Is JotForm GDPR compliant? 2026 Analysis: EU Data Residency & DPA

JotForm is one of the world's most popular form builders, used by millions of organisations for everything from contact forms to complex multi-step surveys. But popularity doesn't equal compliance — and for EU organisations collecting personal data, GDPR obligations apply regardless of which tool you use.

So: is JotForm GDPR compliant? The short answer is that JotForm offers some GDPR-relevant features, but it has significant structural limitations that make it unsuitable for organisations with strict EU data residency requirements or those processing sensitive personal data.

• ⚠️ EU data residency is available — but only on paid plans, not the default, requires explicit configuration
• ✓ DPA available — JotForm provides a GDPR Data Processing Agreement on all paid plans
• ❌ Third-party scripts on form player — Google Fonts, reCAPTCHA create undisclosed processor relationships
• ❌ US-originated provider: EU residency and encryption options depend on plan and configuration
• ❌ No built-in Subject Access Request workflow — manual handling required

Where does JotForm store your data?

JotForm is a US company (JotForm Inc., San Francisco). Its infrastructure runs on AWS, and by default, form responses are stored on US-based AWS servers. JotForm does offer a 'HIPAA-compliant' tier that includes US-based encrypted storage — but for EU data residency, this is not the same as data being stored within the EEA.

JotForm has introduced EU-hosted infrastructure for some plans, but this is not the default and requires explicit configuration. If you're on the free or basic plan and haven't actively selected EU data residency, your respondents' data is likely stored in the United States.

For organisations subject to strict EU data residency — healthcare providers, legal firms, financial services, public sector — the possibility of US-hosted data is a hard blocker, regardless of Standard Contractual Clauses.

How to configure JotForm EU data residency — official steps

JotForm's EU data residency option is available on paid plans (Bronze and above). Here is the official configuration process: (1) Upgrade to a paid JotForm plan if you have not done so — EU data residency is not available on the free tier. (2) Go to your JotForm account settings and look for the 'Data Residency' or 'Data Center' option, typically under the Privacy or Security section. (3) Select 'EU' or 'Europe' as your data center. (4) Save the setting — JotForm will confirm which region your new submissions will be stored in. (5) Note that changing the data residency region does not retroactively move existing submission data. If you have pre-existing submissions, you may need to export and delete them under GDPR Article 17, then re-collect or migrate data to the EU-hosted storage.

Before going live, confirm the effective date and region in writing with JotForm support. JotForm's documentation on EU data residency has changed over time, and confirming which specific AWS region is used (typically eu-west-1 in Ireland or eu-central-1 in Frankfurt) is important for your GDPR documentation and any Transfer Impact Assessment you may need to complete.

Does JotForm provide a Data Processing Agreement?

Yes, JotForm provides a Data Processing Agreement. It is available online and covers JotForm's role as a data processor under GDPR Article 28. This is a positive — many form tools in the same price bracket do not offer any DPA.

However, review the DPA carefully: check which sub-processors are listed (JotForm uses multiple third-party services), which data transfer mechanisms apply (Standard Contractual Clauses for US transfers), and specifically what the DPA says about data residency. Signing a DPA does not automatically mean EU data residency — the DPA and the infrastructure commitment are separate things.

Third-party trackers on JotForm form pages

This is one of the most significant compliance issues with JotForm. When a respondent opens a JotForm form, the form player page loads JotForm's own analytics and, depending on your plan and configuration, potentially third-party services like Google Fonts, Google reCAPTCHA, and others.

Google Fonts loaded from Google's CDN sends the respondent's IP address to Google servers. reCAPTCHA creates a behavioural profile of the user. These processors are not ones you chose — they are added by JotForm's infrastructure. Under GDPR, you as the data controller are responsible for every processor that touches your respondents' data, even ones introduced by your form tool.

JotForm Enterprise plans offer more customisation, including self-hosted options that reduce third-party exposure. But on standard plans, this remains a material compliance risk — particularly for forms handling health information, financial data, or anything where respondent profiling by third parties is not disclosed in your privacy notice.

Data subject rights

GDPR Articles 15–22 give individuals the right to access, correct, restrict, and delete their personal data. JotForm provides the ability to delete individual submissions from the dashboard. It does not have a built-in workflow for Subject Access Requests (SARs) — if a respondent asks to see all data you hold on them, you'll need to manually locate and compile it.

For low-volume forms, this is manageable. For organisations processing large numbers of submissions across multiple forms, manual SAR handling creates operational risk and potential delays beyond the 30-day GDPR response deadline.

Encryption

JotForm encrypts data at rest and in transit (TLS). JotForm also offers a form-level encryption feature that encrypts specific fields using a key you provide — which is a meaningful extra safeguard. However, this feature requires careful configuration and is not the default; most JotForm users store responses in plain text, accessible to JotForm staff and systems.

Even with per-field encryption enabled, JotForm manages the broader infrastructure and can potentially access metadata, submission timestamps, and unencrypted fields.

