Would you give a complete stranger in the street your age, your job and your health status? Probably only if you knew exactly who was asking and what would happen to the answers. That is what data protection in surveys comes down to.
Your survey complies with the UK GDPR when you have a lawful basis under Article 6 before the first question, tell participants who you are and how long you keep the answers, collect only what you will analyse, and use a survey tool that signs a data processing agreement with you.
empirio.ai, an online survey tool from Germany, includes the data processing agreement in the free plan. The legal statements in this article were checked against the guidance of the Information Commissioner’s Office on 3 November 2026.
📌 Key takeaways
- Purely private surveys fall outside the UK GDPR entirely.
- Consent needs no signature, but it needs a record.
- An IP address alone does not prove consent.
- The privacy notice belongs before every other question.
- With empirio.ai the data processing agreement is in the free plan.
This is what it looks like done properly: a dedicated privacy page with a consent tick box, placed at the very start of your survey.
Create a survey for free
With empirio.ai you can create a modern online survey in minutes — with hosting in the EU.
- AI-built survey
- Adjust by drag & drop
- Real-time analysis
Personal or professional: does the UK GDPR apply to you?
Purely private surveys fall outside the UK GDPR. The regulation does not apply to processing carried out by an individual in the course of a purely personal or household activity. Someone asking the family group chat which Saturday suits everyone for a barbecue needs neither consent nor a privacy notice.
The household exemption is narrower than the name suggests. It covers individuals, not organisations, and only activities with no connection to a professional or commercial purpose. A club or society is an organisation and falls outside the exemption, even where it is run entirely by volunteers and nobody makes any money from it.
| Who is asking | UK GDPR | What you need |
|---|---|---|
| An individual among family and friends | no | nothing, as long as the link stays private |
| A club or society surveying members | yes | lawful basis, privacy notice, processing contract |
| A student running a dissertation survey | yes | plus whatever your university requires |
| A business surveying customers or staff | yes | full obligations, often a processing record |
Two misunderstandings are common here. First, the exemption does not make a survey a legal free-for-all: the tool provider still processes the data and still has obligations, you as an individual simply have none of your own. Second, you leave the exemption faster than you think. As soon as you share the link publicly and anyone can take part, the purpose is no longer purely personal.
Students are the case people underestimate most. A dissertation survey is not a private activity, it is part of a course of study, and many universities have their own requirements on top. What that means for planning is covered in the guide to surveys for a bachelor’s or master’s dissertation.
Personal data in surveys: what actually counts
Personal data is any information relating to an identified or identifiable living individual. What matters is not the individual field but whether someone can be singled out through it. That qualifier is missing from most survey guides, which is why they end up with long lists that confuse more than they help.
One example makes the difference clear. Age on its own is not personal data in a survey of 400 people. In a team of seven, the combination of age, gender and department can be more than enough to identify one person. Identifiability is not a property of the field, it emerges from the context.
| Field in your survey | Personal data | What it depends on |
|---|---|---|
| Name and email address | always | directly identifying |
| Device IP address | usually yes | often logged by the tool automatically |
| Age, gender, department | depends on group size | the combination singles people out |
| Free-text answer | frequently by accident | people name colleagues and places there |
The last row catches most people out. An open box asking for comments reliably produces sentences like “the problem is Sarah in accounts”. You have now collected personal data about someone who never took part in your survey at all. If you use open questions, ask in the field label for no names, and read the answers before you analyse them.
In the United Kingdom the rules sit in the UK GDPR alongside the Data Protection Act 2018, which received Royal Assent on 23 May 2018 and fills in the areas the regulation leaves to national law.
Special category data: when your question needs more
Special category data covers racial or ethnic origin, political opinions, religious or philosophical beliefs, trade union membership, health, sex life and sexual orientation, along with genetic and biometric data used to identify someone. Processing it is prohibited unless one of the exceptions applies, and in a survey explicit consent is usually the only realistic one.
The trap is that a question does not have to name the category to fall inside it. Asking staff how many days they were off sick is a health question. Asking which place of worship someone attends regularly says something about religious belief. The safest test is to ask what the answer reveals, not what the question mentions.
Explicit means more than ticked
For special category data the tick box has to be its own, tied to that specific processing, and worded so the participant can see exactly what they are agreeing to. A single blanket tick covering the whole survey does not meet the standard. The ICO makes the same point about the strength of the statement: explicit consent must be affirmed in a clear statement, whether spoken or written.
