Is Tally GDPR Compliant in 2026? DPA, EU Data Residency & Real Risks

Tally has earned a devoted following as a clean, generous-free-tier alternative to Typeform. It is built in Belgium, which gives it natural credibility with European users who assume that an EU-based company automatically means GDPR-friendly hosting. The reality is more nuanced: where the founders sit matters far less than where the data goes.

If you are an EU accountant, consultant, healthcare provider, public sector body, or any organisation handling sensitive respondent data, the short answer is: Tally can be configured to be reasonably GDPR-compliant, but several defaults — especially the US-based infrastructure stack and the lack of encryption at rest — mean you should not assume compliance out of the box.

What GDPR requires of a form builder

Whenever you collect personal data with a third-party tool, that tool becomes a data processor under Article 4(8) GDPR. The obligations are well-defined:

• A signed Data Processing Agreement (DPA) under Article 28
• Documented sub-processors and transparency about where data is stored
• Appropriate technical and organisational measures, including encryption at rest (Article 32)
• A lawful basis for any transfer outside the EEA (Article 44 ff.) — Standard Contractual Clauses alone are not enough after Schrems II
• The ability to honour data subject rights — access, rectification, erasure, portability (Articles 15–22)
• Breach notification within 72 hours (Article 33)

Where Tally stands today

1. EU-based company, US-based infrastructure

Tally is operated by Tally Forms BV in Ghent, Belgium. That is a real GDPR strength — the controller behind the platform is squarely inside the EU jurisdiction, and there is no parent company subject to US extraterritorial laws like the CLOUD Act. However, Tally's actual hosting and sub-processor stack is primarily US-based. According to Tally's public sub-processor list, the platform relies on AWS (with regions including the United States), Cloudflare, Stripe, Postmark, and several US-headquartered SaaS providers for core functionality.

What this means in practice: even if the legal entity collecting your respondents' data is in Belgium, the data itself is processed by US providers acting as sub-processors. Standard Contractual Clauses are in place, but after the Schrems II ruling (CJEU C-311/18), SCCs alone are not sufficient — you must also perform a Transfer Impact Assessment and implement supplementary measures.

2. Disk-level encryption only (as far as Tally documents)

Tally encrypts data in transit (TLS) and at rest at the disk/database level (standard AWS encryption). What it does not publish is any application-level encryption of responses on top of that, so you should assume the platform operator can access respondent data and rely on its DPA and access controls.

For most low-risk use cases (event signups, simple feedback), disk-level encryption is fine. For health questionnaires, financial intake forms, or anything covered by professional secrecy, you should weigh who operates the platform and where it is hosted, because any hosted tool that manages its own keys can technically read the data. FormVault is in the same position on that point — it differs on EU-only hosting, a DPA on every plan and no third-party trackers, not on key custody.

3. Tally DPA: what it covers and where to find it

Tally publishes a Data Processing Agreement that covers Tally's role as a data processor under GDPR Article 28. The Tally DPA includes: sub-processor disclosure, Standard Contractual Clauses for transfers outside the EEA (needed because Tally uses US-based AWS and other US providers), security obligations under Article 32, and breach notification requirements under Article 33.

The Tally DPA is accessible from Tally's website under their legal documentation. For paid-plan customers, the DPA takes effect by accepting Tally's Terms of Service. Tally recommends that free-plan users who need a countersigned DPA upgrade to a paid plan or contact Tally directly. If you are an accountant, HR manager, or consultant collecting client data, do not begin using any form tool in production without a valid signed DPA on file — this is a direct GDPR Article 28 obligation.

One important limitation: the Tally DPA covers Tally as processor, but it does not resolve the underlying data residency question. Standard Contractual Clauses are listed as the transfer mechanism for non-EEA sub-processors, but under the Schrems II ruling (CJEU C-311/18), SCCs alone are not sufficient — you must also conduct a Transfer Impact Assessment. A DPA is not the same as guaranteed EU data residency.

4. Third-party scripts and trackers

By default, the Tally application and embedded forms load assets from Cloudflare, which under the ePrivacy Directive/TTDSG can already require consent depending on the jurisdiction. If you embed Tally on your website without a properly configured Consent Management Platform, you may be violating the cookie/tracking rules even before any GDPR question arises. Self-hosted form alternatives or providers that ship without third-party CDNs simplify this considerably.

5. Data subject rights are manual

Like most US-style form builders, Tally relies on manual workflows for data subject rights. If a respondent emails you under Article 15 (access) or Article 17 (erasure), you must locate and act on the data yourself within one month. There is no built-in portal that audits and records these requests — which makes proving compliance to a supervisory authority harder than it needs to be.

