Google Forms and UK GDPR: What Actually Applies

“Is Google Forms GDPR compliant?” is the most asked and worst answered question about the tool. The usual replies are either “absolutely not, the data sits in the US” or “it is only a survey”. Both fall short, and both miss that a UK organisation answers to the UK GDPR rather than the EU version.

Google Forms can be used compliantly if you run it on a paid Google Workspace account, because that is the only place a processing contract exists, if you have a lawful basis, if the form tells people who is collecting, why, for how long and how to withdraw, and if you only ask for what your analysis genuinely needs. For this article we read Google’s contract terms, its edition comparison and the ICO guidance in August 2026.

📌 Key takeaways

• A processing contract only comes with paid Google Workspace.
• Opening the form already processes technical connection data.
• The Europe data region is missing from Business Starter and free accounts.
• For Google Forms it covers stored data, not logs.
• The UK-US data bridge applies, but the ICO calls it partial.

First question: are you a controller at all?

Before Google comes into it, you do. The UK GDPR does not apply to every survey, and anyone who is not a controller needs no lawful basis, no contract and no privacy notice.

The line does not run between harmless and sensitive questions. It runs between a purely personal activity and everything else, and that distinction decides the rest of this article.

The household exemption for purely private surveys

Article 2(2)(a) UK GDPR says the Regulation does not apply to processing by an individual in the course of a purely personal or household activity. Asking your family which date suits them, or running a poll among friends, falls under it. Anyone surveying only in that setting can stop reading here.

Where the household exemption ends

The exemption is read narrowly. It stops applying once a commercial purpose comes in, even a mixed one, once a legal person stands behind the survey, whether a company, a charity, a school or a public body, and once a publicly posted link reaches an unlimited number of people. That last point catches more people than they expect: sharing a dissertation survey in open Facebook groups is no longer a purely household activity. For academic work, university requirements usually apply on top.

Why technical data alone is enough

The most common mistake sounds like this: “I am not asking anything personal, so the survey is not a data protection issue.” That conclusion does not hold.

The moment someone opens a Google form, Google processes technical connection data: IP address, date and time, the page requested, browser and device information. IP addresses count as personal data where the processing party has means reasonably likely to be used to identify the person. For Google as the operator that is normally the case.

Processing of personal data is therefore under way regardless of what your questionnaire asks. And that is what decides whether a lawful basis and a contract with Google are needed at all. The answer is yes, from the first response onwards.

Two clarifications, so this is not misread:

• Google Forms never shows you IP addresses as the form owner, not even in the export.
• A survey can still be anonymous from your point of view, the two are not mutually exclusive. How to do that is covered in creating an anonymous survey.

The processing contract is the real sticking point

When Google processes personal data on your behalf, Google is the processor and you are the controller. Article 28 UK GDPR requires a contract for that relationship, and Article 28(9) requires it in writing, including in electronic form.

Google covers this in the Cloud Data Processing Addendum. According to Google’s own contract terms the addendum applies to Google Workspace, Cloud Identity and Google Cloud. It does not apply to private, free Google accounts. For Google Workspace Individual, Google undertakes to enter into it where the service is used professionally or commercially.

So anyone running work surveys from a personal Gmail account has a gap that no amount of careful privacy wording will close. That is where it fails in practice, and it is the point most guides leave out entirely.

⚠️ Warning

Running Google Forms for work purposes on a free Google account leaves you without a processing contract. That formal requirement cannot be fixed retrospectively. The way out is a paid Workspace account, or a tool that offers the contract on its free tier too.

Server location: less of a blocker than its reputation

The standard argument against Google runs like this: the data sits in the US, so it is not allowed. Since 2023 the position is more complicated, in both directions.

Transfers from the UK to the US rest on the Data Protection (Adequacy) (United States of America) Regulations 2023, in force since 12 October 2023 and commonly called the UK-US data bridge. They cover recipients listed as participants in the UK Extension to the EU-U.S. Data Privacy Framework. Google states that Google LLC is certified under the UK Extension. The ICO describes the arrangement as a partial adequacy finding and expects exporters to check the recipient’s active status periodically.

Why the basis is less settled than it sounds

The framework rests in large part on the independence of US oversight bodies. On 29 June 2026 the US Supreme Court held in Trump v. Slaughter that removal protection for FTC commissioners is unconstitutional, overruling Humphrey’s Executor. In the EU, the European Data Protection Board asked the Commission on 31 July 2026 to review the effect on its adequacy decision. We found no equivalent statement from the ICO or the Department for Science, Innovation and Technology, and the adequacy regulations are unchanged.

What that means for you: server location is not a blocker in August 2026, because the regulations still stand. It is a risk worth knowing about. Anyone setting up a survey meant to run for years should not build on it.

