Web hosting: what to check

A web host keeps a website online. Before choosing one, a business can check how backups work, where customers' details will be held, and what the contract says.

Keep your own copy

The National Cyber Security Centre (NCSC) advises making a copy, or backup, of the data your business needs to operate. That can include your website, emails, invoices, documents, contacts and customer information.

A ransomware attack can lock a business out of its own data. If you lose access to your data, you can restore it from the backup. The NCSC says a backup can be stored online or on an external device such as a USB stick or external hard drive.

Where customers' details are held

The Information Commission (which took over from the ICO on 30 September 2026) publishes guidance on the rules for sending personal information to other countries. Its guidance explains what it calls a "restricted transfer", and has an interactive tool to help decide whether you are making one.

The contract with your supplier

Where a supplier handles personal data on a business's behalf, the Information Commission calls the business the controller and the supplier the processor. Its guidance sets out when the UK GDPR says a contract between them is needed and the minimum terms it must contain. The Information Commission says this guidance is under review after the Data (Use and Access) Act 2025.

Those terms include processing only on the controller's documented instructions, a duty of confidence, appropriate security measures and rules on using sub-processors.

A security baseline

The NCSC describes Cyber Essentials as the minimum standard of cyber security the government recommends for organisations of all sizes. It is built around five technical controls against the most common internet attacks.

Questions to ask a host

Useful links