GDPR-compliant forms: six form builders checked
For a small business that collects names, emails and messages through online forms, has EU visitors and no privacy staff. Google Forms against 5 form builders, measured on what decides whether a form tool fits the GDPR: the processor contract, what the vendor does with responses, where they are stored, how they leave the EU, and whether you can export and delete them. Every cell comes from each vendor’s own pages. read 2026-10-28
Best for keeping every entry on your own server
WPForms
On a WordPress site it meets 5 of the 7 rows: entries stay in your own database and WPForms collects none of them.
Best hosted builder made and stored in the EU
Tally
A Belgian company that stores form data in Europe and binds its DPA through its terms; its own pages meet 6 of the 7 rows.
Best open-source option, self-hosted or in a German cloud
Formbricks
AGPLv3 software you can run on your own server, or its cloud in Germany under a published DPA. Built for surveys first.
GDPR-compliant forms: the checks, builder by builder
Each row is something the GDPR asks of a tool that collects and holds form responses for you, with the article it comes from. Google Forms sits in the first column as the baseline most small firms already use. Read across for one rule; read down for one builder. If the form also carries a captcha, our GDPR compliant captcha comparison covers that script.
| Requirement | Google Forms | Jotform | Typeform | Tally | Formbricks | WPForms |
|---|---|---|---|---|---|---|
| Signs a processor contract, or holds no responsesGDPR Art. 28(3) | yesWorkspace accounts | yessigned online | yespublished DPA | yesaccepted with its terms | yespublished DPA | yesholds no entries |
| Uses responses only on your instructionsGDPR Art. 28(3)(a); Art. 28(10) | yesto provide and secure it | partialalso analyses responses | yesdocumented instructions | yesstores on your behalf | yesdocumented instructions | yesnever receives entries |
| Keeps responses in the EUGDPR Art. 44 | paid plandata regions, paid editions | yesEU servers in Frankfurt | paid planEU data center, Enterprise | yesstored in Europe | yescloud in Germany | partialwhere your host is |
| Names its basis for transfers out of the EUGDPR Art. 45(1); Art. 46(2)(c) | yesSCCs in the Cloud DPA | yesData Privacy Framework | yesSCCs in its DPA | yesSCCs in its DPA | yesSCCs and the DPF | yesnone to WPForms |
| Exports and deletes a person’s responsesGDPR Arts 15, 17, 20 | yesCSV; one by one or all | yesCSV, Excel, PDF | yesby response ID | yesdelete or export | yesdelete or export | paid planexport needs a licence |
| Deletes responses on a schedule you setGDPR Art. 5(1)(e) | not stated | yesone hour to one year | not stated | paid planBusiness plan | not stated | not stated |
| Can run on your own serverno outside processor (Art. 28) | not stated | not stated | not stated | not stated | yesAGPLv3, Docker | yesWordPress plugin |
Source: vendor pages, terms, DPAs and docs, read 2026-10-28. “not stated” means the vendor’s own documentation does not say. | ||||||
What makes a form GDPR compliant
A form builder can be GDPR compliant only in the sense that it lets you meet the rules; the form you publish is your processing, and you are the controller. These six checks apply to a contact form, a quote request or a sign-up form whichever tool draws it. Our GDPR checklist covers the rest of the program a form starts.
- 01
Ask only for what the form needs
Data must be limited to what is necessary for the purpose, and by default only the necessary data may be collected. A contact form that needs an email address and a message has no use for a phone number, a birthday or a job title. Make every extra field optional, or drop it.
GDPR Art. 5(1)(c), Art. 25(2) - 02
Pick the lawful basis before you add a checkbox
Answering a question someone sent you, or quoting for a job they asked about, is processing needed to take steps at their request before a contract, which is Art. 6(1)(b); a reply can also rest on legitimate interests. Consent is the basis for the extras: a newsletter, marketing calls, a case study.
GDPR Art. 6(1)(b), (f) - 03
If you rely on consent, one unticked box per purpose
Consent is a clear affirmative action, so pre-ticked boxes do not count, and a request for consent must be clearly distinguishable from the other matters on the form. One box for the newsletter, another for marketing calls, each unticked, each saying what it is for.
GDPR Art. 4(11), Art. 7(2), Recital 32 - 04
Tell people at the moment you collect
The notice is due at the time the data is obtained: who you are, why you want the data, the legal basis, who receives it (the form builder among them) and how long you keep it. A short line under the submit button with a link to the privacy notice does the job.
GDPR Art. 13(1)–(2) - 05
Keep health and other special data out
Health, religion, ethnic origin, sexual orientation, biometrics and the other special categories may not be processed unless an Art. 9(2) exception, such as explicit consent, applies. A free-text box invites them; a booking or intake form that needs them needs more than a builder setting.
