How to create GDPR-compliant surveys with empirio.ai

The moment your survey asks people for their opinions, their experiences or details about themselves, privacy comes into play. Your respondents trust you with their answers, and you are responsible for what happens to them. Whether your survey holds up depends on what you ask and how you handle the answers, but also on the technology in the background: your survey tool.

For European customers and anyone surveying people in the EU, the rulebook is the GDPR. It can apply to US organizations too, for example when they offer goods or services to people in the EU or monitor their behavior. Simply having a website that people in Europe can open is not enough on its own. The UK has its own UK GDPR with very similar rules. So if you deliberately run surveys for respondents in Europe, it pays to plan as if the GDPR applies to you.

empirio.ai is the ideal survey tool when you want to create GDPR-compliant surveys. The software is modern, and it takes privacy seriously: a data processing agreement from day one, EU hosting and ready-made privacy notices for your surveys. In the six points below, we show you why empirio.ai is a great choice for surveys that are modern and privacy-friendly at the same time.

Surveying only people in the US? Then the GDPR is usually not the law you need to worry about. There is no single federal privacy law for surveys in the US. Depending on your state and your industry, state privacy laws can apply, and research at a university usually needs a review by the IRB first. We explain the US rules and what else you need to keep in mind in our guide to data privacy in surveys.

Privacy and the GDPR at empirio.ai at a glance

Surveys are always about trust, and handling data with care has been our top priority from the very start. That is why privacy has always played a central role at empirio.ai, and it is one reason more than 100,000 people have trusted us with their surveys since 2018. Here are the main privacy advantages of empirio.ai at a glance:

1. The data processing agreement comes with sign-up
2. Your data is processed and stored in the EU
3. The AI assistants run in the EU too
4. Respondents can take part anonymously
5. The privacy page and consent in one click
6. Security and full control over your data

Below, we walk you through these six points one by one, so you know exactly what is behind each advantage and how to use it for your surveys.

1. The data processing agreement comes with sign-up

If the GDPR applies to your survey and a survey tool processes answers that identify people on your behalf, you need a data processing agreement, or DPA for short, with that provider. And it needs to be in place before the first answer comes in. It makes sure the provider only processes the data on your instructions, keeps it protected and does not use it for its own purposes.

With many tools, you first have to request the DPA, fill out a form or upgrade to a more expensive plan. At empirio.ai, it is part of our terms and conditions, which you accept when you sign up. That means it applies from day one, on the free plan too. There is nothing to sign and nothing to wait for.

You can read the full agreement anytime, including the technical and organizational measures and the list of our subprocessors: empirio.ai data processing agreement. For your own documentation, you can link to it directly or download it as a PDF if you want to keep a copy.

2. Your data is processed and stored in the EU

All your survey data, including your respondents' answers, is processed and stored on servers in the European Union. For European customers and anyone surveying people in the EU, that matters a lot: the answers stay under European data protection law, and the survey tool itself does not send them to the US or any other country outside the EU. So for the stored answers, there is no transfer to a third country that you need to check or explain in your privacy notice.

We are open about which service providers we use to run our website and platform, and where they are based. You will find everything in our privacy policy and in the appendix to the DPA. This kind of transparency matters most when you run surveys for a university, a nonprofit or your company, because in the end you are the one who is responsible to your respondents.

3. The AI assistants run in the EU too

Many survey tools now offer AI, for example to draft a questionnaire or to analyze open-ended answers. Usually, there is a language model behind it that runs at a provider in the US. For you, that means once you send answers that identify people through the AI, that data leaves the EU.

empirio.ai works differently. The AI features we offer ourselves process content only on infrastructure inside the European Union, and of course your input and survey data are never used to train AI models. AI that also runs in the EU is still the exception among survey tools. On top of that, you always decide for yourself whether to use AI for your survey or not. Nothing is sent to AI models automatically.

