Data Protection Act 2018 and the DPC: GDPR-ready hosting and Article 28 processor agreements in Ireland

A practical guide for Irish businesses that host a website, online shop or SaaS application and want to understand what the GDPR and the Data Protection Act 2018 mean for the hosting contract. This page is general information, not legal advice. Position as of 30.09.2026.

Short answer

1. 1In Ireland the GDPR is the main rulebook and the Data Protection Act 2018 (Act 7 of 2018) adds national provisions. The Data Protection Commission (DPC), established by section 10 of the Act, is the supervisory authority.
2. 2If you use a hosting provider to store or process personal data for your business, you are normally the controller and the provider is a processor. Article 28 GDPR requires a binding contract between you.
3. 3That contract must cover the subject matter, duration, nature and purpose of the processing, the type of personal data, the categories of data subjects and your rights and obligations as controller.
4. 4Choosing a provider is a controller decision: you must use only processors that give sufficient guarantees of appropriate technical and organisational measures. A provider cannot take that accountability off you.
5. 54hosting runs its servers in Frankfurt, not in Ireland, and offers a DPA under Article 28 GDPR.

How the Act and the GDPR fit together

The GDPR applies directly in Ireland. The Data Protection Act 2018 (Act 7 of 2018) gives further effect to it at national level. Section 10 of the Act establishes the Data Protection Commission, the body that supervises data protection law in Ireland. The text is published on the Irish Statute Book.

For a hosting customer the practical rules come mainly from the GDPR itself. You decide why and how personal data is processed, so you are the controller. The provider that stores or runs that data on your instructions is a processor.

What an Article 28 processor agreement must contain

The DPC publishes a Practical Guide to Controller-Processor Contracts. It lists the minimum content that Article 28(3) requires in the contract:

• the subject matter, duration, nature and purpose of the processing;
• the type of personal data processed;
• the categories of data subjects;
• the obligations and rights of the controller.

The same Article sets out the processor's duties, among them processing only on documented instructions, confidentiality for authorised persons, appropriate security measures, conditions for engaging sub-processors and assistance to the controller. Read the DPC guide and Article 28 alongside the provider's DPA and compare them clause by clause.

Breaches, location and transfers

The DPC states that organisations must report a personal data breach that presents a risk to individuals to the supervisory authority within 72 hours of becoming aware of it. Where the risk is high, the affected individuals must also be informed without undue delay. Under Article 33(2) GDPR a processor must notify the controller without undue delay after becoming aware of a breach. Agree in advance who contacts whom and how.

Location matters for transfers. Chapter V of the GDPR governs transfers of personal data to third countries and international organisations. The 4hosting datacentres are in Frankfurt, inside the EU. Still ask every provider which sub-processors it uses and whether any support or administrative access comes from outside the EEA, because that is where a transfer tool such as standard contractual clauses may be needed.

Three Irish scenarios

Common mistakes

• Assuming that a provider's privacy policy is a processor agreement. Article 28 asks for a binding contract or other legal act.
• Signing a DPA but never checking where the data is stored, who the sub-processors are and how a breach would be reported to you.
• Having no internal procedure for breaches. A controller must notify the DPC within 72 hours of becoming aware of a breach that presents a risk to individuals, where feasible, and the processor must tell you without undue delay.
• Believing that EU hosting outside Ireland needs a transfer mechanism. Chapter V of the GDPR applies to transfers to third countries or international organisations. Check sub-processors and support access outside the EEA separately.
• Treating the DPA as a one-off signature instead of reviewing it when services, locations or sub-processors change.

How 4hosting helps

• Servers in EU datacentres in Frankfurt. There is no datacentre in Ireland, and Irish customers should choose on that basis.
• A data processing agreement (DPA) under Article 28 GDPR and standard contractual clauses (SCC) for transfers where they are needed.
• Alignment with ISO 27001. This is not an ISO 27001 certificate.
• DevOps and CyberSecurity hours included in your plan, for example Hardening & Compliance, WAF & DDoS and SIEM & Incident Response. You request them from the client panel.
• Support in English.
• 4hosting is not a compliance certifier and does not sign legal compliance on your behalf. Your organisation remains responsible as controller.

FAQ

See also

• NIS2 in Ireland and what it means for your hosting provider
• VPS NVMe in EU datacentres
• Contact us to request the DPA