Sensitive is not the same as special category
Plenty of questions feel sensitive without falling under the special category rules. Salary, debt and family circumstances are ordinary personal data in law, even though people are reluctant to answer them. That does not make them harmless: the risk to your participants is real, so keep the answers separated from any identifier and think about who in your organisation will see them.
Which lawful basis lets you ask at all?
Every piece of processing needs one of the six lawful bases in Article 6 of the UK GDPR. Consent is one of them, and despite the assumption it is not automatically the right one. Which basis fits depends on who is asking and what relationship they have with the people answering.
A club surveying its members sits differently from a university evaluating a module, and both sit differently from an employer surveying staff. Get this decision right before you write the privacy notice, because the notice has to state the basis you chose.
| Lawful basis | When it works | The catch |
|---|---|---|
| Consent, Article 6(1)(a) | voluntary participation, no power imbalance | withdrawable at any time, must be recorded |
| Legitimate interests, Article 6(1)(f) | your own customer survey, no sensitive data | document the balancing test, right to object |
| Public task, Article 6(1)(e) | research at a public university | depends on the underlying statutory function |
The ICO gives an example that maps directly onto surveys. An individual submits an online survey about their eating habits; by submitting the form they are clearly indicating consent to process their data for the purposes of the survey itself. But submitting the form will not, by itself, be enough to show valid consent for any further use of that information. If you later want to reuse the answers for something else, you need to have asked for that separately.
One more point matters for staff and student surveys. Consent requires a genuine, free choice, and where there is a clear imbalance of power that choice rarely exists. If you are surveying in that kind of relationship, the cleanest answer is to build the survey so that no personal data is collected at all. Your university, employer or the ICO has the final word on your particular case; this article is not legal advice.
Create a survey for free
With empirio.ai you can create a modern online survey in minutes — with hosting in the EU.
- AI-built survey
- Adjust by drag & drop
- Real-time analysis
Asking for consent: the checklist
Valid consent is freely given, specific, informed and unambiguous, given by a statement or a clear affirmative action. It belongs at the start of the survey, before the first substantive question. How you collect it is left open, and that is where most home-made forms go wrong.
The ICO guidance is blunt about the failure modes: you cannot rely on silence, inactivity, pre-ticked boxes, opt-out boxes, default settings or a blanket acceptance of your terms and conditions. Opt-out boxes are not banned by name, but the ICO treats them as essentially the same as pre-ticked boxes, which are.
What the consent request must contain
The following is the minimum. It fits into five sentences and has to be written in plain language.
- Who is running the survey, with a name and contact.
- What the data will be used for.
- What kinds of data you collect.
- That taking part is voluntary.
- That consent can be withdrawn at any time.
- Whether data leaves the United Kingdom.
There is no requirement for a signature or a written form. A clear affirmative action is enough, and clicking an empty tick box is exactly that. Even explicit consent can be given orally, though the ICO expects you to keep a record of the script.
Withdrawal deserves its own line in your plan. It shall be as easy to withdraw as to give consent, and the ICO recommends making it an easily accessible one-step process. There is no exemption from this for scientific research. For a long-term study the ICO also suggests considering refreshing consent every two years.
How to prove consent
Article 7(1) of the UK GDPR puts the burden on you: you have to be able to demonstrate that the participant consented. The ICO sets out what that record looks like. Keep who consented, when they consented, what they were told at the time, how they consented and whether they have since withdrawn.
What has to be provable is the specific consent statement the individual saw, documented in full. Storing an IP address and asserting that the consent came from that address is not a record of consent, because it shows neither the wording nor the act. The German supervisory authorities reject that practice expressly in their guidance on consent (as at 23 September 2026), and that is the standard you work to the moment you survey participants in the EU.
For an online survey that means one thing in practice: the consent wording someone saw and the tick they set belong in the same record as their answer. Rebuild the notice as an ordinary text question and ask for the tick somewhere else, and you can no longer show which wording anybody agreed to. If the consent turns out to have been invalid, you cannot swap it for another lawful basis after the event; the German authorities treat switching between bases as a breach of fairness and transparency, so the basis has to be right before you start.
When minors take part in your survey
Article 8 of the UK GDPR sets the age at which a child can consent on their own behalf, but only for an information society service offered directly to them, and section 9 of the Data Protection Act 2018 reads that age as 13 for the United Kingdom. The ICO states that only children aged 13 or over are able to provide their own consent, and that for a child under 13 an adult with parental responsibility has to consent instead, with reasonable efforts to verify that the person holds it (ICO: what are the rules about an ISS and consent?).
