Executive Summary: What is it?
The Compliance Shift is what changes in your duties when you run software on your own infrastructure instead of using a provider's service. A provider that processes personal data for you must, by contract, take the security measures the GDPR requires. When you self-host, the work of those duties is yours: securing, patching, backing up and watching the system, and reporting incidents on a legal clock. The duties that come with making and supplying the software stay with its maker, where the law names one.
CFO / Business Impact: What does it cost/risk?
- What You Fund: Each duty below is work for people and tools: someone installs updates, tests restores, watches for incidents and can report one before the legal deadline. The cost grows with the number of systems you run and the sensitivity of their data, and it falls on your team or on a firm you hire to operate the system.
- What You No Longer Sign: When the software runs on your own infrastructure, its maker does not process your data, so you need no processing contract with it, as long as no personal data reaches it, through telemetry or support access. A host that stores your data is your processor (it handles personal data on your behalf) instead.
- Which Rules Bind You: The shift happens whatever the rules; which duties are legally binding depends on your organisation, not on the software. The GDPR applies when the system holds personal data and your organisation is established in the EU, or offers goods or services to people in the EU or monitors their behaviour there. NIS2 applies, through each EU country's own law, to medium-sized and larger organisations in the sectors it lists that operate in the EU, and to some entities whatever their size. Your sector may add its own rules, such as HIPAA, DORA or PCI DSS.
Technical Reality: How does it work?
The operator's checklist. Each duty is yours when you self-host; the law named is where it binds.
- Security Measures: Access control, encryption, and keeping the system confidential, intact and available, at a level that fits the risk (GDPR; NIS2).
- Patching: Handling the vulnerabilities of the systems you run (GDPR; NIS2). A maker's security update protects you only once you install it.
- Backups and Recovery: Restoring data in good time after an incident (GDPR), with backup management and disaster recovery (NIS2).
- Testing: Checking regularly that these measures work (GDPR; NIS2).
- Incident Handling: Detecting and handling incidents (NIS2). You can report only what you detect.
- Reporting: A personal-data breach goes to the data protection authority without undue delay and, where feasible, within 72 hours of becoming aware of it, unless it is unlikely to put people at risk (GDPR). A significant incident under NIS2 takes an early warning within 24 hours, a notification within 72 hours and a final report within one month of the notification. A provider must tell you of a breach it finds; when you self-host, finding it is your job.
- Suppliers: A host, or anyone who operates the system for you, is a supplier you choose with care: the GDPR allows only processors that give sufficient guarantees, and NIS2 makes supply chain security a measure of its own.
- People's Requests: Answering requests to access, erase or export someone's data is yours either way. A provider must help you with them; when you self-host, the software's own features are your help.
What Stays with the Maker
- A Manufacturer: Whoever develops the software and supplies it under its own name on the EU market in the course of a commercial activity, paid or free of charge, is its manufacturer under the EU Cyber Resilience Act (CRA). For a product it places on the market from 11 December 2027, it must handle the product's vulnerabilities for its support period, at least five years unless the product is expected to be in use for less. For such a product it must also ship security updates without delay, free of charge unless agreed otherwise for a tailor-made product. From 11 September 2026 it must report actively exploited vulnerabilities. These duties do not move to you when you self-host.
- An Open-Source Steward: A foundation or other legal person that supports, on a sustained basis, the development of open-source software intended for commercial use, without being its manufacturer, has light duties: a documented cybersecurity policy, cooperation with the authorities and, where it takes part in development, reporting actively exploited vulnerabilities. The CRA sets it no duty to ship security updates.
- No One: Open-source software that no one supplies in the course of a commercial activity, and no steward supports, leaves no one owing you CRA duties for it. Its fixes arrive when its developers ship them.
- When It Becomes You: Self-hosting for your own use carries no CRA duty. If you supply the software on the market under your own name, you become its manufacturer. If you substantially modify it and then supply it on the market, you become its manufacturer for the part you changed, or for all of it if the change affects the security of the whole product.
What a Certificate Tells You
- The Maker's or a Provider's Certificate: A SOC 2 report examines the controls of a service organization, and an ISO 27001 certificate covers an organization's own information security management system. Either is evidence about that party, never about your install.
- Your Host's Certificate: It speaks for the systems the host runs, never for what you run on them. It helps you judge the host as a supplier; the duties above stay yours.