Is Wufoo GDPR or HIPAA Compliant in 2026? No — Here's Why

Wufoo has been around since 2006 — one of the original drag-and-drop form builders. It's still widely used for contact forms, event registrations, and simple surveys. But for EU organisations collecting personal data, age and familiarity are no substitute for GDPR compliance.

Short answer: Wufoo is not suitable for EU organisations that need to meet GDPR requirements. Its US-hosted infrastructure, SurveyMonkey ownership, and lack of EU-specific contractual protections on standard plans create fundamental compliance gaps.

Who owns Wufoo?

Wufoo was acquired by SurveyMonkey (now Momentive) in 2011. This matters because Wufoo operates on SurveyMonkey's infrastructure — a US company with US-based data centres as its default. The compliance limitations that apply to SurveyMonkey largely apply to Wufoo as well, with fewer options for remediation.

Where is Wufoo data stored?

Wufoo stores form responses on SurveyMonkey's US-based infrastructure. Unlike SurveyMonkey's own product — which has introduced limited EU data residency options for paid plans — Wufoo does not offer EU data residency at all. If you use Wufoo, your respondents' data is stored in the United States regardless of your plan tier.

GDPR Article 44 restricts the transfer of personal data to third countries unless specific safeguards are in place. Wufoo relies on Standard Contractual Clauses for US transfers — but this does not change where the data physically resides or who can access it under US law.

For organisations with any EU data residency requirement — healthcare, legal, financial services, government, or simply organisations whose respondents have a reasonable privacy expectation — US-hosted storage with no EU region option is a hard blocker.

Does Wufoo offer a Data Processing Agreement?

This is one of Wufoo's most significant GDPR problems. A Data Processing Agreement (DPA) is legally required under GDPR Article 28 whenever you use a third-party processor for personal data. Wufoo does not offer a standalone DPA for standard plans.

Wufoo's terms of service reference SurveyMonkey's broader privacy framework, but this is not the same as a signed, GDPR-compliant DPA with your organisation. Without a valid DPA, you are in direct violation of Article 28 from the moment you collect a single response.

Enterprise-level accounts may be able to negotiate a DPA directly with Momentive, but this is not a self-service option and is not available to the vast majority of Wufoo users.

Third-party trackers on Wufoo form pages

When a respondent opens a Wufoo form, the form page loads Google Analytics, Stripe (for payment forms), and SurveyMonkey's own analytics infrastructure. These trackers run on the form player — the page your respondents interact with — and are outside your control.

Under GDPR, you as the data controller are responsible for every processor that touches your respondents' data, including those introduced by your form tool. Google Analytics on a form page collecting personal data requires explicit consent and disclosure in your privacy notice. Most Wufoo users have neither.

Encryption

Wufoo encrypts data in transit (TLS) and at rest using standard encryption. Momentive manages the infrastructure and keys, so Wufoo and Momentive staff, sub-processors and legal requests directed at a US company can reach your respondents' form responses.

Data subject rights

GDPR Articles 15–22 give respondents the right to access, correct, and delete their personal data. Wufoo allows administrators to delete individual entries from the dashboard. There is no built-in workflow for Subject Access Requests (SARs) — if a respondent asks to see all data you hold, you'll need to manually find and compile it.

Wufoo's form management interface has not been significantly updated for GDPR workflows. For even moderate response volumes, manual SAR handling is operationally impractical.

Summary: Wufoo and GDPR

• ✗ No EU data residency — data stored in US by default, no EU region available
• ✗ No DPA on standard plans — direct violation of GDPR Article 28
• ✗ Third-party trackers on form pages — Google Analytics, Stripe, Momentive analytics
• ✗ Operated by a US parent company (Momentive/SurveyMonkey) — no EU-only guarantee
• ✗ No built-in SAR workflow — manual handling only
• ✗ US-incorporated parent company (Momentive) with US-default infrastructure

Unlike some US-based form tools that have added EU data residency options or dedicated GDPR plans, Wufoo has not evolved its compliance posture since the SurveyMonkey acquisition. For EU organisations, it is among the least suitable form builders for personal data collection.

Is Wufoo HIPAA compliant?

Wufoo is not HIPAA compliant. HIPAA-covered entities and business associates must sign a Business Associate Agreement (BAA) with any vendor that processes Protected Health Information (PHI). Wufoo does not offer a BAA on any plan. Because Wufoo operates on SurveyMonkey's shared infrastructure, there is no configuration path to meet HIPAA's required technical safeguards.