A questionnaire you hand to a class is not usually an online service offered directly to the child, so the age of 13 works as an orientation rather than a rule that settles your case. Two things follow for practice. For surveys in schools you obtain the consent of the parents or carers and clear the whole thing with the head teacher first, because schools often have requirements of their own. And the younger the group, the simpler the language has to be, because consent nobody understands is not informed consent.
A privacy notice for your survey: template to adapt
The privacy notice meets the transparency requirements in Article 13 and is a different thing from the consent request. Consent is the permission; the notice is the information about what happens. Both usually sit on the same first page of the survey, and both are allowed to be short. The welcoming part of that page, with the greeting, the purpose and the expected length, follows rules of its own, which are covered in the guide to the survey welcome message.
The template below covers the mandatory points for a straightforward survey with no special category data. Replace the square brackets and keep the rest.
This survey is run by [name, email address]. We collect [fields] in order to study [purpose]. Our lawful basis is your consent under Article 6(1)(a) of the UK GDPR. Taking part is voluntary and you can stop at any time. You can withdraw your consent at any time with effect for the future by emailing [address]. Answers are kept until [date] and then deleted; they are not shared with third parties. You have the right to access, rectify, erase and restrict processing of your data, and you can complain to the Information Commissioner’s Office.
Two details are worth getting right. The retention period has to be a real date or a criterion someone could apply, because “as long as necessary” does not tell anyone anything. And if your survey tool processes data outside the United Kingdom, say which country and on what basis.
Tip
Tie the retention date to the end of your project, not the end of term. “Until the examination process concludes, and no later than 31 March 2027” is a date you can still honour if your submission slips by a few weeks.
Anonymous, pseudonymised or still personal?
A genuinely anonymous survey falls outside the UK GDPR altogether, because there are no personal data to protect. Nobody can be identified from the answers, directly or indirectly, so there is no lawful basis to find and no retention schedule to keep.
The difficulty is in the word “genuinely”. You have to account for all the means reasonably likely to be used to identify someone, including the ones you hold yourself. A survey with no name field that quietly logs IP addresses and asks for department fails that test.
Pseudonymisation sits in between and is regularly mistaken for anonymity. With a pseudonym the link back to a person still exists, it just needs extra information such as a code list. Pseudonymised data therefore remains personal data and stays fully within scope. It is a safeguard, not an exit.
For most small surveys real anonymity is still achievable if you do three things together: collect no email address and require no login, switch off IP logging in the tool, and keep demographic questions coarse enough that no cell contains fewer than five people. How that works in practice is set out under anonymous surveys, and which demographic questions you can drop is a judgement of its own. If you still need an email address for a prize draw, ask for it after the last question, and the guide to the end of survey page shows how to keep it apart from the answers.
What the Court of Justice said about pseudonymisation
How far pseudonymisation takes you was settled by the Court of Justice of the European Union on 4 September 2025 in Case C-413/23 P. The judgment does not bind the United Kingdom after its exit from the EU, but it is the standard that applies to you the moment you survey participants in the EU. The case was not about a survey: it concerned comments an EU body had passed to a consultancy in pseudonymised form.
The core finding transfers cleanly. Whether data is personal depends on what additional information the person holding it has. As long as you hold the code list, the answers stay personal data in your hands, and pseudonymisation changes nothing about that. For a third party for whom re-identification is effectively ruled out, the same data can fall outside the definition. The Court also held that an opinion someone has expressed is always personal data, without anyone having to examine its content first. For free-text answers in surveys that is the more useful half of the judgment.
A second point decides a practical question. The duty to inform is assessed from the controller’s position at the time of collection. You cannot leave out the privacy notice on the grounds that you will pseudonymise or anonymise later. At the moment the first answer arrives the data is personal, and that is exactly when the notice has to be on screen.
Whether you may log IP addresses
An IP address is usually personal data, even where it is assigned dynamically. Logging it is therefore not forbidden, but it needs a purpose of its own and a lawful basis of its own. A plausible purpose is guarding against repeat submissions or automated answers, and legitimate interests under Article 6(1)(f) can carry that, together with the balancing test that goes with it.
