GDPR Optimised Hosting

The General Data Protection Regulation (GDPR) is a set of regulations with the objective to protect the personal information and privacy of individuals in the United Kingdom, European Union (EU) and European Economic Area (EEA). GDPR applies to all organisations that offer goods or services or monitor the online behaviour of UK and EU citizens.

“Data processing” refers to the collection and subsequent processing of personal information such as name, email address, IP address, and location. Under GDPR this data may only be captured with consent and must be processed fairly, securely, transparently, and lawfully, and only be stored as long as it is required.

As a GDPR-optimised web hosting service provider, Storm has the following GDPR-related responsibilities:

• Data Protection. With extensive cutting-edge security measures in place, Storm gives your security a powerful boost out of the box. This includes firewalls, encryption, 24/7 monitoring and surveillance, intrusion detection, regular security audits, and more.
• Data Processing Agreement (DPA). Storm’s GDPR Statement sets out Storm’s responsibilities and liabilities pertaining to data storage and processing under the GDPR.
• Data Processing. You are the owner of the data submitted to Storm, whether on our servers or your on-premise infrastructure. We do not access the data you submit to Storm. Any data processing that may occur is only done so in relation to the services we offer. Nor is your data shared with third parties, unless lawfully required.
• Data Transfers. All your data is stored on UK-based hardware owned and maintained by Storm Internet. This hardware is co-located in the UK at our ISO 27001-certified data centres. All your data is stored in the UK, and therefore not transferred outside the EEA.
• Data Breaches. We’ve made significant investments to keep your data safe. In the unlikely event of a breach, we’ll notify you within 48 hours of the discovery of the breach.

The UK GDPR applies when:

• You are physically located in the United Kingdom. The UK GDPR applies even when the data is processed outside the UK.
• You are located outside the United Kingdom, but process the personal data of UK-based individuals. This is especially the case if the processing activities are related to the offering of goods or services to individuals in the UK, or the monitoring of their behaviour within the UK.

If any of the above is true, then you’ll benefit from GDPR-optimised hosting.

Given that the EU GDPR is a European Union regulation it doesn’t apply to the UK, and you’ll instead be required to comply with the Data Protection Act 2018. However, the EU GDPR may still apply to your business if you operate in the European Economic Area (EEA).

Provisions of the EU GDPR are now part of the UK GDPR, with very few differences between the two.

Within the context of GDPR web hosting, you are the data controller and Storm Internet is the data processor. A data controller determines how data is processed. The data processor processes data on behalf of the data controller. As such, your responsibilities include:

• Obtaining valid consent from individuals whose data you collect and store.
• You are also required to provide transparency with regard to how personal data is processed
• Individuals should also be able to access, rectify, erase, restrict, or object to the processing of their personal data
• You’ll also need to perform periodic impact assessments to determine the risk associated with the collection and processing of sensitive data. This is especially relevant if where changes are made to the underlying technology used to capture and process data
• Should you suffer a breach, you’ll be required to notify the ICO as well as affected individuals within 72 hours of learning of such a breach
• You may need a cookie consent banner if you use cookies or other technologies capable of collecting information from individuals. Cookies are small text files that can be used for a variety of purposes, such as remembering preferences, tracking technical information about the individual, and direct marketing, to name a few.

The risks of not complying with GDPR regulations can have potentially disastrous implications. These can include:

• Fines or penalties up to 4% of your annual global turnover or £17.5 million, whichever is greater.
• Reputational damage (e.g. media publications reporting the breach) and loss of trust from visitors, users, and other stakeholders
• Legal actions filed by affected individuals

You can minimise potential risks by signing up for Storm’s GDPR-optimised hosting. We can also provide you with expert guidance on all your GDPR-related queries.