To host Moodle in Europe under GDPR, keep the servers, database, files and backups in an EU data centre, sign a data processing agreement with your host, and make sure the host handles the firewall, patching, backups and access logs. Hetzner (Germany and Finland) suits most Moodle sites; AWS Europe (Milan) suits teams that want AWS managed services or an Italian location. EDZLMS has hosted Moodle in the EU for around 12 years on both, taking care of data privacy, the firewall and GDPR, and hosts its edzlms learning platform the same way.
Key takeaways
- Keep everything in the EU: the Moodle server, database, moodledata files and every backup copy.
- Hetzner gives EU data residency on dedicated or cloud servers in Germany and Finland; AWS Milan adds managed services and autoscaling in Italy.
- GDPR needs more than location: a data processing agreement, security measures, breach reporting and help with data subject requests.
- Moodle's Privacy API and Data privacy tool (since 3.5) cover data requests and retention, but they must be configured.
- EDZLMS has hosted Moodle in the EU for around 12 years on Hetzner and AWS Milan, covering the firewall, privacy and GDPR, with backups kept in the EU.
What GDPR-ready Moodle hosting actually means
Moodle stores a lot of personal data: names, emails, grades, quiz attempts, forum posts, submitted files and activity logs. Under the EU General Data Protection Regulation (GDPR), your institution or company is the controller of that data and your hosting provider is a processor. That gives the host specific duties, and gives you specific things to check.
| Requirement | What it means for Moodle hosting |
|---|---|
| Data location | Server, database, moodledata folder and backups all in an EU data centre, written into the contract |
| Data processing agreement (GDPR Art. 28) | A signed contract covering purpose, security, sub-processors, breach help and deletion at the end |
| Security of processing (Art. 32) | Firewall, encrypted connections (HTTPS), restricted and logged admin access, timely Moodle and OS security updates, tested backups |
| Breach notification (Art. 33) | The host tells you quickly so you can notify the regulator within 72 hours where required |
| Data subject rights | Moodle's Data privacy tool set up so you can export or delete one person's data on request |
| Retention | Retention periods set in Moodle's data registry, and old backups expired on schedule |
General information, not legal advice. Your data protection officer should confirm what applies to you.
Hetzner or AWS Milan: where to host Moodle in Europe
| Hetzner | AWS Europe (Milan) | |
|---|---|---|
| Locations | Nuremberg and Falkenstein (Germany), Helsinki (Finland) | Milan, Italy, with three availability zones |
| Best for | Most universities, schools, training companies and businesses that want EU residency on solid servers | Organisations already on AWS, very large exam peaks, or a requirement for data in Italy |
| Server options | Dedicated servers and cloud servers, load balancers, private networks | EC2 servers, managed databases (RDS), managed Redis, shared file storage, autoscaling |
| Scaling | Add servers as you grow; very good performance per server | Autoscale app servers for exam days; managed failover |
| Things to plan | Your host configures backups, failover and monitoring | More moving parts; AWS is a US company, so check its data processing terms |
Both are good homes for Moodle. The bigger difference is usually the team running it: who applies security updates, watches the firewall, tests restores and upgrades Moodle on time. For costs, see each provider's own pricing pages: hetzner.com and aws.amazon.com/pricing.
Recommended configurations
Starting points for Moodle 5.3 LTS in an EU region. Size for the number of people active at the same time, then load-test with your own courses.
Up to 500 users: one well-tuned server on Hetzner
| Component | Recommendation |
|---|---|
| Server | 4 vCPU, 16 GB RAM in Nuremberg, Falkenstein or Helsinki |
| Software | Ubuntu 24.04 LTS, Nginx, PHP-FPM 8.3, MariaDB/MySQL or PostgreSQL, Redis for cache and sessions |
| Security | Firewall allowing only web traffic and restricted admin access, HTTPS, key-only server login, automatic OS security updates |
| Backups | Daily database and moodledata backups to a second EU location, restore tested regularly |
| Privacy | Moodle Data privacy tool configured, retention periods set, admin access logged |
Scalable setup: Hetzner or AWS Milan
| Layer | On Hetzner | On AWS Milan |
|---|---|---|
| Traffic | Hetzner load balancer | Application Load Balancer |
| App servers | Two or more cloud or dedicated servers with Nginx and PHP-FPM 8.3 | Two or more EC2 instances in an autoscaling group across availability zones |
| Database | Dedicated database server with a replica | Amazon RDS (MariaDB/MySQL or PostgreSQL) with Multi-AZ |
| Cache and sessions | Dedicated Redis server | Amazon ElastiCache for Redis |
| Files (moodledata) | Shared NFS or S3-compatible object storage | Amazon EFS or S3-compatible storage |
| Background jobs | Cron on one worker server | Cron on one worker instance |
| Backups | Daily, to a second EU location | Daily snapshots, kept in the EU |
For sizing detail, see our Moodle server architecture guide. Hosting in India instead? See Moodle hosting in India.
