Is Cognito Forms GDPR compliant?

Cognito Forms is used by thousands of EU organisations for contact forms, event registrations, application forms, and payment collection. Its generous free tier and ease of use make it attractive for nonprofits, schools, and small businesses. But ease of use is not the same as GDPR compliance.

Short answer: Cognito Forms is a US company running on Microsoft Azure infrastructure. Like many US-based SaaS tools, it has GDPR-facing documentation — but structural limitations around data residency and DPA availability make it unsuitable for EU organisations with strict compliance requirements.

Where does Cognito Forms store your data?

Cognito Forms is a US company (Cognito, LLC, South Carolina). Its infrastructure runs on Microsoft Azure, primarily in US-based Azure regions. Cognito Forms does not offer EU data residency as a selectable option — unlike some competitors that provide EU region hosting on paid plans.

This means form responses from your EU respondents are processed and stored in the United States. GDPR Article 44 requires appropriate safeguards for data transfers outside the EEA. Cognito Forms relies on Microsoft Azure's Standard Contractual Clauses for US transfers — but this does not change where the data physically resides or who can access it under US law.

For EU organisations in regulated sectors — healthcare, legal, financial services, public administration — US-hosted storage with no EU region option is a hard compliance blocker, regardless of which transfer mechanism is invoked.

Does Cognito Forms provide a Data Processing Agreement?

This is one of the most significant gaps in Cognito Forms's GDPR posture. A Data Processing Agreement (DPA) is a legally required contract under GDPR Article 28 whenever you use a third-party service to process personal data. Without one, you are in direct violation of Article 28.

Cognito Forms does not offer a standalone DPA as a standard feature on its free, personal, or professional plans. Their privacy policy and terms of service describe data handling in general terms, but this is not a DPA — it does not establish the specific contractual obligations that Article 28 requires.

Enterprise customers may be able to negotiate a custom data handling agreement, but this requires individual legal negotiation and is not a self-service option available to the vast majority of Cognito Forms users.

Third-party trackers on Cognito Forms pages

When a respondent opens a Cognito form, the form player page loads Google Analytics and Google Fonts from Google's CDN. These third-party scripts run on the page your respondents interact with — not just on your Cognito dashboard.

Google Fonts loaded from Google's CDN transmits the respondent's IP address to Google servers in the US. Google Analytics creates a behavioural session profile of the respondent. Neither of these processors is one you chose — they come bundled with Cognito Forms's infrastructure.

Under GDPR, you as the data controller are responsible for every processor that touches your respondents' data, including those introduced by your form tool. If your privacy notice doesn't explicitly name Google as a sub-processor with a lawful transfer basis, every Cognito Forms submission may constitute a compliance violation.

Data subject rights

GDPR Articles 15–22 give respondents the right to access, correct, and delete their personal data. Cognito Forms allows administrators to view and delete individual form entries from the dashboard. However, there is no built-in workflow for Subject Access Requests (SARs) — if a respondent asks to see all data you hold on them across multiple forms, you'll need to manually search and compile it.

Cognito Forms also has limited automated data retention controls. You can set a maximum entry count and manually delete entries, but there is no policy-based retention schedule or audit trail of deletions. Maintaining your own SAR compliance records becomes an entirely manual process.

Encryption

Cognito Forms encrypts data at rest on Azure infrastructure and in transit using TLS. Cognito Forms manages the encryption keys, and the service runs on US-controlled cloud infrastructure.

This means Cognito Forms staff, Microsoft Azure infrastructure, legal requests, and anyone who compromises Cognito Forms's systems can read your respondents' form responses. For forms collecting sensitive information — medical data, financial details, legal information, or personal assessments — this is a meaningful security and compliance risk.

Summary: when Cognito Forms is (and isn't) acceptable for GDPR

• ✗ No EU data residency — data stored in US-based Azure regions with no EU region option
• ✗ No standard DPA — direct violation of GDPR Article 28 for most users on free and standard plans
• ✗ Third-party trackers on form pages — Google Analytics and Google Fonts load on every form
• ✗ US-operated service on US-controlled cloud — no EU-only guarantee
• ✗ No built-in SAR workflow — manual handling only, no deletion audit trail
• ✗ US-incorporated company (South Carolina) with US-default infrastructure
• ~ Enterprise plans may be able to negotiate a DPA, but this is not self-service

What to use instead for EU compliance

The requirements are consistent for any form tool collecting personal data from EU respondents: EU data residency as the default (not an enterprise add-on), a DPA available to all users without negotiation, no third-party tracking on the form player, encryption at rest, and built-in data subject rights tooling.

Cognito Forms's architecture — US company, US infrastructure, no standard DPA, Google trackers on form pages — fails on all four counts. For EU organisations using it without an enterprise agreement, the compliance exposure begins with the first form submission.