EU Hosting and GDPR for a Company Website: OVH vs AWS in Berlin (2026)

The verdict in three sentences

Hosting on AWS in an EU region is not illegal under GDPR, but it requires a transfer assessment because the parent company remains subject to US law. For a mid-sized company website that collects forms, a VPS or managed instance at OVHcloud or Scaleway costs EUR 60 to 120 a month and simplifies compliance paperwork. The real risk is not the provider but missing records, processing agreements and encryption.

Provider comparison in 2026

The three most common options for a European company have different legal and pricing profiles.

AWS remains relevant if the company already uses its ecosystem (CDN, queues, AI). For a corporate site with contact and recruitment forms, a European provider reduces the documentation burden.

What GDPR says about hosting outside the EU

Since July 2023, the Data Privacy Framework allows transfers to certified US companies. It is still contested and could be struck down like Safe Harbor and Privacy Shield before it. In practice, a CFO should check:

• the provider's and its sub-processors' DPF certification;
• a signed data processing agreement (Article 28);
• standard contractual clauses as a fallback;
• encryption of data at rest, ideally with customer-managed keys;
• the host listed in the record of processing and the privacy policy.

GDPR fines can reach EUR 20 million or 4 % of global turnover. In practice, fines against SMBs and mid-sized firms in 2024 and 2025 mostly ranged from EUR 10,000 to 500,000, often for security failures or excessive retention.

3-year total cost by plan

Migrating a corporate site from AWS to OVHcloud or Scaleway usually takes 2 to 4 weeks, including testing and DNS cutover.

Mini case study

Thomas, CFO of a 320-employee food manufacturer in Berlin, hosts his website on AWS for EUR 420 a month, plus EUR 180 of DevOps services. The site receives 900 job applications and 400 sales inquiries a year.

Migration to a managed Scaleway instance: EUR 4,500 once, then EUR 95 for hosting and EUR 190 for maintenance a month, EUR 285 in total. Monthly saving: EUR 315, or EUR 3,780 a year. The migration pays back in 14 months, and the compliance file (records, Article 28 agreement) gets simpler: about 2 days of legal work avoided, roughly EUR 1,600 of counsel fees.

FAQ

Is hosting my site on AWS in the EU GDPR-compliant?

Yes, provided you document the potential transfer: DPF certification, Article 28 agreement and standard clauses. Legal risk exists if the DPF is struck down, as Privacy Shield was in 2020.

What hosting budget for a mid-sized company site in 2026?

Count EUR 40 to 90 a month for the instance at a European provider, and EUR 150 to 250 with maintenance. A heavily used or application-driven site can exceed EUR 500.

Is SecNumCloud mandatory for a company website?

No, it mainly targets public administrations and critical operators. A private mid-sized firm does not need it for a corporate site, unless a public-sector client requires it.

How much does a hosting migration cost?

Between EUR 1,500 and 6,000 depending on site size and integrations. Plan 2 to 4 weeks and a cutover outside peak sales periods.

Should forms be encrypted?

HTTPS is mandatory, and encryption at rest is strongly recommended for CVs and sensitive data. Also set a retention period, for example 24 months for applications.

Let's scope your project. We audit your current hosting, price a migration to OVHcloud or Scaleway and prepare the GDPR paperwork, with an indicative budget of EUR 1,500 to 6,000 and a 2 to 4 week timeline. Detailed quote within 48 h. WhatsApp +221 77 596 93 33.