OVH and personal data protection

The OVHcloud “Data Processing Agreement” is evolving

The OVHcloud Data Processing Agreement (“DPA”) is evolving in order to reflect the new requirements of the GDPR applicable to Personal Data transfer to third countries, in particular the Commission's implementing decision (EU) 2021/914 on standard contractual clauses published for the transfer of personal data to third countries pursuant to Regulation (EU) 2016/679 of the European Parliament and of the Council (GDPR) which has been adopted by the European Commission on June 4, 2021.

Click here to consult the new version of the DPA effective as of September 27, 2021.

Please note that if you use or intend to use OVHcloud services located in non-European data centers to process Personal Data subjected to the GDPR, the new aforementioned Standard Contractual Clauses have to be implemented as well as any supplementary measures that may be required taking into account the categories of personal data concerned and the law or practices of the third countries. For more information, please contact OVHcloud Data Protection Officer."

If you are not processing Personal Data within OVHcloud Services located in non-European data centers the aforesaid change has no impact.

OVH, founded in 1999, is now one of the leading names in the cloud industry, with a presence in 19 countries around the world. We have over 1 million customers and we take customer data and security extremely seriously.


When you decide to outsource some or all of the hosting for the data that your organisation processes to OVH, you are entrusting us with a share of your information assets. We are aware of the issues that this can represent for your company, particularly when it comes to compliance with the relevant data protection regulations. This is why OVH is providing the most complete information possible on issues concerning the protection of personal data.

Regulations that govern personal data protection

There are currently various documents covering data protection in place at the national, international, and European levels. The most important ones are the following:

OVH undertakes to abide by its obligations in accordance with the aforementioned regulations, particularly the General Data Protection Regulations (GDPR). It's this commitment to compliance in particular which means that OVH's customers can also meet some of their own regulatory obligations. We strongly advise all our customers to be particularly vigilant on these aspects of compliance. Other, more specific regulations may exist, including for certain specific categories of personal data. In such cases, organisations are solely responsible for correctly identifying the regulations applicable to their business activities, and achieving compliance with them. Choosing the right provider, especially when it comes to the cloud, is essential if you want to meet your own obligations on protecting personal data.

OVH's Data Protection Officer (DPO): oversees data protection strategy and implementation to ensure compliance with GDPR.

OVH has appointed a DPO, whose role and aims are partly determined by European regulations. The DPO acts as a fully independent internal watchdog, ensuring that OVH's data processing operations are compliant with all applicable European regulations.

Grégory Gitsels - Data Protection Officer


Grégory Gitsels is totally committed to his objectives and has the resources at his disposal to operate completely independently, without any conflicts of interest. He regularly runs awareness and training sessions for the Group's employees and is there to answer their questions on privacy and data protection. He is in charge of implementing a "privacy by design" and "privacy by default" approach, especially for designing new solutions for customers, he liaises with supervisory authorities and more... He is also the first point of contact for any customers who need guarantees for the measures they have implemented in order to conform with applicable regulations, including the GDPR.