The Europe data region and what it actually covers

Many people treat the data region as the answer: set it to Europe and the data stays here. Two limitations break that calculation.

The first is about your edition, the second about the service. Together they mean the data region does considerably less for Google Forms than the name suggests.

Data regions are not in every edition

The data regions feature is tied to specific Google Workspace editions. Which ones is set out in Google’s admin help and changes from time to time.

Source: Google Workspace admin help, as of 29 July 2026, subject to change.

For Google Forms the data region covers only half

Google separates data at rest from data in processing. For services such as Gmail, Drive or Docs the data region covers both. For Google Forms only the at rest column is ticked in Google’s own overview, meaning text, embedded images, responses and response drafts. Processing itself is not covered. The same source excludes logs and cached content across the board, which is exactly where the technical connection data sits (as of 24 March 2026).

The data region is therefore a sensible building block, not a guarantee that no data leaves Europe. Anyone who needs that guarantee needs a European provider.

What you actually have to do

Assume you are staying with Google Forms and using it for work. The contract comes first and the retention schedule last, and between them sit five steps that take about an hour.

The order is deliberate: without the first point, the other six achieve nothing.

1. Use paid Google Workspace. That is the only place the processing contract exists. Everything else builds on it.
2. Settle your lawful basis. For voluntary surveys that is usually consent under Article 6(1)(a) UK GDPR: freely given, informed and capable of being withdrawn.
3. Put a privacy notice in the form description. Who is collecting, with contact details, why, how long the data is kept, that taking part is voluntary and how consent can be withdrawn. Add a link to your full privacy policy.
4. Check data minimisation. For every question: do I genuinely need this for the analysis? What you never collect, you never have to protect.
5. Get consent if you embed the form. An embedded Google form is not strictly necessary for your site to work, so under PECR it should only load after active agreement.
6. Update your record of processing activities. Easily forgotten, still required.
7. Set a retention schedule. When do the responses get deleted? The linked Google Sheet is a second copy and has to be deleted separately.

A general template for survey privacy notices and more background sits in our guide to data protection and GDPR in surveys.

Three special cases that come up often

In three situations the checklist above is not enough, because extra requirements apply that have nothing to do with Google.

What they share is that the voluntary nature of consent becomes questionable, or a third party has a say. Miss that and you can do everything formally right and still have a problem.

Surveys in schools and classrooms

Children need extra protection, and in the UK a child can consent to an information society service from the age of 13 under Article 8 UK GDPR. Below that, consent comes from a person with parental responsibility. The ICO’s Children’s code applies to services likely to be accessed by children, not only to services aimed at them. In June 2026 the ICO published findings from audits of 28 edtech providers and reported that almost 70 percent were controllers for some uses of children’s data without having recognised it, and that many had no data protection impact assessment where one was required. Reliable guidance for a specific school comes from its data protection officer.

Employee surveys

The sticking point is not the server location but the imbalance of power: consent in an employment relationship counts as freely given only to a limited degree. In practice there is a second problem. If staff do not trust the anonymity, you do not get honest answers. More on the methodological side sits in our guide to employee surveys.

Academic research

For dissertations and theses the university rules usually apply, and many require collection on European servers. On top of that, your methodology section has to explain how anonymity and data protection were ensured. “I used Google Forms” is not a good answer in a viva.

The alternative: do not transfer at all

The simplest way to avoid all of these questions is a provider where they do not arise. If the data never leaves Europe, you need neither a transfer mechanism nor a debate about data regions, and European providers usually offer a processing contract on free tiers as well.

With empirio.ai, an online survey tool from Germany, you build surveys about as easily as with Google Forms while the data stays entirely in the EU. Other options and their respective strengths are compared in our overview of Google Forms alternatives.

None of this makes Google Forms forbidden. For a short anonymous survey with no personal questions, run from a Workspace account and with a proper privacy notice, Google Forms is a defensible tool. Just not for everything.

Conclusion

The data protection question around Google Forms is decided by the account rather than the server location: without paid Google Workspace there is no processing contract, and that gap cannot be worked around. For short anonymous feedback from a Workspace account, Google Forms is defensible. For employee surveys, school settings and health data we would choose a provider whose data never leaves Europe.

This article reflects our research as of August 2026 and is not legal advice. For sensitive collections, speak to your data protection officer or a solicitor.

What to read next

• Building the survey right now? Google Forms: experiences, costs, pros and cons
• Want it genuinely anonymous? Creating an anonymous survey
• Looking for the general framework? Data protection and GDPR in surveys
• Thinking about switching? Google Forms alternatives compared

Start a survey without the contract question?

With empirio.ai the data stays in the EU and the processing contract is part of using the service, on the free tier too. Try it for free