JotForm GDPR compliance for accountants and consultants

Accountants, bookkeepers, and management consultants are among JotForm's most common professional users — intake forms, client questionnaires, tax information gathering. This is also the use case where JotForm's GDPR limitations create the most exposure. Client financial data and tax IDs fall under the principle of data minimisation and confidentiality under GDPR Article 5(1)(f). When a client completes a JotForm intake form, their session is exposed to Google Fonts and potentially reCAPTCHA — processors that are almost certainly not disclosed in a standard professional engagement letter. This creates a silent compliance gap that most accounting firms have not reviewed.

If you are an EU-based accountant or consultant evaluating JotForm for GDPR: the minimum requirement is a paid plan with EU data residency explicitly enabled, a signed DPA (which JotForm provides), and an updated privacy notice that lists Google (Fonts, reCAPTCHA) and AWS EU as data processors. Even with these steps, the third-party tracker exposure on the form player remains — and for clients in regulated sectors, you should evaluate whether a dedicated EU-native form tool with no third-party scripts is the more defensible choice.

Summary: when JotForm is (and isn't) acceptable for GDPR

• ✓ Acceptable: Enterprise plan with EU data residency explicitly enabled, DPA signed, low-sensitivity data, respondents informed about sub-processors in your privacy notice
• ✗ Not acceptable: Free, Bronze, Silver plans — no EU data residency by default
• ✗ Not acceptable: High-sensitivity data (health, legal, financial) — third-party scripts on form player (Google Fonts, reCAPTCHA) are a material risk
• ✗ Not acceptable: Organisations in regulated sectors that require guaranteed EU data residency and zero third-party data sharing
• ✗ Not acceptable: Teams that need built-in SAR workflows — JotForm requires manual handling

What a genuinely GDPR-compliant alternative looks like

If your organisation needs guaranteed EU data residency on all plans (including free), no third-party trackers on the form player, encryption at rest, and a DPA that covers every user — JotForm's architecture is not built for this. Like most US-originated SaaS tools, EU compliance is an add-on rather than the foundation.

A GDPR-first form builder stores all data exclusively in the EU by default, uses no third-party scripts on the form player, encrypts responses at rest, and provides a DPA and data subject rights tooling to every customer regardless of plan.

Frequently asked questions

Is JotForm GDPR compliant?

JotForm is partially GDPR compliant, but with important caveats. On paid plans, JotForm provides a Data Processing Agreement and EU data residency is available — but neither is the default. On the free plan there is no EU data residency option and DPA terms may not apply automatically. Third-party scripts on the form player (Google Fonts, reCAPTCHA) are a compliance risk on all plans. For organisations with strict requirements, JotForm requires careful configuration to meet GDPR obligations.

Does JotForm have EU data residency?

Yes, JotForm offers EU data residency — but only on paid plans (Bronze, Silver, Gold, and Enterprise), and it must be explicitly enabled in your account settings. It is not the default. Free-plan users have no EU data residency option; their data is stored on JotForm's US-based AWS infrastructure. If you are evaluating JotForm for GDPR, confirm in writing with JotForm support which region your data will be stored in before going live.

Is JotForm's EU data residency option official for all paid plans?

JotForm's EU data residency is an official, documented option available on paid plans — it is not a workaround or an enterprise-only custom arrangement. However, 'official' does not mean 'automatic': you must manually select the EU data center in your account settings, and JotForm does not migrate existing data when you change regions. Additionally, JotForm's EU residency stores data in AWS EU regions (typically Ireland or Frankfurt), meaning AWS remains a sub-processor for your EU-hosted data. This is covered by JotForm's DPA under Standard Contractual Clauses, but it means you are not free of US-company involvement — you are simply keeping the data within EU AWS infrastructure. For organisations that require zero US-company sub-processor involvement (some public sector requirements), JotForm's EU data residency is still insufficient, and a fully EU-native infrastructure is the only compliant option.

Does JotForm have a DPA?

Yes. JotForm provides a GDPR Data Processing Agreement that covers JotForm's role as a data processor under Article 28. The DPA is publicly available and covers Standard Contractual Clauses for data transfers outside the EEA, sub-processor disclosure, security obligations, and breach notification. On paid plans the DPA takes effect automatically when you accept JotForm's terms; on the free plan, the availability and automatic applicability of the DPA should be confirmed with JotForm directly. Always download and archive the version in force when you start using the service, as DPA terms can change.

Is JotForm GDPR compliant for accountants and financial services?

Not recommended without careful configuration. Accountants and financial advisers collect highly sensitive personal data — tax IDs, income details, financial account information. JotForm's third-party form player scripts (Google Fonts, reCAPTCHA) mean client sessions are exposed to processors not disclosed in a standard engagement letter. JotForm Enterprise with EU data residency and a custom domain can reduce this risk, but for most regulated financial professionals an EU-native tool with no third-party trackers and per-submission encryption is a stronger and simpler compliance position.

What is the best GDPR-compliant JotForm alternative for EU organisations?

The key criteria for a genuine EU alternative to JotForm: EU data residency as the default on every plan (not an opt-in add-on), no third-party tracker scripts on the form player, encryption at rest, and a DPA that covers every customer including free-tier users. JotForm meets some of these on paid plans, but fails on third-party trackers across all tiers.

Comparing tools? See our answer to is Google Forms GDPR compliant for how a Workspace account changes the picture.