UK GDPR and EU data hosting after Brexit: does hosting in Frankfurt work for UK businesses?

A practical overview for UK businesses with a website, shop or application: what the UK and EU adequacy arrangements mean for an EEA server, and what you still have to check yourself. Position as of 30.09.2026.

Short answer

1Yes, hosting UK personal data in Frankfurt can work: the UK treats all EEA countries as adequate, so a transfer to an EEA server does not need an IDTA or UK Addendum.
2The European Commission renewed its UK adequacy decisions on 19 December 2025, valid until 27 December 2031, so EU-to-UK data flows are also open.
3Adequacy covers the location, not the whole of UK GDPR: you still need a lawful basis, security measures and a written processor contract under Article 28.
4Anything that leaves the EEA (a US analytics tool, for example) needs its own transfer mechanism.
5Your hosting provider does not certify your compliance. You remain the controller and answer to the ICO.

What the legal framework says

Since Brexit the UK has its own regime: the UK GDPR, supervised by the Information Commissioner's Office (ICO). Transfers of personal data out of the UK are restricted unless the destination is covered by UK adequacy regulations or an appropriate safeguard applies. The ICO guidance states that all EEA countries currently have full UK adequacy. Germany and Romania are both in the EEA, so a server in Frankfurt is a transfer the UK already recognises.

The other direction matters if you also serve EU customers. On 19 December 2025 the European Commission renewed its two decisions recognising the UK as adequate. They run until 27 December 2031, with a review committed at the mid-point. That lets EU-origin data flow to the UK without extra safeguards, and means one EU hosting location can serve both audiences.

What adequacy does not cover

Adequacy answers where the data sits. It does not replace the rest of UK GDPR. You still need a lawful basis, data minimisation, appropriate security, and a written contract with any processor under Article 28. If your host stores data on your behalf, it is a processor and the contract must say what it may do, which sub-processors it uses and how it helps with breaches and requests.

Our own position is simple. Our datacentres are in the EU, in Frankfurt, not in the UK. We offer a data processing agreement under Article 28 and SCCs for transfers where they are needed. We are not a compliance certifier: we do not sign off your processing, and we hold no ISO, SOC 2 or Cyber Essentials certificate.

Examples

A Manchester online shop

The shop keeps customer accounts and order history on a VPS in an EEA datacentre. It signs a processor contract, lists the hosting location in its records of processing and checks that its email and analytics tools are covered by a separate transfer mechanism.

A London SaaS start-up with EU customers

The team serves UK and EU users from one EU server. UK-to-EEA transfers rely on UK adequacy regulations and EU-to-UK flows on the Commission decisions, so one hosting location serves both audiences.

A Bristol agency hosting client sites

The agency is a processor for its clients and passes the same obligations down to its host, including a list of sub-processors, so each client's contract still holds.

Common mistakes

Treating an EU server as automatic compliance. Location is one question; lawful basis, minimisation and security are others.
No written processor contract, or one that omits sub-processors and security measures (Article 28).
Forgetting third-party tools that send data outside the EEA, such as chat widgets, email marketing or analytics.
No breach plan. A reportable personal data breach must reach the ICO within 72 hours of becoming aware of it (Article 33), where it is likely to risk people's rights.
Assuming adequacy is permanent. Both directions are political decisions with expiry dates, so note the renewal date in your risk register.

How 4hosting helps

We give you the infrastructure side: EU datacentres, a data processing agreement, backups and DDoS protection. Each plan includes monthly DevOps and security hours, which you can use for hardening, access control and backup checks. Free migration is available when you move from another host. Responsibility for lawful processing stays with you as controller.

Talk to us about your setup

Frequently asked questions

Do I need an IDTA to host UK data in the EU?

Not where you rely on the UK adequacy regulations for the EEA. The ICO states that EEA countries have full UK adequacy, so safeguards such as an IDTA or UK Addendum are not needed for a restricted transfer to an EEA recipient on that basis.

Where are 4hosting servers?

Our datacentres are in the EU, in Frankfurt, not in the UK. We provide a data processing agreement under Article 28 and SCCs for transfers where needed, but you assess compliance of your own processing.

Does 4hosting certify my UK GDPR compliance?

No. A hosting provider is a processor and cannot give legal certification. We hold no ISO, SOC 2 or Cyber Essentials certificate; our controls are aligned with ISO 27001. DevOps hours can help with technical hardening.