If you handle personal data of EU residents, GDPR applies regardless of where your server is located. This guide covers the technical infrastructure considerations relevant to self-hosted VPS environments — not legal advice, but a starting point for the technical side of compliance.
Important Disclaimer
This article covers technical infrastructure practices relevant to GDPR, not legal compliance advice. Consult a qualified privacy professional or lawyer for your specific legal obligations.
Core GDPR Principles Relevant to Infrastructure
- Data minimization — only collect and store personal data you actually need
- Security of processing — implement appropriate technical measures to protect personal data
- Right to erasure — be able to actually delete a specific individual's data on request
- Data breach notification — be able to detect and respond to breaches within required timeframes
Technical Measures to Consider
Encryption at Rest and in Transit
- HTTPS for all data transmission — see How to Install Let's Encrypt SSL with Certbot
- Encrypted backups containing personal data — see Backup Encryption: Protecting Your Backups from Unauthorized Access
- Consider disk-level encryption for the VPS itself where supported
Access Control
- Restrict database and application access to only staff who genuinely need it
- Use individual accounts, not shared credentials — enables accountability
- See Database Security Checklist: Protecting MySQL, PostgreSQL & MongoDB
Audit Logging
Maintain logs of who accessed what personal data and when — see How to Install and Configure auditd for System Auditing.
Data Retention
Implement technical processes to actually delete data once it's no longer needed, rather than accumulating it indefinitely — this requires both application-level logic and awareness of where data lives, including in backups.
Right to Erasure in Practice
Consider how you would actually locate and delete a specific individual's data across your primary database, backups, and logs — document this process, since it needs to be executable, not just theoretical.
Data Location Considerations
GDPR has specific requirements around transferring personal data outside the EU/EEA — if your VPS or backup destinations are located outside these regions, understand the specific legal mechanisms (adequacy decisions, standard contractual clauses) that may apply to your situation.
Breach Notification Readiness
GDPR requires notifying relevant authorities within a specific timeframe of becoming aware of a breach involving personal data. Being able to actually detect a breach quickly depends on:
- Intrusion detection — see How to Monitor Auth Logs and Detect Intrusion Attempts
- File integrity monitoring — see How to Set Up File Integrity Monitoring with AIDE
- A documented incident response process — see How to Recover from Ransomware or a Compromised VPS
Documenting Your Technical Measures
Maintain documentation of the security measures you've implemented — this supports the "accountability" principle and is often required during any regulatory inquiry or audit.
Common Technical Gaps
- Personal data in backups that isn't covered by the same deletion/retention policy as production data
- Overly broad database access privileges beyond what's actually needed
- No documented process for actually fulfilling a data subject access or erasure request
Continue Reading
- Database Security Checklist: Protecting MySQL, PostgreSQL & MongoDB
- Backup Encryption: Protecting Your Backups from Unauthorized Access
- How to Install and Configure auditd for System Auditing
Browse more articles in Advanced Security & Compliance.