Check where your backups go
The most common GDPR gap in Moodle hosting is not the live server but the backups. Make sure every copy, including off-site backups and snapshots, stays in the EU and is deleted on schedule.
- 1Which EU data centre will host our Moodle and backups?
Get the provider, city and backup location in writing.
- 2Will you sign a GDPR data processing agreement?
It should list sub-processors such as Hetzner or AWS, security measures, breach notification and deletion at contract end.
- 3How is the server protected?
Ask about the firewall, how admin access is restricted and logged, and how fast security updates are applied.
- 4How quickly will you tell us about a breach?
You may need to notify your regulator within 72 hours, so the host must report much faster than that.
- 5Is Moodle's Data privacy tool set up?
You should be able to export or delete one learner's data and apply retention rules.
- 6Which Moodle version and upgrade plan?
Expect Moodle 5.3 LTS in 2026, with upgrades tested on a staging copy first.
- 7Can we leave with all our data?
Confirm you get a full database dump and moodledata files on request, with copies deleted afterwards.
How EDZLMS hosts Moodle in Europe
EDZLMS has hosted Moodle in the EU for around 12 years. We run sites on Hetzner in Germany and Finland and on AWS Europe (Milan), and take care of the parts that make hosting GDPR-ready: the firewall and server hardening, data privacy settings in Moodle, GDPR, monitoring and Moodle upgrades. For sites on EU servers, every backup is kept in the EU too. For Indian organisations hosted in India, servers and backups stay in India and we follow the Digital Personal Data Protection (DPDP) Act. We host our own AI learning platform, edzlms, the same way, so organisations that want AI course creation, Gelato AI roleplay practice or managed Moodle can keep learner data in the EU either way. See Moodle development and hosting, DevOps support and security.
Frequently asked questions
Who offers GDPR-ready Moodle hosting in Europe?
Moodle can be hosted in the EU by Moodle HQ's MoodleCloud, by Moodle Certified Partners listed on moodle.com, and by independent Moodle specialists. EDZLMS has hosted Moodle in the EU for around 12 years on Hetzner (Germany and Finland) and AWS Europe (Milan), handling the firewall, data privacy and GDPR, keeping backups in the EU, and also hosts its own learning platform, edzlms.
Is Hetzner good for Moodle hosting?
Yes, for most institutions and businesses. Hetzner runs its own data centres in Nuremberg and Falkenstein in Germany and in Helsinki, Finland, so data stays in the EU, and its dedicated and cloud servers suit Moodle well. You still need someone to configure the server, firewall, backups and Moodle upgrades.
Can Moodle be hosted on AWS in Italy?
Yes. AWS Europe (Milan) opened in April 2020 with three availability zones, so a Moodle site can run there with its database, files and backups kept in Italy. It suits organisations that want AWS managed services, autoscaling for exam peaks or an Italian data location.
Does GDPR require Moodle data to be stored in the EU?
Not strictly. GDPR allows transfers outside the EU with safeguards, but hosting in the EU keeps learner data under EU rules by default and removes most transfer questions. Many universities and companies require EU hosting in their contracts for that reason. This is general information, not legal advice.
Is Moodle GDPR compliant?
Moodle has had a Privacy API and a Data privacy tool since version 3.5, which help you handle data requests, record what personal data is stored, and set retention rules. Compliance also depends on how you configure and host it, who can access it, and your contracts, including a data processing agreement with your host.
Hetzner or AWS Milan for Moodle?
Hetzner is a strong fit for most Moodle sites that want EU data residency and predictable server resources. AWS Milan suits organisations already on AWS, those needing managed databases and autoscaling for big exam peaks, or those that specifically want data in Italy.
What should a data processing agreement with a Moodle host cover?
Under GDPR Article 28 it should cover what data is processed and why, security measures, staff confidentiality, any sub-processors such as the data centre provider, help with data subject requests, breach notification, and deletion or return of data at the end of the contract.
Can an Indian company host our Moodle in Europe?
Yes. Where the servers sit decides where the data is stored, not where the support team is. EDZLMS is based in Bengaluru and has hosted Moodle on EU servers for around 12 years, taking care of the firewall, data privacy and GDPR, with backups kept in the EU. Ask any host, wherever it is based, for clear terms on data location and who can access the data.
Where are backups kept when EDZLMS hosts Moodle?
In the same region as the site. For Moodle or edzlms on EU servers, backups stay in the EU. For Indian organisations hosted in India, servers and backups stay in India, following the DPDP Act.
Host Moodle or edzlms in the EU
Tell us your number of learners, your busiest windows and whether you prefer Germany, Finland or Italy. We'll recommend a GDPR-ready setup on Hetzner or AWS Milan.