Is Typeform GDPR compliant? What it covers and what you still own

No software product is GDPR compliant on its own, because the GDPR regulates what organizations do with personal data, not the tools they use. When you publish a form and collect names, emails or opinions, you are the controller: you decide why the data is collected and what happens to it. The form builder is a processor that stores and handles the answers on your instructions.

So the useful question is narrower: does the vendor give you what a processor must give a controller? Article 28 of the GDPR requires a contract (a data processing agreement, or DPA) that covers confidentiality, security, sub-processors, help with data subject requests, breach notification, deletion or return of data at the end, and audits. If personal data leaves the EEA, Chapter V requires a transfer mechanism such as an adequacy decision or Standard Contractual Clauses (SCCs).

Everything else, including telling respondents what you do with their answers, choosing a lawful basis and deciding how long to keep responses, stays with you whichever tool you pick.

Yes. Typeform's help centre says the GDPR processor obligations are part of its published legal terms, so you do not need to sign a separate DPA. The DPA itself sits at typeform.com/legal/data-processing-agreement and names Typeform S.L., a Spanish company registered in Barcelona, as the other party. It covers processing only on your documented instructions (which include settings you choose in the product), confidentiality, security measures listed in an annex, sub-processors, help with data subject requests, breach notification "without undue delay", deletion or return at the end, and audits.

Two details are worth reading before you rely on it. First, audits: Typeform can satisfy audit requests by sharing its ISO 27001 and SOC 2 reports, and on-site audits are limited to one a year at your cost unless a material breach is found. Second, if you want a countersigned or negotiated DPA, which some procurement and legal teams insist on, Typeform offers that only on Enterprise and Growth Custom plans.

Typeform's sub-processor page splits the list into two groups. For response data, the core sub-processor is Amazon Web Services, located in the US, or the EU for EU data hosting customers. A second group only touches response data if you use optional features, for example Alloy for some integrations (Klaviyo, Zendesk, Freshdesk, Asana, Aircall, Shopify) and AWS AI services for AI form building and analysis.

A separate page lists the companies Typeform uses for its own business, such as billing, analytics and monitoring, which mostly concern your account data rather than your respondents' answers. Under the DPA, you are expected to subscribe to Typeform's email list for sub-processor changes, and you have 15 calendar days to object to a new one; if you do, Typeform may end the contract.

Typeform is an EU company, but on self-serve plans your responses are stored on AWS servers in Virginia. That is an international transfer, so the mechanism matters. Typeform's DPA relies on the European Commission's 2021 Standard Contractual Clauses: module 3 (processor to processor) for onward transfers to sub-processors, module 4 when the customer is outside the EEA, and the UK addendum for UK customers. Its sub-processor page adds that where SCCs alone cannot give equivalent protection, Typeform applies supplementary security measures.

The EU-US Data Privacy Framework, adopted by the Commission in July 2023, is a separate route that certified US companies can use. Typeform's sub-processor page lists "Adequacy decision and SCCs" as the transfer tool for AWS; its own DPA is built on SCCs. If your data protection officer wants a transfer impact assessment, Typeform's Enterprise plan includes security team support for vendor assessments.

Typeform's help centre says all data is hosted on AWS, with main servers in Virginia, USA. Data is encrypted in transit with TLS 1.2 and at rest with AES-256, including backups. The pricing page lists "Choose your preferred data center (US or EU)" as Enterprise only, and the help centre adds Growth Custom as a second plan with EU hosting.

The catch that trips up existing customers: EU data hosting is available to new customers, and the Enterprise help article says it is not currently available for existing accounts. If you already have years of forms on a Basic or Plus account and later need EU residency, expect a new account and a migration rather than a switch. EU-hosted accounts also have their own list of supported integrations, so check that the tools you connect are on it before you sign.

None of this makes US hosting unlawful under the GDPR. With SCCs in place, many EU organizations use US-hosted tools. But some public bodies, health providers and works councils require EU residency as internal policy, and for them Typeform's self-serve plans (Free, Basic, Plus, Business and Growth Flow) are off the table.

DSGVO (German) and RGPD (French, Spanish) are the same regulation as the GDPR under local names, so the answer does not change: Typeform provides the processor terms, and compliance depends on your setup. In German practice the DPA is usually called an AVV (Auftragsverarbeitungsvertrag). Typeform's position is that its online DPA applies without a signature; if your data protection officer requires a signed AVV, that is an Enterprise or Growth Custom conversation.

For UK organizations, the DPA includes the UK addendum to the SCCs and treats transfers between the UK and Spain as covered by adequacy decisions.

Typeform's help centre puts consent on the form owner: you are responsible for getting respondents' consent where needed and for telling them how the data will be used. It suggests a welcome screen or statement explaining the purpose, and a Legal question, which asks respondents to accept or decline terms. With logic, a decline can send someone straight to the end. The Legal question type is on the free plan's list of question types.

On deletion, Typeform is blunt: deleted responses, forms and accounts cannot be restored, and deleting a form also deletes its file uploads. Deleted responses still count toward the month's response limit. There is a bulk delete through the Responses API if you need to purge on a schedule. The DPA also says inactive free accounts are deleted after 24 months.

When a respondent asks you for access or erasure, Typeform expects the request to go to you; if it receives one directly, it forwards it to the form creator. Keep a note of which form a person answered so you can find and export or delete their response quickly.

Typeform lists SOC 2 Type II, ISO/IEC 27001:2022, ISO 27017 and ISO 27018 certifications in its help centre, with reports in its trust center, and also lists ISO/IEC 42001, the standard for AI management systems. That is a strong set for a form tool and it answers most vendor security questionnaires.

HIPAA is a US health-data law, separate from the GDPR. Typeform signs a Business Associate Agreement only on Enterprise, according to its pricing page. If you collect health information from EU residents, the GDPR treats it as special category data, which needs an Article 9 condition and usually a data protection impact assessment, whatever tool you use.

Zunoform publishes a short-form processor DPA at /dpa, incorporated into its terms. It names the customer as controller and Zunoform as processor, lists sub-processors (a hosting provider, Cloudflare, Resend for email, and the billing providers), incorporates the SCCs (module 2) for transfers from the EU and UK, and commits to deleting remaining copies within 30 days of termination. A countersigned copy is available by email on any plan.

Every plan, including Free, has an anonymous mode that stores no IP address, user agent, referrer, location, language or screen size for that form, which helps with data minimization on surveys that do not need identity. The contact question also has an optional privacy-consent checkbox you can switch on.

Where it does not fit: Zunoform does not offer guaranteed EU-only hosting, SOC 2, HIPAA or a BAA, or SSO. If your procurement checklist requires EU residency or third-party security certifications, Typeform Enterprise meets requirements that Zunoform does not today.