GDPR checklist for forms tools.
Form tools collect answers directly from people, so they sit at the start of the data’s journey. Compare 3 common tools and see what to check for each.
Compared at a glance
| Tool | Usual role | Data location | Agreement |
|---|---|---|---|
 Typeform | Usually a processor | Set per account or project | Published by the vendor |
 Tally | Usually a processor | Often the European Union, check your account | Published by the vendor |
 SurveyMonkey | Usually a processor | Set per account or project | Published by the vendor |
What to check for forms tools
- Show a short notice at the point of collection, with a link to your policy.
- Collect only the fields you need.
- Set a retention period for responses and attachments.
- Record the region and where responses are exported to.
All forms tools
Questions, answered.
What should I check before using a forms tool under the GDPR?
Show a short notice at the point of collection, with a link to your policy. Collect only the fields you need. Set a retention period for responses and attachments. Record the region and where responses are exported to.
Do I need a data processing agreement with a forms provider?
If the provider handles personal data on your behalf, yes: Article 28 of the GDPR requires a written contract. Some providers publish the text, others give it to you inside your account. Providers that decide their own purposes may act as independent controllers instead, so check the role.
Which forms tools does Privacyboard cover?
Typeform, Tally, SurveyMonkey. Each has a page with its agreement, usual role and data location, checked on 1 November 2026.
Other categories
Privacyboard is not affiliated with these vendors. Checked on 1 November 2026. This is guidance, not legal advice.