Is Typeform GDPR Compliant in 2026? Data Residency, DPA & Tracker Analysis

Typeform is one of the most widely used form builders in the world — known for its conversational UI and polished design. But for EU organisations collecting personal data, the question isn't just whether Typeform looks good. It's whether it meets GDPR.

The short answer: Typeform can be made partially GDPR-compliant for some use cases, but it has several structural limitations that make it unsuitable for organisations with strict EU data residency requirements or high-sensitivity data.

Where Typeform's data actually lives

Typeform is a US-incorporated company (Typeform S.L. is headquartered in Barcelona, Spain — EU incorporated — but data is processed on US-based infrastructure). Typeform uses AWS data centres, and by default data may be stored in US regions.

Typeform does offer an EU data residency option — but only on Business and Enterprise plans. If you're on the free or Essentials tier, your form responses are processed outside the EU. For organisations that need guaranteed EU data residency, this is a blocker unless you're on a paid plan that explicitly includes the EU region.

Does Typeform offer a DPA?

Yes — Typeform does provide a Data Processing Agreement, and it's available online without requiring a manual negotiation. This covers Typeform as a data processor under GDPR Article 28.

However, the DPA only becomes meaningful if you're on a paid plan with EU data residency. On free plans, you may have the legal document but not the underlying infrastructure guarantee. Read the DPA carefully: check the sub-processor list, the data transfer mechanisms (Standard Contractual Clauses), and which regions your data is retained in.

Third-party trackers on Typeform form pages

This is where Typeform creates a significant compliance problem for many organisations. When a respondent fills in a Typeform, the form player loads Typeform's own analytics scripts — and potentially those of third-party services embedded by the form creator (Google Tag Manager, Facebook Pixel, etc.).

Even on clean Typeform forms, Typeform's own tracking (Intercom, Amplitude, and their in-product analytics) fires on the form player page. Your respondents are being profiled by third-party services that you haven't disclosed in your privacy notice. Under GDPR, you as the data controller are responsible for this — even if it's the processor doing it.

This is particularly problematic for sensitive categories of data (health, legal, financial). If your form asks about medical history and the page loads Amplitude analytics on the respondent's session, you have a problem that goes beyond a legal technicality.

Data subject rights

Typeform provides a way to delete individual responses from the dashboard. Subject access requests (SARs) — where a respondent asks to see all data you hold on them — require you to export and manually curate the relevant responses. There is no built-in SAR workflow.

For low-volume use cases this is manageable. For organisations processing thousands of responses, manual SAR handling becomes operationally difficult and risks delays beyond the 30-day GDPR deadline.

Encryption

Typeform encrypts data at rest and in transit using standard TLS + AES-256. Typeform manages the encryption keys, as most hosted form tools do, so Typeform, its sub-processors and legal requests directed at a US company can reach your respondents' data. Encryption alone does not change that; hosting jurisdiction and who operates the service are what differ.

Summary: when Typeform is (and isn't) acceptable for GDPR

• ✓ Acceptable: Business/Enterprise plan with EU data residency enabled, DPA signed, low-sensitivity data, respondents informed about Typeform analytics in your privacy notice
• ✗ Not acceptable: Free or Essentials plan — no EU data residency guarantee
• ✗ Not acceptable: High-sensitivity data (health, legal, financial) — third-party trackers on form player are a material risk
• ✗ Not acceptable: Organisations in regulated sectors (healthcare, finance, government) that need guaranteed EU residency and zero third-party data sharing
• ✗ Not acceptable: Self-service GDPR compliance — Typeform requires careful plan selection and configuration that most teams don't audit

What a GDPR-first alternative looks like

If you need guaranteed EU data residency, no third-party trackers, a DPA on all plans including free, and EU-only operation — Typeform is not the right tool regardless of the plan tier. The architecture of a US-originated SaaS with EU residency as an add-on creates inherent compliance risk.

A GDPR-first form builder is one built with EU residency as the default, no tracking on the form player, encryption at rest, and a DPA that covers every user — not just enterprise customers.

Frequently asked questions

Is Typeform GDPR compliant?

Partially, and only with the right plan and configuration. Typeform provides a GDPR Data Processing Agreement and offers EU data residency — but EU residency is only available on Business and Enterprise plans, not on free or Essentials tiers. Typeform also embeds third-party analytics (Amplitude, Intercom) on the form player page, which creates additional compliance obligations regardless of plan. For organisations that need straightforward GDPR compliance without careful plan selection and privacy-notice updates, a purpose-built EU-hosted alternative is safer.

Does Typeform store data in Europe?

Only on Business and Enterprise plans, and only when EU data residency is explicitly enabled. On free and Essentials plans, Typeform defaults to US-hosted AWS infrastructure — your respondents' data is processed outside the EEA. This is a critical distinction for GDPR Article 44 compliance: EU data residency is an opt-in feature on paid plans, not Typeform's default architecture.

Is Typeform suitable for accountants, lawyers, or financial advisers?

Not recommended. Professional services firms collecting client financial information, tax records, or legal case details are handling data with elevated GDPR sensitivity. Typeform's third-party analytics scripts — Amplitude, Intercom — fire on the public form player page, exposing client sessions to services not disclosed in a standard engagement letter or privacy notice. For client-facing forms in regulated professions, an EU-hosted form tool with no third-party trackers and encryption at rest is a materially stronger compliance position.

What is a GDPR-compliant alternative to Typeform?

A compliant alternative has: EU data residency as the default on all plans (not as a paid add-on), a Data Processing Agreement included without enterprise negotiation, no third-party tracking scripts on the form player page, and EU-only processing. Typeform meets some of these criteria on paid plans but fails on third-party trackers across all tiers.

Comparing tools? See our answer to is Google Forms GDPR compliant for how a Workspace account changes the picture.