I'm creating a new privacy document based on the GDPR.

I have a site which collects some personal data (first name, last name, location, etc). My site (including database) is hosted by a hosting company, they undoubtedly have access to my server.

Now I need to document whom I'm sharing the personal information with. I'd like to market my site as "We don't share your information with third parties.".

Although I'm now not entirely sure anymore. Is this hosting company, legally speaking, a 'third party'?


Not really sharing, because the may not legally be allowed to access the data. Depends on your jurisdiction - in the EU you would have to make sure they are contractually bound to keep that data secret and are not under higher jurisdiction that says otherwise. That is why serious hosting company's usually have documents prepared for that. Maybe you could still be "not sharing" if you made sure the date on the server is properly encrypted? Or get your own Server at a co-location.

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.