HIPAA compliance requires: a signed BAA, audit controls for PHI access, automatic session timeout, encryption with controls that prevent the platform operator from reading PHI, and strict access restrictions. SurveyMonkey's enterprise offering includes a HIPAA-eligible tier, but Wufoo — as a separate, lower-tier product — does not inherit those capabilities and is not covered by SurveyMonkey's HIPAA programme.

For EU healthcare organisations, the analysis is the same from the GDPR side: health data is special category data under Article 9 GDPR, requiring explicit consent or another specific lawful basis, and a higher bar for technical safeguards. Wufoo's US-hosted infrastructure, absence of a DPA on standard plans, and third-party trackers on the form player make it unsuitable for any health data collection — regardless of whether HIPAA or GDPR applies.

Does Wufoo have a Business Associate Agreement (BAA) for HIPAA?

No. Wufoo does not offer a Business Associate Agreement on any plan — not even at enterprise tier. A BAA is the foundational legal document required before any vendor can lawfully handle Protected Health Information (PHI) under HIPAA. Without a signed BAA, using Wufoo for patient intake forms, appointment requests, medical questionnaires, or any form that combines a person's identity with health information creates direct HIPAA liability. There is no upgrade path or add-on that unlocks a BAA for Wufoo accounts.

Can healthcare organisations use Wufoo for patient forms?

No. HIPAA-covered entities — hospitals, clinics, GP surgeries, dental practices, pharmacies — and their business associates cannot lawfully use Wufoo for any form that collects Protected Health Information. Patient intake forms, symptom questionnaires, appointment scheduling forms, medication lists, and any form that links a person's identity to health data all constitute PHI. Without a BAA, without HIPAA-eligible encrypted infrastructure, and without audit logging that prevents Wufoo or Momentive staff from reading PHI, Wufoo is structurally unsuitable for healthcare data collection.

Frequently asked questions

Is Wufoo HIPAA compliant?

No. Wufoo is not HIPAA compliant. HIPAA requires a signed Business Associate Agreement (BAA) before any vendor can lawfully handle Protected Health Information (PHI). Wufoo does not offer a BAA on any plan — not on free, not on paid, not at enterprise tier. Because Wufoo operates on SurveyMonkey's shared infrastructure and is marketed as a separate, lower-tier product, it does not inherit SurveyMonkey Enterprise's HIPAA-eligible features. Any HIPAA-covered entity using Wufoo for patient intake forms, appointment requests, symptom questionnaires, or any form that combines identity with health data is creating direct HIPAA liability.

Is Wufoo GDPR compliant?

No. Wufoo fails GDPR on multiple grounds. It has no Data Processing Agreement (DPA) on standard plans — a direct violation of GDPR Article 28, which requires a signed DPA with every data processor. Its data is stored on US-based SurveyMonkey infrastructure with no EU data residency option on any plan. The Wufoo form player loads Google Analytics and Momentive's own analytics scripts, adding undisclosed processors to every form submission. For EU organisations, Wufoo is among the least compliant form builders currently on the market.

Does Wufoo have a DPA (Data Processing Agreement)?

No. Wufoo does not provide a standalone GDPR Data Processing Agreement on standard plans. Wufoo's terms of service reference SurveyMonkey's broader privacy framework, but referencing a parent company's privacy documentation is not the same as executing a DPA under GDPR Article 28. Enterprise accounts may be able to negotiate bespoke terms directly with Momentive, but this is not a self-service option and is unavailable to the vast majority of Wufoo users. If you are using Wufoo on any standard plan and collecting personal data from EU residents, you are in violation of Article 28.

Does Wufoo store data in Europe?

No. Wufoo stores all form data on SurveyMonkey's US-based infrastructure. Unlike SurveyMonkey's own product — which has added limited EU data residency options for paid plans — Wufoo does not offer EU data residency at any plan tier. Your respondents' data is stored in the United States regardless of whether your organisation and respondents are based in the EU. GDPR Article 44 restricts such transfers without appropriate safeguards; Wufoo relies on Standard Contractual Clauses, but this does not change the physical location of the data or access rights under US law.

What to use instead of Wufoo for EU compliance

The requirements are consistent: EU data residency as the default (not as an option), a DPA available on all plans without enterprise negotiation, no third-party tracking on the form player, encryption at rest, and built-in data subject rights tooling.