When is Tally a reasonable choice?

• Low-risk forms with no sensitive data: event signups, public surveys, marketing leads
• You have signed Tally's DPA and reviewed the sub-processor list
• You have completed a Transfer Impact Assessment for AWS US transfers
• You can defend the lawful basis and minimisation of every field you collect
• You have a documented process for handling DSARs within the GDPR deadlines

When should you choose a stricter EU-only alternative?

• You process health data, financial data, legal client data, or other Article 9 special categories
• Your supervisory authority or sector regulator requires EU-only data residency
• Your customers or respondents specifically ask for EU-only processing
• You operate in regulated sectors: healthcare, finance, public administration, law
• You want to avoid Schrems II / SCC complexity altogether

Tally vs FormVault: side-by-side

• Company HQ: Tally — Belgium (EU). FormVault — EU operator, EU hosting
• Hosting: Tally — primarily AWS (incl. US regions). FormVault — Hetzner Nuremberg, Germany only
• Encryption at rest: Tally — disk-level. FormVault — application-level AES-256-GCM
• DPA: Tally — yes on paid plans. FormVault — signed DPA on every plan including free
• Sub-processors: Tally — several US-headquartered (AWS, Cloudflare, Stripe). FormVault — Hetzner + minimal EU-only stack
• Data subject rights: Tally — manual. FormVault — built-in DSAR portal with audit trail
• Trackers on the form page: Tally — Cloudflare assets and some marketing scripts. FormVault — zero third-party trackers, cookieless self-hosted analytics

Frequently asked questions

Is Tally GDPR compliant?

Tally is partially GDPR compliant — but not by default, and not unconditionally. Tally provides a Data Processing Agreement, which satisfies Article 28, and the DPA includes Standard Contractual Clauses for data transferred to US sub-processors (AWS, Cloudflare, Stripe). However, Tally does not guarantee EU data residency — form responses can be stored on US-based AWS infrastructure — and responses are not encrypted with keys you control. For low-risk use cases (event signups, marketing surveys) with a signed DPA and a completed Transfer Impact Assessment, Tally is a defensible choice. For health data, financial client data, or any special-category data under Article 9 GDPR, a dedicated EU-only encrypted form tool provides a materially stronger compliance position.

Is Tally GDPR compliant just because it is based in Belgium?

No. The location of the company is not the same as the location of the data. Tally is a Belgian controller-of-controller but uses US sub-processors. Compliance depends on the contracts, the Transfer Impact Assessment, and the technical measures you put in place — not on where the founders live.

Does Tally have a DPA?

Yes, Tally provides a GDPR Data Processing Agreement. The Tally DPA covers sub-processor disclosure, Standard Contractual Clauses for US data transfers (AWS, Cloudflare, Stripe), Article 32 security obligations, and Article 33 breach notification. For paid plans, the DPA is incorporated by reference in Tally's Terms of Service — sign it, archive the current version, and review it whenever Tally updates its sub-processor list. For free-plan users, confirm with Tally directly whether the DPA applies automatically before collecting any personal data.

Can I use Tally for healthcare or financial intake forms?

We would not recommend it. Health data falls under Article 9 GDPR (special categories) and financial intake data is often subject to professional secrecy. Both call for strong encryption and strict EU residency, which Tally does not currently guarantee.

What does the Tally DPA cover?

The Tally Data Processing Agreement covers: (1) Tally's role as a data processor under Article 28 GDPR; (2) a list of sub-processors including AWS, Cloudflare, Stripe, and Postmark; (3) Standard Contractual Clauses (SCCs) as the legal basis for data transfers to those US-based sub-processors; (4) security obligations under Article 32, including encryption in transit and at rest; (5) breach notification requirements under Article 33. On paid plans, the Tally DPA takes effect automatically when you accept Tally's Terms of Service. Free-plan users should confirm with Tally directly whether the DPA applies before collecting any personal data. Importantly, the Tally DPA does not guarantee EU-only data residency — it documents US data transfers under SCCs, which means you must also conduct a Transfer Impact Assessment to comply with Schrems II.

Is there a Tally alternative with full EU residency and encryption at rest?

Yes. FormVault stores every submission AES-256-GCM-encrypted on Hetzner servers in Nuremberg, Germany, with a signed DPA on every plan (including free) and no third-party trackers on form pages.

Comparing tools? See our answer to is Google Forms GDPR compliant for how a Workspace account changes the picture.