GDPR Art. 9(1) - 06
Decide when responses are deleted
Data may be kept in identifiable form for no longer than the purpose needs. Pick a period for each form (an answered enquiry, a closed job), write it in the notice, and set the builder to delete on that schedule if it can. The table shows which builders can.
GDPR Art. 5(1)(e)
The commonest “GDPR form” is a contact form with a required box reading “I consent to the processing of my data”. If the person cannot send the message without ticking it, the consent is not freely given, and you did not need it to reply anyway. The regulation says so in its consent conditions:
“When assessing whether consent is freely given, utmost account shall be taken of whether, inter alia, the performance of a contract, including the provision of a service, is conditional on consent to the processing of personal data that is not necessary for the performance of that contract.”
A required box that confirms the person has read the privacy notice is a different thing from consent, and it is not needed either: the notice line under the button meets Art. 13. Keep checkboxes for the optional purposes. Information, not legal advice.
A business the CCPA covers owes a notice at collection on a web form too. The regulations’ example for webforms is a link to the notice close to the input fields or the submit button (§ 7012(c)(2)), the same spot the GDPR notice line takes. Our notice at collection template writes the text for it.
Google Forms and GDPR: which account you use decides
Google Forms is the baseline in the first column because it is free and already open on most office laptops. What it offers under the GDPR depends on the account the form was made with, not on the form.
On a Google Workspace account, Google’s Cloud Data Processing Addendum applies. It replaced what was called the Data Processing Amendment under a Workspace agreement, limits Google’s use of your data to providing, securing and monitoring the service, and carries the standard contractual clauses for transfers. Workspace data regions list Google Forms text, responses and draft responses among the data they cover, so a supported paid edition can store them in Europe.
On a personal Gmail account, the pages we read put none of that in place: the addendum is written for Workspace and Cloud customers, and Google’s help page says users without a supported edition are not covered by data region policies even when a policy is set. For a business form that collects names and emails, make it from the Workspace account, or pick a builder whose terms cover you on the plan you have.
Each form builder in short
What each one is, who it fits, how it meets the rows, and what to confirm before you move your forms. Sign or accept the DPA before the first form goes live, and check it against the clauses our data processing agreement template lists.
Google Forms
What it is
Google’s free form builder, part of Google Workspace. Responses land in the form and, if you link one, in a Google Sheet.
Who it fits
A firm that already pays for Google Workspace and wants its forms under the same contract as its email and files.
What the rule requires and whether it meets it
Under a Workspace agreement, Google’s data processing addendum applies and limits its use of your data to providing, securing and monitoring the service, with the standard contractual clauses for transfers. Workspace data regions cover form responses, so a supported paid edition can pin them to Europe. You can download responses as CSV and delete them one by one or all at once.
Check with the vendor
The addendum is written for Workspace and Cloud customers, and data regions skip users without a supported edition. If your forms live on a personal Google account, the pages we read offer no processor terms for it. Responses are not deleted on a schedule; deleting them is a manual job.
Jotform
What it is
A US form builder from Jotform Inc. in San Francisco, with a free plan and hosting on Google Cloud and AWS in the US and Frankfurt.
Who it fits
A small firm that wants a full-featured hosted builder with EU storage it can switch on itself and a rule that deletes old submissions.
What the rule requires and whether it meets it
It offers a DPA you sign through an online form. A setting in your account moves form data to its servers in Frankfurt, and its security page says EU data always stays in the EU. Its privacy policy relies on the EU-U.S. Data Privacy Framework, and its auto-delete feature removes submissions after a period you choose, from one hour to one year.
Check with the vendor
Its privacy policy says it analyses question and response data to monitor and improve its services. Ask how that use fits the purpose in your notice, and whether the auto-delete period applies to uploaded files too.
Typeform
What it is
A form builder from Typeform S.L., a Spanish company in Barcelona, with hosting by AWS, a US company, named in its DPA.
Who it fits
A team that wants an EU-based vendor and its published DPA, and either accepts the transfer clauses or buys Enterprise for EU storage.
What the rule requires and whether it meets it
Its published DPA, last updated 20 July 2026, has it process personal data on your documented instructions and brings in the standard contractual clauses for transfers outside the EEA. Its Responses API can export responses and delete them by response ID.
Check with the vendor
The EU Responses Data Center is for Enterprise customers; below that, responses rely on the transfer clauses. The pages we read describe no automatic deletion schedule, so plan a manual or API clean-up.
Tally
What it is
A Belgian form builder from Tally BV that offers unlimited forms and submissions on its free plan.
Who it fits
A small firm with EU visitors that wants a hosted builder from an EU company with responses stored in Europe from the first plan.
