Would you give a complete stranger in the street your age, your job and your health status? Probably only if you knew exactly who was asking and what would happen to the answers. That is what data protection in surveys comes down to.
Your survey complies with the UK GDPR when you have a lawful basis before the first question, tell participants who you are, what you collect and how long you keep it, ask only for the data you will actually analyse, and use a tool you have a processing contract with. For this article we checked the requirements against the guidance published by the Information Commissioner’s Office.
📌 Key takeaways
- Purely private surveys fall outside the UK GDPR entirely.
- Consent needs no written form, but it needs a record.
- Pre-ticked boxes and opt-out boxes are not valid consent.
- Withdrawing consent must be as easy as giving it.
- The privacy notice belongs before every other question.
This is what it looks like done properly: a dedicated privacy page with a consent tick box, placed at the very start of your survey.
Create a survey for free
With empirio.ai you can create a modern online survey in minutes — with hosting in the EU.
- AI-built survey
- Adjust by drag & drop
- Real-time analysis
Personal or professional: does the UK GDPR apply to you?
Purely private surveys fall outside the UK GDPR. The regulation does not apply to processing carried out by an individual in the course of a purely personal or household activity. Someone asking the family group chat which Saturday suits everyone for a barbecue needs neither consent nor a privacy notice.
The household exemption is narrower than the name suggests. It covers individuals, not organisations, and only activities with no connection to a professional or commercial purpose. A club or society is an organisation and falls outside the exemption, even where it is run entirely by volunteers and nobody makes any money from it.
| Who is asking | UK GDPR | What you need |
|---|---|---|
| An individual among family and friends | no | nothing, as long as the link stays private |
| A club or society surveying members | yes | lawful basis, privacy notice, processing contract |
| A student running a dissertation survey | yes | plus whatever your university requires |
| A business surveying customers or staff | yes | full obligations, often a processing record |
Two misunderstandings are common here. First, the exemption does not make a survey a legal free-for-all: the tool provider still processes the data and still has obligations, you as an individual simply have none of your own. Second, you leave the exemption faster than you think. As soon as you share the link publicly and anyone can take part, the purpose is no longer purely personal.
Students are the case people underestimate most. A dissertation survey is not a private activity, it is part of a course of study, and many universities have their own requirements on top. What that means for planning is covered in the guide to surveys for a bachelor’s or master’s dissertation.
Personal data in surveys: what actually counts
Personal data is any information relating to an identified or identifiable living individual. What matters is not the individual field but whether someone can be singled out through it. That qualifier is missing from most survey guides, which is why they end up with long lists that confuse more than they help.
One example makes the difference clear. Age on its own is not personal data in a survey of 400 people. In a team of seven, the combination of age, gender and department can be more than enough to identify one person. Identifiability is not a property of the field, it emerges from the context.
| Field in your survey | Personal data | What it depends on |
|---|---|---|
| Name and email address | always | directly identifying |
| Device IP address | usually yes | often logged by the tool automatically |
| Age, gender, department | depends on group size | the combination singles people out |
| Free-text answer | frequently by accident | people name colleagues and places there |
The last row catches most people out. An open box asking for comments reliably produces sentences like “the problem is Sarah in accounts”. You have now collected personal data about someone who never took part in your survey at all. If you use open questions, ask in the field label for no names, and read the answers before you analyse them.
In the United Kingdom the rules sit in the UK GDPR alongside the Data Protection Act 2018, which received Royal Assent on 23 May 2018 and fills in the areas the regulation leaves to national law.
Special category data: when your question needs more
Special category data covers racial or ethnic origin, political opinions, religious or philosophical beliefs, trade union membership, health, sex life and sexual orientation, along with genetic and biometric data used to identify someone. Processing it is prohibited unless one of the exceptions applies, and in a survey explicit consent is usually the only realistic one.
The trap is that a question does not have to name the category to fall inside it. Asking staff how many days they were off sick is a health question. Asking which place of worship someone attends regularly says something about religious belief. The safest test is to ask what the answer reveals, not what the question mentions.
Explicit means more than ticked
For special category data the tick box has to be its own, tied to that specific processing, and worded so the participant can see exactly what they are agreeing to. A single blanket tick covering the whole survey does not meet the standard. The ICO makes the same point about the strength of the statement: explicit consent must be affirmed in a clear statement, whether spoken or written.
Sensitive is not the same as special category
Plenty of questions feel sensitive without falling under the special category rules. Salary, debt and family circumstances are ordinary personal data in law, even though people are reluctant to answer them. That does not make them harmless: the risk to your participants is real, so keep the answers separated from any identifier and think about who in your organisation will see them.
Which lawful basis lets you ask at all?
Every piece of processing needs one of the six lawful bases in Article 6 of the UK GDPR. Consent is one of them, and despite the assumption it is not automatically the right one. Which basis fits depends on who is asking and what relationship they have with the people answering.