There is one more thing to keep in mind: empirio.ai offers a wide range of integrations that connect the survey tool with other software, including AI models. If you connect empirio.ai to Claude, ChatGPT or another assistant, for example, you are choosing that service on purpose. From then on, its terms and server locations apply, not ours. Make sure the provider does not use your input to train its AI. Or use it on purpose only to help you draft the questionnaire.

If you want to be on the safe side, use one of the many AI features built into empirio.ai. They help you create, edit and analyze your surveys, and everything is processed 100% in the EU.

Why the EU location matters

A survey tool with servers in the US is not automatically off-limits for data from Europe. Since 2023, the EU-US Data Privacy Framework has allowed US companies that have certified under it to receive personal data from the EU. Whether this decision will hold is still an open question. If your team has respondents or customers in Europe and your data and AI processing stay in the EU, you do not depend on it. That makes working with European partners easier and also supports Europe's digital sovereignty.

4. Respondents can take part anonymously

People who take your survey on empirio.ai need neither an account nor a login. They open the link, answer the questions and they are done. You only collect a name or an email address if you ask for it yourself.

That is about more than convenience. Strictly speaking, a truly anonymous survey falls outside the GDPR, because no personal data is created. And under the privacy rules for surveys in the US, collecting no identifying data at all is usually the safest route too. What counts is that no one can be identified, not even indirectly. So only ask what you will actually analyze, and keep demographic questions broad when groups are small. As a bonus, you will get more honest answers.

5. The privacy page and consent in one click

As soon as you collect personal data, a privacy notice and usually a consent step belong at the start of your survey. In many tools, you build this yourself from a text question and a separate checkbox, and you have to remember to make the checkbox required. That is exactly where the gaps appear.

At empirio.ai, the privacy page is its own page type in the editor. The text and the consent checkbox belong together. Consent is required automatically and is saved together with the answers.

1. Add the privacy page. Select the privacy page in the editor and place it before all other questions.
2. Check the text and adjust it if needed. A suitable text for the privacy notice and the checkbox is created automatically, and you can adjust it if you like.
3. Done. Now you can send out your privacy-compliant survey.

Pay attention to the order. Consent that only comes after the first questions is too late, because by then you have already collected those answers.

6. Security and full control over your data

Privacy also means that no unauthorized person gets access to your results, and that you decide when data disappears.

• The connection between browser and server is encrypted.
• Two-factor authentication for your account is included on every plan.
• Your data is backed up daily so nothing gets lost.
• You can export or delete answers and entire surveys yourself at any time.

We permanently remove deleted survey data from our systems after 14 days. That way, you can actually stick to the retention period you state in your privacy notice.

Checklist for your GDPR-compliant survey

empirio.ai makes sure you can create GDPR-compliant surveys from a technical point of view. But there are a few things no survey tool can do for you, and you need to keep an eye on them yourself, whichever tool you use:

• Know which rules apply: The GDPR matters when you survey people in the EU. If you only survey people in the US, check the privacy law of the states your respondents live in instead and, for university research, talk to your IRB before you collect any answers.
• Private or not: Where the GDPR applies, a purely personal survey among family or friends usually falls outside it under the household exemption. As soon as you ask on behalf of a club, a university or a company, that exemption no longer covers you.
• Get consent: In most cases, it is enough for your respondents to agree before the first question. For surveys at work or at a university, that is not always enough. Under the GDPR, consent from employees is often not considered freely given, and university research usually needs a decision from the IRB.
• Only ask what you need: Any question you will not analyze later can go.
• Be careful with sensitive questions and answer options: Under the GDPR, questions about health, religion or political opinions are specially protected. Answer options like department or age group can also reveal who answered when groups are small.

You will find more on this, including legal bases and retention periods, in our guide to data privacy in surveys. This post is not legal advice. When in doubt, the data protection authority in the relevant EU country, the IRB or privacy office at your university, or the data protection officer or legal team at your company can help.

If you want to get started right away, you can create your survey here. Everything described in this post is included at empirio.ai from the free plan on.