Is SurveyMonkey GDPR compliant?

SurveyMonkey (now operating under the parent brand Momentive) is one of the most recognised survey and form tools in the world, used by millions of organisations for employee satisfaction surveys, customer feedback, market research, and event registrations. Its ease of use and template library make it a natural first choice.

But for EU organisations processing personal data through surveys — names, email addresses, health information, opinions about employment — GDPR obligations apply. The question is whether SurveyMonkey's architecture and contractual commitments are sufficient.

Short answer: SurveyMonkey has GDPR-facing documentation and some EU-relevant features, but it is a US-incorporated company with US-based infrastructure at its core — and that creates structural compliance limitations.

Where does SurveyMonkey store your data?

SurveyMonkey's primary data centres are in the United States. The company offers EU data residency on specific plans and for customers who explicitly opt in — but this is not the default. If you signed up without checking residency settings, your survey responses are likely stored on US servers.

For EU organisations, storing personal data in the US requires either: the EU-US Data Privacy Framework certification (which SurveyMonkey holds), Standard Contractual Clauses, or another Article 46 safeguard. These mechanisms provide a legal basis for transfer — but they do not change where the data is physically stored or who can access it.

For organisations in healthcare, legal services, financial advice, or public administration — where respondents have a reasonable expectation of EU-hosted data processing — US-hosted storage is a hard compliance risk regardless of transfer mechanism.

Does SurveyMonkey provide a Data Processing Agreement?

Yes — SurveyMonkey offers a Data Processing Agreement for paid plan customers. The DPA is available online and covers the key GDPR Article 28 requirements: purposes of processing, sub-processor list, data subject rights assistance, and security obligations.

However, there are significant caveats. SurveyMonkey's free plan does not include a DPA. If you're using SurveyMonkey free to collect any personal data, you have no DPA — which means you are in direct violation of GDPR Article 28. Even on paid plans, verify that your DPA is explicitly signed or click-through accepted, not just posted online.

Additionally, read the DPA's sub-processor list carefully. SurveyMonkey uses multiple third-party services (including US-based analytics and infrastructure providers), and your DPA acceptance covers all of them.

How SurveyMonkey uses your respondents' data

This is one of the most significant GDPR concerns with SurveyMonkey. The company's business model historically included using aggregated survey data from its platform to power its own market intelligence products (SurveyMonkey Audience, Momentive AI).

Even if SurveyMonkey anonymises individual responses, GDPR Article 28 requires a processor to process data only on the controller's documented instructions. Any use of respondent data for platform improvement, benchmarking, or product development beyond strict service delivery is legally problematic.

SurveyMonkey's paid DPA terms limit processing to service provision, which is better. But the commercial context — a company whose products are built around aggregated survey data — creates inherent risk that the free plan and consumer product terms do not adequately constrain.

Third-party trackers on SurveyMonkey survey pages

When a respondent opens a SurveyMonkey survey, the survey page loads SurveyMonkey's analytics infrastructure and, depending on the plan, potentially third-party scripts. SurveyMonkey uses its own analytics platform (Momentive) and loads various performance and tracking scripts.

These scripts run on the form player page — the page your respondents see. Even if your survey doesn't ask for any personally identifiable information, the page may be setting cookies or building a behavioural profile of the respondent through SurveyMonkey's own systems. Your privacy notice almost certainly does not disclose this.

Data subject rights

SurveyMonkey provides administrators with the ability to delete individual responses. Responding to Subject Access Requests (SARs) — where a respondent asks to see all data you hold on them — requires manually locating and compiling responses. There is no built-in SAR workflow.

For organisations running one or two surveys, this is manageable. For those running many surveys over time (annual employee surveys, rolling customer feedback), manual SAR handling at scale becomes a meaningful operational risk.

Encryption

SurveyMonkey encrypts data at rest (AES-256) and in transit (TLS). SurveyMonkey manages the encryption keys, as most hosted survey tools do, so SurveyMonkey, its sub-processors and legal requests directed at a US company can reach your respondents' data.

Summary: when SurveyMonkey is (and isn't) acceptable for GDPR

• ✓ Acceptable: Paid plan with EU data residency explicitly configured, DPA signed, non-sensitive data, low-risk internal surveys
• ✗ Not acceptable: Free plan — no DPA, potential data use for platform products
• ✗ Not acceptable: High-sensitivity data (health, employment, legal, financial)
• ✗ Not acceptable: Organisations requiring guaranteed EU-only data processing
• ✗ Not acceptable: Use cases requiring EU-only processing or zero third-party data sharing
• ✗ Not acceptable: Regulated sectors (healthcare, finance, government, education with minors) — US company with US-default infrastructure is a fundamental blocker

A GDPR-first alternative to SurveyMonkey

The pattern is consistent across US-based form and survey tools: GDPR compliance is layered on top of US-first infrastructure, available as an add-on for paying customers, and never quite eliminates the structural risk of a US parent company with US-hosted defaults.

For EU organisations that need guaranteed data residency in Europe, no third-party scripts on the survey page, and a DPA available on every plan including free — the only sustainable approach is a tool built from the ground up for the EU regulatory environment.