A club surveying its members sits differently from a university evaluating a module, and both sit differently from an employer surveying staff. Get this decision right before you write the privacy notice, because the notice has to state the basis you chose.
| Lawful basis | When it works | The catch |
|---|---|---|
| Consent, Article 6(1)(a) | voluntary participation, no power imbalance | withdrawable at any time, must be recorded |
| Legitimate interests, Article 6(1)(f) | your own customer survey, no sensitive data | document the balancing test, right to object |
| Public task, Article 6(1)(e) | research at a public university | depends on the underlying statutory function |
The ICO gives an example that maps directly onto surveys. An individual submits an online survey about their eating habits; by submitting the form they are clearly indicating consent to process their data for the purposes of the survey itself. But submitting the form will not, by itself, be enough to show valid consent for any further use of that information. If you later want to reuse the answers for something else, you need to have asked for that separately.
One more point matters for staff and student surveys. Consent requires a genuine, free choice, and where there is a clear imbalance of power that choice rarely exists. If you are surveying in that kind of relationship, the cleanest answer is to build the survey so that no personal data is collected at all. Your university, employer or the ICO has the final word on your particular case; this article is not legal advice.
Create a survey for free
With empirio.ai you can create a modern online survey in minutes — with hosting in the EU.
- AI-built survey
- Adjust by drag & drop
- Real-time analysis
Asking for consent: the checklist
Valid consent is freely given, specific, informed and unambiguous, given by a statement or a clear affirmative action. It belongs at the start of the survey, before the first substantive question. How you collect it is left open, and that is where most home-made forms go wrong.
The ICO guidance is blunt about the failure modes: you cannot rely on silence, inactivity, pre-ticked boxes, opt-out boxes, default settings or a blanket acceptance of your terms and conditions. Opt-out boxes are not banned by name, but the ICO treats them as essentially the same as pre-ticked boxes, which are.
What the consent request must contain
The following is the minimum. It fits into five sentences and has to be written in plain language.
- Who is running the survey, with a name and contact.
- What the data will be used for.
- What kinds of data you collect.
- That taking part is voluntary.
- That consent can be withdrawn at any time.
- Whether data leaves the United Kingdom.
There is no requirement for a signature or a written form. A clear affirmative action is enough, and clicking an empty tick box is exactly that. Even explicit consent can be given orally, though the ICO expects you to keep a record of the script. What you do need is proof: record who consented, when, what they were told at the time, how they consented and whether they have since withdrawn.
Withdrawal deserves its own line in your plan. It shall be as easy to withdraw as to give consent, and the ICO recommends making it an easily accessible one-step process. There is no exemption from this for scientific research. If you are running a long-term study, the ICO also suggests considering refreshing consent every two years.
A privacy notice for your survey: template to adapt
The privacy notice meets the transparency requirements in Article 13 and is a different thing from the consent request. Consent is the permission; the notice is the information about what happens. Both usually sit on the same first page of the survey, and both are allowed to be short.
The template below covers the mandatory points for a straightforward survey with no special category data. Replace the square brackets and keep the rest.
This survey is run by [name, email address]. We collect [fields] in order to study [purpose]. Our lawful basis is your consent under Article 6(1)(a) of the UK GDPR. Taking part is voluntary and you can stop at any time. You can withdraw your consent at any time with effect for the future by emailing [address]. Answers are kept until [date] and then deleted; they are not shared with third parties. You have the right to access, rectify, erase and restrict processing of your data, and you can complain to the Information Commissioner’s Office.
Two details are worth getting right. The retention period has to be a real date or a criterion someone could apply, because “as long as necessary” does not tell anyone anything. And if your survey tool processes data outside the United Kingdom, say which country and on what basis.
💡 Tip
Tie the retention date to the end of your project, not the end of term. “Until the examination process concludes, and no later than 31 March 2027” is a date you can still honour if your submission slips by a few weeks.
Anonymous, pseudonymised or still personal?
A genuinely anonymous survey falls outside the UK GDPR altogether, because there are no personal data to protect. Nobody can be identified from the answers, directly or indirectly, so there is no lawful basis to find and no retention schedule to keep.
The difficulty is in the word “genuinely”. You have to account for all the means reasonably likely to be used to identify someone, including the ones you hold yourself. A survey with no name field that quietly logs IP addresses and asks for department fails that test.
Pseudonymisation sits in between and is regularly mistaken for anonymity. With a pseudonym the link back to a person still exists, it just needs extra information such as a code list. Pseudonymised data therefore remains personal data and stays fully within scope. It is a safeguard, not an exit.
For most small surveys real anonymity is still achievable if you do three things together: collect no email address and require no login, switch off IP logging in the tool, and keep demographic questions coarse enough that no cell contains fewer than five people. How that works in practice is set out under anonymous surveys, and which demographic questions you can drop is a judgement of its own.
A survey is only anonymous when you could not restore the link yourself either.
How to spot a UK GDPR compliant survey tool
You cannot tell a compliant survey tool from the promise on its homepage. Five checks will tell you. The moment you use a tool, the provider processes your participants’ data on your instructions, which makes you the controller and leaves the liability with you even when the mistake is theirs.