Two limits apply regardless. If you promise anonymity you must not log the IP address, or the promise is untrue. And an IP address is not a record of consent, however convenient that would be. The rule of thumb: if you cannot name a purpose for the address, switch the logging off before the first link goes out.
A survey is only anonymous when you could not restore the link yourself either.
How to spot a UK GDPR compliant survey tool
You cannot tell a compliant survey tool from the promise on its homepage. Five checks will tell you. The moment you use a tool, the provider processes your participants’ data on your instructions, which makes you the controller and leaves the liability with you even when the mistake is theirs.
The first check is the data processing agreement required by Article 28. It has to be in place before the first response arrives, and it must be in writing, which includes electronic form. With several providers it depends on the plan: the free tier does not include it and only a paid account unlocks it.
| Check | What to look for | Why it matters |
|---|---|---|
| Data processing agreement | included in the plan and self-serve | Article 28 requires it |
| Where data is processed | processing, not just storage, in the UK or EU | access from abroad is a transfer |
| IP addresses | logging can be switched off or truncated | otherwise answers become identifiable |
| Retention | you can set deletion yourself | storage limitation under Article 5 |
| Sub-processors | list published and kept current | you are liable for the whole chain |
As at November 2026; provider terms change.
What a data processing agreement has to contain
The agreement is not a formality but a list of duties, and Article 28(3) of the UK GDPR is fairly precise about which. It fixes the subject matter, the duration, the nature and purpose of the processing, the type of personal data and the categories of data subject. It then binds the provider to your instructions, commits it to confidentiality and to the security measures in Article 32, settles how it helps you with access and erasure requests, and says what happens to the data at the end, return or deletion.
Three points in it get overlooked. The agreement has to be in writing, which may be an electronic format, so a confirmation inside your account is enough. Under Article 28(2) the provider may only engage sub-processors with your prior authorisation, and it has to tell you about a change in advance so that you can object. Every one of those sub-processors has to carry the same duties the provider took on towards you.
That is why the list of sub-processors is more than a formality: you are liable for the whole chain. And if a provider processes the data for its own purposes against your instructions, Article 28(10) makes it a controller for that processing and it carries the consequences itself.
Why the label “GDPR compliant” on its own says nothing
Almost every provider writes somewhere on its site that it is GDPR compliant. That is a self-declaration and not evidence. No regulator issues a compliance certificate for a piece of software. Article 42 does provide for certification, but it is voluntary, it covers a defined processing operation, and it is not the same thing as a general badge on a homepage.
What you can check is what sits in the table above, and in this order. Is the data processing agreement available on exactly the plan you intend to use, and can you get at it yourself? Does the provider name the place of processing or only the place of storage? Is the list of sub-processors public? Can IP logging be switched off? Can you delete responses yourself?
Five questions, and a provider either answers all five with a link to a document or does not answer at all. That is the difference between a commitment and a marketing line. Which providers meet which of these points is compared in the overview of survey tools.
Where data is processed: storage is not processing
Processing location deserves a closer look, because the claims often promise less than they appear to. Some providers guarantee a data region only for data at rest, not for the processing itself and not for support access, and often only from a certain plan upwards. Access from outside the United Kingdom is a transfer in data protection terms, even when the hard drive sits in London. How to check that on one specific tool is set out in the guide to using Google Forms in a privacy-compliant way.
If the processing happens wholly or partly outside the United Kingdom, you need a route for it: adequacy regulations made for that country, or the ICO’s international data transfer agreement or its addendum to the EU standard clauses. Check which one your provider relies on, and check that it names the route rather than implying one.
As a rule of thumb: if you handle special category data or survey employees, choose a European survey tool that processes in the UK or the EU and lets you switch off IP logging. For a date poll among friends, any tool will do as long as no personal data is collected.
How to build a compliant survey with empirio.ai
In empirio.ai the privacy page is its own page type rather than a text block you assemble yourself. Anyone who wants to create a survey for free adds it in the editor and decides where in the survey it sits. The consent tick box comes with that page, and the page in the image above is exactly what it produces.
The difference from a home-made version is that the text and the tick box belong together. If you rebuild the notice as an ordinary text question, you have to ask for the consent separately and make it mandatory separately, and that is where the gaps appear.
Four steps and the data protection part of your survey is done.
- Add the privacy page. Pick it as its own page type in the editor and move it to the front. You need a free account for that.
- Adapt the text. Paste the template from the chapter above and replace the square brackets.
- Label the tick box. The wording next to the box is yours, for example “I have read the information and I consent”.
