The verdict in three sentences
The website of an environmental testing laboratory in Berlin does not need health-data-certified hosting, which is meant for patient data: German hosting with Hetzner or IONOS at EUR 20 to 90 a month is enough. Compliance happens elsewhere: a record of processing activities, a compliant cookie banner (rejecting as easy as accepting), daily backups and signed data processing agreements. The compliance budget is EUR 1,500 to 3,000, one-off.
Which hosting to choose in 2026
An environmental lab publishes its accreditations and test methods and receives quote requests from municipalities and manufacturers. Some public buyers require hosting in Germany or the EU in their tender specifications. Here are the realistic options, as 2026 order-of-magnitude figures excluding VAT.
| Option | Indicative 2026 price | Location | Suited to |
|---|---|---|---|
| Shared hosting (IONOS, all-inkl) | EUR 8 to 20/month | Germany | Light brochure site, low traffic |
| Cloud VPS Hetzner or IONOS (2 to 4 vCPU) | EUR 20 to 45/month | Falkenstein, Nuremberg, Berlin | Brochure site + forms + simple client area |
| Managed instance (German managed host) | EUR 45 to 90/month | Germany | Updates and monitoring included |
| Health-data-certified hosting (C5 or equivalent) | EUR 150 to 600/month | Germany | Only for health data (not applicable here) |
| US provider (EU region) | EUR 15 to 80/month | EU, company subject to US law | Possible, but must be justified in the record |
For a lab with 20 to 50 staff, a German VPS at EUR 20 to 45 a month is usually the right trade-off, with an off-site daily backup (EUR 3 to 10 a month extra).
What GDPR compliance really costs
GDPR is not something you buy with a hosting plan: it is a set of documents and settings. A quality manager used to ISO 17025 will recognise the logic: document, trace, verify.
| Item | What to do | Indicative cost (provider) |
|---|---|---|
| Record of processing activities | List quote forms, newsletter, applications, analytics | EUR 300 to 600 |
| Cookie banner compliant with TDDDG and GDPR | "Reject all" at the same level, proof of consent | EUR 200 to 500 + EUR 0 to 15/month for the tool |
| Consent-free analytics | Privacy-friendly tool (configured Matomo, Plausible) | EUR 150 to 300 |
| Privacy policy and Impressum | Purposes, retention, rights, host | EUR 300 to 600 |
| Data processing agreements (DPA) | Host, email tool, CRM | EUR 150 to 400 |
| Security: HTTPS, updates, tested backups | Written procedure, restore tested twice a year | EUR 400 to 600 |
| Total | EUR 1,500 to 3,000 |
Fines for non-compliant cookie banners can reach hundreds of thousands of euros for large players; for an SME, the realistic risk is a regulator's order, competitor warning letters (Abmahnungen) and losing a public contract for lack of written guarantees.
Is environmental lab data sensitive?
Soil, water or air test results are not personal data, unless they identify a private individual (a private well water test with a name and address). In that case, the report download area must sit behind authentication and files must be kept for a defined period, for example 5 years. Health data does not occur in this line of work, so health-grade hosting remains out of scope.
Mini case study
Katrin, quality manager at a 35-person environmental testing lab in Berlin, compares two scenarios over 3 years.
Need a professional website?
Kolonell builds websites that attract clients, optimized for the Sénégalese market. Free quote in 2 minutes.
- Scenario A, health-data-grade hosting as a precaution: EUR 250 a month, so EUR 9,000 over 3 years.
- Scenario B, German VPS at EUR 35 a month + backup at EUR 8 a month: 43 x 36 = EUR 1,548 over 3 years, plus EUR 2,200 of compliance work, so EUR 3,748.
- Saving with scenario B: EUR 5,252 over 3 years, with compliance actually documented.
Katrin can also attach the record and backup procedure to her responses to municipal tenders in Berlin and Brandenburg.
FAQ
Is hosting in Germany mandatory?
No, GDPR allows hosting anywhere in the EU. Some public buyers still require it in their specifications, and a German VPS costs only EUR 20 to 45 a month.
Do we need a Data Protection Officer?
In Germany, a DPO is required once 20 or more people regularly process personal data. A 35-person lab will often qualify; an external DPO costs around EUR 150 to 400 a month.
Is Google Analytics forbidden?
No, but it requires prior consent. A correctly configured privacy-friendly tool can reduce the dependency on consent and keep close to 100% of audience measurement.
How often should the site be backed up?
A daily backup, kept for 30 days and stored off the main server, is the norm. Test a restore at least twice a year and log the result.
How long can quote requests be kept?
For a prospect who did not follow up, around 3 years after last contact is a common benchmark. For a client, retention follows the contract and the 10-year commercial record-keeping obligations.
Let's scope your project. Send us the list of your current forms and tools: we quote EU hosting and GDPR compliance for your site from EUR 1,500 to 3,000, completed in 3 to 4 weeks. Detailed quote within 48 h. WhatsApp +221 77 596 93 33.
Mohamed Bah
Fondateur, Kolonell
Passionate about digital and entrepreneurship in Africa, Mohamed has been helping Sénégalese businesses with their digital transformation since 2020. Founder of Kolonell, he believes every SME deserves a professional and accessible online présence.
