Is Paperform GDPR compliant?

Paperform is an Australian form builder used by consultants, agencies, and small businesses for client intake forms, order forms, surveys, and event registrations. Its design flexibility and payment integrations make it attractive. But for EU organisations collecting personal data, the relevant question is whether Paperform meets GDPR obligations.

Short answer: Paperform has some GDPR-facing features, but as an Australian company running primarily on US-based AWS infrastructure, it has structural compliance limitations that make it unsuitable for EU organisations with strict data residency requirements.

Where does Paperform store your data?

Paperform is incorporated in Australia (Paperform Pty Ltd, Sydney). Its infrastructure runs on Amazon Web Services, with primary data centres in the United States and Australia. Paperform does not offer EU data residency as a configurable option on any plan tier.

This means form responses from your EU respondents are transferred to and stored in non-EEA countries. GDPR Article 44 restricts such transfers unless specific safeguards apply. Paperform relies on Standard Contractual Clauses for cross-border transfers — but SCCs do not change where the data physically sits or who can access it under Australian or US law.

For EU organisations in regulated sectors — healthcare, legal, financial services, HR, or any organisation whose respondents have a reasonable expectation of EU-hosted processing — the absence of any EU data residency option is a hard compliance blocker.

Does Paperform provide a Data Processing Agreement?

A Data Processing Agreement (DPA) is legally required under GDPR Article 28 whenever you use a third-party service to process personal data. Without one, you are in direct violation of Article 28 from your first form submission.

Paperform offers a DPA — but only on paid plans (Professional tier and above). Free plan users and those on lower tiers have no DPA. If you are using Paperform's free plan to collect any personal data from EU residents, you have no GDPR-compliant processing arrangement.

Even on paid plans, verify that you have explicitly accepted the DPA (not just the general terms of service), and review the sub-processor list — Paperform integrates with Stripe, Zapier, and others.

Third-party trackers on Paperform form pages

When a respondent fills in a Paperform form, the form player page loads Paperform's analytics and potentially third-party scripts including Stripe.js, Google Fonts from Google's CDN, and Intercom. These scripts run on the page your respondents interact with.

Google Fonts loaded from Google's CDN sends the respondent's IP address to Google servers. Intercom creates a session profile. Under GDPR, you as the data controller are responsible for every processor touching your respondents' data — including those introduced by your form tool without your explicit selection.

If your privacy notice does not disclose Google, Stripe, or Intercom as sub-processors handling respondent data, every form submission may constitute a compliance gap — particularly for sensitive data collection in health, legal, financial, or HR contexts.

Data subject rights

GDPR Articles 15–22 give respondents the right to access, correct, and delete their personal data. Paperform allows administrators to view and delete individual submissions from the dashboard. There is no built-in Subject Access Request (SAR) workflow — if a respondent asks to see all data you hold on them, you must manually locate and compile it.

For organisations collecting data across multiple forms over time, manual SAR handling creates operational risk and potential delays beyond the 30-day GDPR response deadline. There is no audit trail of deletions.

Encryption

Paperform encrypts data at rest and in transit using standard TLS and AES-256. Paperform manages the encryption keys, as most hosted form tools do, so Paperform, its sub-processors and legal requests can reach your respondents' responses.

For forms collecting sensitive information — medical history, financial data, legal disclosures, HR assessments — this is a significant security consideration on top of the data residency risk.

Summary: when Paperform is (and isn't) acceptable for GDPR

• ✓ Acceptable: Professional+ plan with DPA accepted, non-sensitive data, respondents informed about all sub-processors in your privacy notice
• ✗ Not acceptable: Free or lower-tier plan — no DPA available, direct violation of GDPR Article 28
• ✗ Not acceptable: Any use case requiring EU data residency — Paperform has no EU region option
• ✗ Not acceptable: High-sensitivity data (health, legal, financial, HR) — third-party scripts on form player and non-EU hosting
• ✗ Not acceptable: Regulated sectors requiring guaranteed EU data processing — Australian company, AWS US/AU infrastructure
• ✗ Not acceptable: Situations requiring EU-only processing and a DPA without enterprise negotiation

What a GDPR-first alternative to Paperform looks like

The consistent pattern across non-EU form builders is that GDPR compliance is treated as a configuration layer rather than the foundation. EU data residency is either unavailable or an enterprise add-on. DPAs are gated behind paid tiers. Third-party scripts load on form pages without clear disclosure.

For EU organisations — particularly consultants, accountants, and professional services firms collecting client data — a tool built specifically for the EU regulatory environment provides fundamentally stronger compliance guarantees than an Australian or US tool with a GDPR settings panel.