- Make it required. Without the tick nobody proceeds, and the consent is stored alongside the response.
Watch out
You choose where the privacy page sits, and that is exactly where people trip up. Put it before every other question. Consent collected after the third question arrives too late, because by then you have already processed the answers. The lawful basis has to exist before the processing, not after it.
For multilingual surveys the tick box wording can be stored per language as well. Consent someone confirms in English while answering the questionnaire in French is not informed consent in the sense the UK GDPR means it.
That covers three of the five checks from the chapter before: the data processing agreement is there in the free plan, the hosting is in the EU, and the privacy page with its consent tick is its own page type instead of a construction of your own. How empirio.ai handles data protection in detail is set out in our post on creating GDPR-compliant surveys with empirio.ai. What no tool takes off your hands is the decision that comes first: whether you have a lawful basis at all, and whether your questions touch special category data. No software can check that for you.
Data protection in surveys: the four common mistakes
The four mistakes below turn up again and again in surveys run by clubs, students and small teams. All four can be fixed before you send the link.
What they have in common is that they do not come from carelessness but from an assumption that sounds perfectly reasonable. That is exactly why they survive a proofread.
Anonymity is promised but never delivered
“The survey is of course anonymous” sits in the invitation while the tool logs IP addresses and the form asks for department, age and gender. The promise is untrue, and in a small group it is also demonstrably untrue. Check the settings in the tool before you use the word anonymous.
More is collected than will ever be analysed
Data minimisation under Article 5 requires you to limit yourself to what is necessary. Asking for a full date of birth when you will report in age bands is the opposite of that. Cut every field for which you cannot name the analysis you plan to run.
The retention period is missing or vague
“Data is kept as long as necessary” does not satisfy Article 13. What is required is the period, or where that is not possible, the criteria used to determine it. A date is the simplest answer, and it forces you to actually delete afterwards.
Reuse is assumed rather than asked for
You run a survey for one project and a year later the answers look useful for another. The ICO gives the example of someone submitting an online survey about their eating habits: submitting the form indicates consent for that survey, but not by itself for any further use of the information. If reuse is plausible, ask for it separately at the time, or plan to anonymise the data instead.
Sources and further reading
The legal statements in this article rest on the regulation itself and on the guidance published by the Information Commissioner’s Office. Where a survey reaches participants in the EU, a judgment of the Court of Justice of the European Union and the German supervisory authorities’ guidance come into it as well. All of it is freely available.
- Information Commissioner’s Office: What is valid consent?, as at 4 August 2026.
- Information Commissioner’s Office: How should we obtain, record and manage consent?, as at 4 August 2026.
- Information Commissioner’s Office: What are the rules about an ISS and consent?, on the age of 13, as at 3 November 2026.
- Data Protection Act 2018, 2018 chapter 12, on legislation.gov.uk; section 9 reads the age in Article 8 as 13 years.
- Court of Justice of the European Union, judgment of 4 September 2025, Case C-413/23 P (European Data Protection Supervisor v Single Resolution Board), on when pseudonymised data is personal data.
- Datenschutzkonferenz (2026): Kurzpapier Nr. 20 on consent under the GDPR, as at 23 September 2026. This is the German supervisory authorities’ guidance and it applies to participants in the EU, not in the United Kingdom.
- Datenschutzkonferenz (2018): Kurzpapier Nr. 13 on processing under Article 28 GDPR, as at 17 December 2018, also the German supervisory authorities’ guidance.
- The UK GDPR, in particular Articles 5, 6, 7, 8, 9, 13, 28, 32 and 42.
One caveat worth knowing. The ICO notes on both consent pages that its guidance is under review following changes made by the Data (Use and Access) Act and may change (checked 4 August 2026). If you are setting up a long-running programme of surveys, read the pages again rather than relying on a copy of them.
Conclusion
Data protection in surveys looks bigger than it is. Settle the lawful basis first, ask only for what you will analyse, put a readable notice at the front and document the consent so that you could prove it for one single person, and the great majority of it is done. The safest route remains the one where no personal data is collected at all.
Where to go next
- Want to improve the survey itself? 8 tips for a successful online survey
- Need real anonymity? Creating an anonymous survey
- Writing a dissertation? Surveys for a bachelor’s or master’s dissertation
Ready to launch without patching the data protection afterwards?
empirio.ai processes the responses in the EU and provides the data processing agreement in the free plan.