When the GDPR reaches a course seller outside the EU
The European Commission says a company established outside the EU is covered when it offers goods or services, paid or free, to individuals in the EU, or monitors their behaviour. It also says a non-EU provider that does not specifically target individuals in the EU is not subject to the GDPR just because EU residents use its service while travelling.
A course priced in euros, marketed to EU audiences, or with EU-specific checkout options points toward targeting. If you are unsure whether you target EU students, that is the first question for an adviser.
You are the controller; your host is the processor
The Commission defines the controller as the party that decides the purposes and means of processing, and the processor as the party that processes personal data only on the controller’s behalf. For a course site, you decide what student data to collect and why, and your host stores and serves it for you.
The relationship needs a contract or other legal act. The Commission lists what it must cover: processing only on documented instructions, confidentiality for authorised staff, appropriate security measures, help with your GDPR obligations, and what happens to the data when the contract ends. That contract is what hosts publish as a DPA or data processing addendum.
What five hosts publish
The table summarises each host’s public terms and region options as published on October 29, 2026. It is a starting point for your own reading, not an assessment of whether any host is compliant.
| Host | Data processing terms | EU or nearby regions published | Region choice |
|---|---|---|---|
| Kinsta | DPA is an addendum to the terms of service and part of the agreement; standard contractual clauses (Modules 2 and 3) apply to international transfers | Amsterdam, Frankfurt, Madrid, Milan, Paris, Stockholm, Zurich, plus London | Chosen when creating a site; the DPA lets customers select the region but notes some parts of the service may still involve international transfers |
| WP Engine | DPA forms part of the agreement; standard contractual clauses and a UK addendum for restricted transfers | Google Cloud: Belgium, London, Netherlands and Finland, with Frankfurt on upgraded or premium plans; AWS and Azure European regions on premium plans only | Shared plans default to the Google Cloud region closest to you at signup; moving region is a support-led migration |
| DigitalOcean | DPA is an addendum to the customer terms; relies on the EU-U.S. Data Privacy Framework, with standard contractual clauses as fallback | Droplets in Amsterdam (AMS3), Frankfurt (FRA1) and London (LON1) | You choose the region for each Droplet |
| SiteGround | States it offers data processing agreements; privacy policy cites standard contractual clauses and EU-U.S. Data Privacy Framework participation | Says it has data centers in Europe and that EU customers can choose one to keep data in the EU | Chosen at signup; everything in the account lives in that data center, but the page does not say whether backup copies and CDN caches stay in the region |
| Liquid Web | Terms require you to notify Liquid Web and execute a DPA before using the services with GDPR-protected data | Amsterdam and London (services are otherwise US-hosted, plus Sydney) | Ask at order time |
What an EU data center does and does not settle
Choosing an EU region keeps the primary copy of your WordPress database and files in the EU. That is useful: it simplifies your records, may reduce transfer questions for that system, and is what many students expect.
It does not settle transfers to the host’s group companies and sub-processors, who may provide support or infrastructure from elsewhere; hosts publish sub-processor lists for that reason. It does not cover the other systems that hold student data, such as Stripe or PayPal, your email platform, video host, analytics and any CDN. And it does not cover your lawful basis, privacy notice, retention periods or how you answer access and deletion requests.
Transfers to some non-EU countries are simpler than others. The Commission’s adequacy list includes the United Kingdom and Switzerland, and the United States only for commercial organisations participating in the EU-U.S. Data Privacy Framework, under a decision dated 10 July 2023. A US vendor outside that framework needs another transfer mechanism, typically standard contractual clauses.
Map where student data actually lives
| System | Typical student data | What to check |
|---|---|---|
| WordPress and LMS database | Names, emails, progress, quiz answers, certificates | Host region, DPA, sub-processors |
| Host backups | Full copies of the above | Where backups are stored and for how long |
| Payment processor | Billing details, transaction history | The processor’s own terms and transfer mechanism |
| Email platform | Emails, engagement data | DPA and region options |
| Video host | Viewing data, IP addresses | DPA and where viewing logs are processed |
| Analytics and CDN | IP addresses, device data | Whether you need them; consent requirements |
Checklist before you migrate or launch
- Decide whether you target EU students; if yes, plan for the GDPR.
- Read the host’s DPA and note whether it applies automatically or needs signing; Liquid Web’s terms require it before use.
- Choose the EU region at site creation; on WP Engine, changing later is a support-led migration.
- Save the host’s sub-processor list and check it when notified of changes.
- Ask where backups are stored and how long they are kept.
- List every other tool holding student data and file its DPA.
- Update your privacy notice to name processors and international transfers.
- Set retention periods for inactive students and test deleting one account end to end.
Questions before you decide
Is hosting in the EU enough to be GDPR compliant?
No. Region choice affects where the primary copy of your site data lives, but your obligations also cover lawful basis, transparency, retention, security and every other processor that holds student data.
Do I need to sign a DPA with my host?
It depends on the host. Kinsta and WP Engine describe their DPAs as part of the agreement; Liquid Web’s terms require a DPA to be executed before using the services with GDPR-protected data.
Sources & verification
Product details and prices can change. Check the linked provider before buying.
- European Commission: Application of the GDPR Accessed 29 Oct 2026
- European Commission: What is a data controller or a data processor? Accessed 29 Oct 2026
- European Commission: Adequacy decisions Accessed 29 Oct 2026
- Kinsta: Data processing agreement Accessed 29 Oct 2026
- Kinsta Docs: Data center locations Accessed 29 Oct 2026
- WP Engine: Data privacy addendum Accessed 29 Oct 2026
- WP Engine Support: Change a website data center location Accessed 29 Oct 2026
- DigitalOcean: Data processing agreement Accessed 29 Oct 2026
- DigitalOcean Docs: Regional availability Accessed 29 Oct 2026
- SiteGround: Data centers Accessed 29 Oct 2026
- SiteGround: Privacy policy Accessed 29 Oct 2026
- Liquid Web: Terms of service Accessed 29 Oct 2026
Sources link directly to providers. Product buttons may use separately labeled affiliate links. Read our disclosure.