How to create GDPR-compliant surveys with empirio.ai

As soon as your survey asks for opinions, experiences or details about people, data protection comes into play, and in many cases so does the UK GDPR. Your participants trust you with their answers and you are responsible for what happens to them. Whether your survey is privacy compliant depends on what you ask and how you handle the answers, but also on the technology behind it, meaning your survey tool.

empirio.ai is the ideal survey tool if you want to create GDPR-compliant surveys. The software is modern and takes data protection seriously, from the data processing agreement and EU hosting to ready-made privacy notices for your surveys. In the six points below we show you why empirio.ai is a very good choice for surveys that are both modern and privacy compliant.

Which rules apply to surveys in general and what you still need to take care of yourself is explained in detail in our guide to data protection in surveys.

Data protection & UK GDPR at empirio.ai at a glance

Surveys are always about trust, and handling data carefully has been our top priority from the very start. That is why data protection has always played a central role at empirio.ai, and it is one reason why more than 100,000 people have trusted us with their surveys since 2018. The key data protection benefits of empirio.ai at a glance:

1. The data processing agreement is included when you sign up
2. Data is processed and stored in the EU
3. The AI assistants run in the EU too
4. Participants can take part in surveys anonymously
5. A privacy page and consent in one click
6. Security and full control over your data

Below we walk you through these six points one by one, so you know exactly what is behind each benefit and how to use it for your surveys.

1. The data processing agreement is included when you sign up

As soon as a survey tool processes identifiable responses on your behalf, the UK GDPR requires a written contract between you as the controller and the provider as the processor. This is usually called a data processing agreement, or DPA for short, and electronic form counts as written. It needs to be in place before the first response comes in. It sets out that the provider only processes the data on your documented instructions, keeps it secure and does not use it for its own purposes.

With many tools you have to request the DPA, fill in a form or upgrade to a more expensive plan. At empirio.ai it is part of our terms and conditions, which you accept when you sign up. That means it applies from day one, even on the free plan. There is nothing to sign and nothing to wait for.

You can read the full agreement at any time, including the technical and organisational measures and the list of our sub-processors: empirio.ai data processing agreement. For your own documentation, such as your record of processing activities, you can refer to it directly or download it as a PDF if you want to keep a copy.

2. Data is processed and stored in the EU

All your survey data, including your participants’ answers, is processed and stored on servers in the European Union, so it stays under European data protection law throughout. The UK recognises the countries of the EEA, including every EU member state, as providing an adequate level of data protection. Personal data can therefore flow from the UK to the EU without you having to put extra safeguards in place. In your privacy notice you simply name the EU as the location, and there is no transfer to the US to assess or explain for your stored responses.

We are open about which service providers we use to run the website and platform and where they are based. You will find everything in our privacy policy and in the annex to the DPA. This transparency matters especially if you run surveys for a university, a club or your business, because in the end you are the one who is accountable to your participants.

3. The AI assistants run in the EU too

Many survey tools now offer AI, for example to draft a questionnaire or analyse open answers. Usually there is a language model behind it that runs with a provider in the US. For you this means that as soon as you send identifiable answers through the AI, that data leaves the UK and the EU.

empirio.ai works differently. The AI features we provide ourselves process content exclusively on infrastructure inside the European Union, and of course your inputs and survey data are not used to train AI models. AI that also runs in the EU is still the exception among survey tools. You also always decide yourself whether to use AI for your survey or not. Nothing is passed to AI models automatically.

There is one more thing to keep in mind. empirio.ai offers a wide range of integrations that connect the survey tool with other IT applications, and with AI models too. If you connect empirio.ai to Claude, ChatGPT or another assistant, for example, you are consciously choosing that service. Its terms and server locations then apply, not ours. Make sure the provider does not use your inputs to train its AI. Alternatively, only let it help you build the questionnaire.

If you want to play it safe, use one of the many AI features in empirio.ai. They help you create, edit and analyse your surveys, and everything is processed 100% in the EU.

Why the EU location makes such a difference

A survey tool with servers in the US is not automatically off limits. Since 12 October 2023 the UK-US data bridge has allowed UK organisations to send personal data to US companies certified under the UK Extension to the EU-US Data Privacy Framework. The bridge builds on that EU-US framework, which is still being challenged before the EU courts, so whether it will last is still open. If your data and the AI processing stay in the EU, you do not depend on it. That also makes it easier to get the tool approved at work.

4. Participants can take part in surveys anonymously

People taking your survey on empirio.ai need neither an account nor a login. They open the link, answer the questions and they are done. You only collect a name or email address if you ask for it yourself.

This is about more than convenience. A genuinely anonymous survey strictly speaking falls outside the UK GDPR rules altogether, because no personal data is created. What matters is that nobody can be identified indirectly either. So only ask what you will actually analyse, and keep demographic questions broad in small groups. As a bonus, you will get more honest answers.

5. A privacy page and consent in one click

As soon as you collect personal data, a privacy notice belongs at the start of your survey, and usually a consent request too. In many tools you build a text question and a tick box separately and have to remember to make the tick box mandatory yourself. That is exactly where the gaps appear.

In empirio.ai the privacy page is its own page type in the editor. The text and the consent tick box belong together. Consent is required automatically and is stored with the response.

1. Add the privacy page. Select the privacy page in the editor and place it before all other questions.
2. Check the text and adapt it if needed. A suitable text for the privacy notice and the tick box is created automatically, and you can adjust it if you like.
3. Done. Now you can send out your privacy-compliant survey.

Watch the order. Consent that only comes after the first questions is too late, because by then you have already collected the answers.

6. Security and full control over your data

Data protection also means that nobody unauthorised gets hold of your results, and that you decide when data disappears.

• Data travelling between browser and server is encrypted.
• Two-factor authentication for your account is included on every plan.
• Your data is backed up daily, so nothing gets lost.
• You can export or delete responses and entire surveys yourself at any time.

Once you delete survey data, we remove it permanently from our systems after 14 days. That way you can actually stick to the retention period you state in your privacy notice.

Checklist for your UK GDPR-compliant survey

empirio.ai makes sure that, from a technical point of view, you can create surveys that comply with the UK GDPR. But there are a few things no survey tool can do for you, and you need to keep an eye on them yourself, whichever tool you use:

• Private or not: If you only ask family or friends, the UK GDPR generally does not apply, because purely personal or household activities are outside its scope. As soon as you ask on behalf of a club, a university or a business, it does.
• Choose the right lawful basis: For many voluntary surveys, consent given before the first question is the right choice. For surveys at work or at university it often is not, because consent is rarely freely given where there is a clear imbalance of power.
• Only ask what you need: Any question you will not analyse later can go.
• Take care with sensitive questions and answer options: Questions about health, religion or political opinions involve special category data, which is specially protected and in a survey usually needs explicit consent. Answer options such as department or age group can also reveal who responded in small groups.

More on this, including the lawful basis and retention periods, is in our guide to data protection in surveys. This post is not legal advice. If in doubt, the Information Commissioner’s Office (ICO), your university’s data protection team or your organisation’s data protection officer, if it has one, can help.

If you want to get started straight away, you can create your survey here. Everything described here is included in empirio.ai from the free plan upwards.