GDPR form builder: 5 things to check before you sign up

"GDPR compliant" has become a marketing checkbox that many SaaS tools tick without doing the actual work. If you're collecting personal data from EU residents — contact forms, registration forms, surveys, job applications — you need a form tool that takes privacy seriously.

Here are five questions to ask before you sign up.

1. Where is the data actually stored?

This is the most important question — and the one most often obscured. Ask specifically: which country are the servers in? Is data ever replicated to US data centres? Many tools advertise "EU compliance" while running on AWS us-east or maintaining US-based backups.

GDPR Article 44 restricts personal data transfers to countries outside the EEA unless specific safeguards are in place. Even if a tool is EU-incorporated, that does not mean its infrastructure is in Europe.

What you want: servers explicitly in the EU — Germany, Ireland, Netherlands — with no US-region replication of personal data.

2. Is there a data processing agreement?

A Data Processing Agreement (DPA) is a legally required contract between you (the data controller) and the form tool provider (the data processor). Without one, you are in violation of GDPR Article 28.

Some form tools only offer DPAs on paid plans, or require enterprise negotiations. Check that the DPA covers: the types of personal data being processed, sub-processors, data subject rights obligations, and security measures.

What you want: a DPA available on all plans — including free — signed and delivered without a lawyer.

3. Does the tool track your respondents?

Some form builders embed tracking pixels, Google Analytics, or their own analytics into the public form URL that respondents fill in. This means the form tool is collecting data about your respondents for its own purposes — which is almost certainly not covered by your privacy notice and creates a serious compliance problem.

Check the form player page in your browser's network tab. Are there requests to Google, Meta, Mixpanel, Amplitude, or Intercom? If yes, the tool is adding processors you haven't disclosed.

What you want: no third-party scripts on the form player. If analytics are used server-side, they should be cookieless with no personal data.

4. Can respondents exercise their rights?

GDPR Articles 15–22 give individuals the right to access their data, correct it, restrict processing, and request deletion. If a respondent submits a form and then sends a Subject Access Request (SAR), you need to be able to fulfil it.

Many form tools have no tooling for this — you'd need to manually search exports and delete records by hand. For any meaningful data volume, this is a compliance gap waiting to be tested.

What you want: built-in tooling to find a respondent's submissions by email or token, and delete them with a record of the deletion.

5. Is data encrypted — and who holds the keys?

GDPR Article 32 requires appropriate technical measures to protect personal data. For form data, encryption at rest is the expected standard.

But who holds the encryption keys matters. If the form tool encrypts your data but manages the keys itself — as most hosted tools do — then the provider can read your respondents' answers, and so can anyone who compromises its infrastructure or compels it legally. That is why the provider's jurisdiction, hosting location and access controls matter as much as the cipher.

Encryption at rest protects stored data from disk-level exposure, but whoever holds the keys can read it — so ask any provider who holds them and who can access them.

What you want: encryption at rest, and a clear answer on who holds the keys and who can access decrypted data.

The checklist

• ✓ Servers in the EU, no US data transfers
• ✓ DPA available on all plans, no negotiation required
• ✓ No third-party tracking scripts on the form player
• ✓ Data subject rights tooling built in (access + deletion)
• ✓ Encryption at rest (AES-256-GCM)