What the rule requires and whether it meets it
Its DPA binds professional users when they accept its terms, so there is nothing to sign, and it uses the standard contractual clauses for any transfer. Form data is encrypted and stored in Europe, you can delete or export responses, and deleted data leaves its backups within 90 days.
Check with the vendor
Automatic deletion after a set period is a Business-plan feature. Some opt-in features, such as email notifications and payment forms, send submissions to US sub-processors; its sub-processor table lists them.
Formbricks
What it is
An open-source survey platform from Formbricks GmbH in Germany, offered as a hosted cloud or as software you run yourself.
Who it fits
A firm with someone technical that wants the option to keep every response on its own server, or a German cloud if not.
What the rule requires and whether it meets it
Its core is licensed under AGPLv3 and runs on your own server with Docker, so no outside processor needs to see the data. Its cloud stores survey data encrypted in Germany, under a published DPA that has it act only on documented instructions.
Check with the vendor
Its privacy policy leaves the storage period to you, with no automatic schedule named. It is built for surveys and product feedback, so check that its field types cover a plain contact or booking form.
WPForms
What it is
A WordPress form plugin with a free Lite version and paid licences. Entries are stored in your own site’s database.
Who it fits
A WordPress site that wants its contact and quote forms to send nothing to an outside form service.
What the rule requires and whether it meets it
WPForms says it collects no entry data on its end. Its GDPR settings add a consent field that is always required and can never be ticked by default, and can switch off its user cookie and the storage of IP address and user agent, site-wide or per form.
Check with the vendor
Your web host now holds the entries, so its location and its own processor terms decide the EU question. Exporting entries needs a paid licence, and WPForms Lite does not store entries at all.
How we compared them
We started from Google Forms, the free builder most small firms open first, and five alternatives a small firm meets when an EU customer or a data protection question makes it look again: two hosted builders from EU companies, one from a US company with an EU server option, an open-source platform you can run yourself, and a WordPress plugin that keeps entries on your own site. Enterprise survey suites are left out. Our GDPR compliance software page covers the tools that run the rest of the program.
Each row is a requirement the rule itself sets, with the article or section cited beside it. Every cell comes from the vendor’s own public documentation, read on 2026-10-28; we did not run trials, take demos or accept vendor answers that are not published.
“not stated” means the vendor’s documentation does not say either way. It is not a “no”: ask the vendor and get the answer in writing. “paid plan” means the feature exists but not on the free or entry tier. There are no scores, ratings or prices on this page.
Verdicts are editorial: no vendor can buy a verdict position or displace another vendor.
This page is information, not legal advice. A tool that meets a row does not make a site compliant; how it is set up does.
Questions
Is Google Forms GDPR compliant?
No form tool is compliant on its own; your use of it is. On a paid Google Workspace account, Google’s data processing addendum makes it your processor and supplies the transfer clauses, and some paid editions can keep form responses in Europe with data regions. On a personal Google account, the pages we read offer no processor terms, which leaves the Art. 28 contract question open. Either way the notice, the fields and the deletion schedule are yours to set.
Do I need a consent checkbox on my contact form?
Usually not for the reply itself. Answering a message someone sent you rests on taking steps at their request (Art. 6(1)(b)) or on legitimate interests, and making a consent box a condition of sending the form undercuts the “freely given” test in Art. 7(4). Use an unticked box for optional extras such as a newsletter, and put a notice line with a link to your privacy notice under the submit button.
Can a GDPR consent checkbox be ticked by default?
No. Consent needs a clear affirmative action, and Recital 32 says silence, pre-ticked boxes or inactivity are not consent. A box the visitor has to tick, one per purpose, is the pattern the regulation describes.
Does a US form builder make my EU data transfer unlawful?
Not if the transfer has a basis. The EU-US Data Privacy Framework is an adequacy decision for US organisations on its list, and the Commission’s standard contractual clauses are an appropriate safeguard. Jotform names the Framework in its privacy policy; Google and Typeform use the clauses in their addendums. Our Google Analytics and GDPR guide explains how to check the Framework list.
Do I need a DPA with my form builder?
Yes, if the builder stores the responses for you, because it processes personal data on your behalf and Art. 28(3) asks for a contract with set terms. Tally and Typeform build theirs into their terms, Jotform has you sign online, and Google’s comes with a Workspace agreement. A plugin that keeps entries on your own server, such as WPForms, needs none, but your web host then holds the data. Our data processing agreement template lists the clauses to look for.
How long can I keep form responses?
The GDPR sets no number: no longer than the purpose needs (Art. 5(1)(e)), and the period, or how you decide it, goes in your notice. An answered enquiry rarely needs years. Our data retention policy template sets a period and a reason per category, and the table above shows which builders can delete on a schedule.