The first check is the processing contract required by Article 28. It has to be in place before the first response arrives, and it must be in writing, which includes electronic form. With several providers it depends on the plan: Google only offers one for Google Forms through a paid Workspace account, not through a personal account.
| Check | What to look for | Why it matters |
|---|---|---|
| Processing contract | included in the plan and self-serve | Article 28 requires it |
| Where data is processed | processing, not just storage, in the UK or EU | access from abroad is a transfer |
| IP addresses | logging can be switched off or truncated | otherwise answers become identifiable |
| Retention | you can set deletion yourself | storage limitation under Article 5 |
| Sub-processors | list published and kept current | you are liable for the whole chain |
As of August 2026; provider terms change.
Processing location deserves a closer look, because the claims often promise less than they appear to. Some providers guarantee a data region only for data at rest, not for processing or support access. As a rule of thumb: if you handle special category data or survey employees, choose a tool that processes in the UK or the EU and lets you switch off IP logging. For a date poll among friends, any tool will do as long as no personal data is collected.
Which providers meet which of these points is compared in the overview of survey tools.
How to build a compliant survey with empirio.ai
In empirio.ai, an online survey tool from Germany, the privacy page is its own page type rather than a text block you assemble yourself. You add it in the editor and decide where in the survey it sits. The consent tick box comes with it, and the page in the image above is exactly what it produces.
The difference from a home-made version is that the text and the tick box belong together. If you rebuild the notice as an ordinary text question, you have to ask for the consent separately and make it mandatory separately, and that is where the gaps appear.
Four steps and the data protection part of your survey is done.
- Add the privacy page. Pick it as its own page type in the editor and move it to the front.
- Adapt the text. Paste the template from the chapter above and replace the square brackets.
- Label the tick box. The wording next to the box is yours, for example “I have read the information and I consent”.
- Make it required. Without the tick nobody proceeds, and the consent is stored alongside the response.
⚠️ Watch out
You choose where the privacy page sits, and that is exactly where people trip up. Put it before every other question. Consent collected after the third question arrives too late, because by then you have already processed the answers. The lawful basis has to exist before the processing, not after it.
For multilingual surveys the tick box wording can be stored per language as well. Consent someone confirms in English while answering the questionnaire in French is not informed consent in any meaningful sense.
Taken together this covers the five checks from the chapter before: a processing contract, processing inside the EU, a privacy page with consent, optional extra data you can switch off, and an export you can delete from. What it does not do is make the decision that comes first: whether you have a lawful basis at all, and whether your questions touch special category data. No tool can check that for you.
Common data protection mistakes in surveys
The four mistakes below turn up again and again in surveys run by clubs, students and small teams. All four can be fixed before you send the link.
What they have in common is that they do not come from carelessness but from an assumption that sounds perfectly reasonable. That is exactly why they survive a proofread.
Anonymity is promised but never delivered
“The survey is of course anonymous” sits in the invitation while the tool logs IP addresses and the form asks for department, age and gender. The promise is untrue, and in a small group it is also demonstrably untrue. Check the settings in the tool before you use the word anonymous.
More is collected than will ever be analysed
Data minimisation under Article 5 requires you to limit yourself to what is necessary. Asking for a full date of birth when you will report in age bands is the opposite of that. Cut every field for which you cannot name the analysis you plan to run.
The retention period is missing or vague
“Data is kept as long as necessary” does not satisfy Article 13. What is required is the period, or where that is not possible, the criteria used to determine it. A date is the simplest answer, and it forces you to actually delete afterwards.
Reuse is assumed rather than asked for
You run a survey for one project and a year later the answers look useful for another. The ICO example above settles this: submitting the form shows consent for that survey, not for further uses. If reuse is plausible, ask for it separately at the time, or plan to anonymise the data instead.
Sources and further reading
The legal statements in this article rest on the regulation itself and on the guidance published by the Information Commissioner’s Office. Both are freely available.
- Information Commissioner’s Office: What is valid consent?, as of 4 August 2026.
- Information Commissioner’s Office: How should we obtain, record and manage consent?, as of 4 August 2026.
- Data Protection Act 2018, 2018 chapter 12, on legislation.gov.uk.
- The UK GDPR, in particular Articles 5, 6, 7, 9, 13 and 28.
One caveat worth knowing. The ICO notes on both consent pages that this guidance is under review following changes made by the Data (Use and Access) Act and may change. If you are setting up a long-running programme of surveys, check the pages again rather than relying on a copy of them.
Conclusion
Data protection in surveys looks bigger than it is. Settle the lawful basis first, ask only for what you will analyse, put a readable notice at the front and use a tool you have a processing contract with, and the great majority of it is done. The safest route remains the one where no personal data is collected at all.
Where to go next
- Want to improve the survey itself? 8 tips for a successful online survey
- Need real anonymity? Creating an anonymous survey
- Writing a dissertation? Surveys for a bachelor’s or master’s dissertation
Ready to launch without patching the data protection afterwards?
empirio.ai, an online survey tool from Germany, processes responses in the EU and provides the processing contract.