Short answer: A self-hosted Nextcloud on a server in Germany is easier to handle under data protection law than a cloud subscription in a third country — but it is not automatically GDPR-compliant. You still need a data processing agreement with the data centre, a record of processing activities, a deletion policy, and access rights that actually match reality.
The common misconception: “the server is in Germany, so we are fine.” The server location solves exactly one issue — third-country transfer. The remaining obligations stay.
The processing agreement applies to self-hosting too
As soon as your server sits with a provider, that provider processes personal data on your behalf — if only because it has physical access to the machine. Article 28 GDPR requires a processing agreement for that.
Every larger German provider offers one, usually self-service in the customer account. The point is not that it is hard to get — the point is that it is routinely forgotten, because self-hosters do not think of themselves as controllers commissioning a processor.
What else belongs in the record
- Purpose: what the Nextcloud is used for — file storage, calendar, contacts, each listed separately.
- Categories of data subjects: employees, customers, applicants.
- Retention periods: per category, not blanket.
- Recipients: including the host and any external maintenance provider.
Encryption: three layers that get confused
“Encrypted” is not one property but three different things. Confusing them means promising more in your privacy policy than the system delivers.
Transport encryption
TLS between browser and server. Mandatory, uncontroversial, free with Let's Encrypt. Also check that outdated protocol versions are disabled — see hardening Nginx.
Encryption at rest
The server's disk. Protects against theft of the medium, not against an attacker with access to the running system. The distinction matters because it bounds what the measure actually protects.
Nextcloud's server-side encryption
Nextcloud ships its own encryption module. It protects files against the storage backend — useful when data sits on third-party object storage. If everything is on your own server it adds little and complicates restores. Turn it on deliberately or off deliberately, not by feel.
Access rights that match reality
The most common audit finding is not a technical fault but accumulated drift: folders meant “for management only” that everyone can read. Share links without expiry. Accounts of people who left the company.
- Enforce an expiry date on share links.
- Allow public uploads only where they are needed.
- Require two-factor authentication for every account with admin rights.
Deleting means actually deleting
Nextcloud has a trash bin and file versioning. Both are useful, and both mean a deleted file is not gone yet. For access and erasure requests under Articles 15 and 17 GDPR you need to know how long each is kept — and the period has to match your deletion policy, not the default setting.
Remember backups too. A file deleted from Nextcloud still sits in the backups. That is permissible, but it has to be described in the deletion policy, together with the period after which the backup itself expires.
Logging: as much as necessary
Access logs help investigate incidents and are themselves personal data. Set a retention period, truncate IP addresses where you can, and describe both in the record. Unlimited logs “just in case” are the case that gets held against you in an audit.
Conclusion
Server location is the easy part. The work sits in the processing agreement, the deletion policy, and access rights that match what your privacy policy claims.
We set up such installations including the documentation — see DevOps & Automation. If you would first like to know where an existing system stands, a security test is a more honest starting point than a fresh install.