GDPR applies to any survey that collects personal data from individuals in the European Union, regardless of where the researcher or organisation is based. For academic and research teams, this means that a survey conducted from a US university that includes EU student or participant data falls within GDPR scope. This guide covers the practical design requirements that affect how surveys are structured, what data they collect, and which platforms are appropriate.
Establishing a Lawful Basis for Data Collection
GDPR requires a lawful basis for processing personal data. For research surveys, the most commonly applicable bases are:
- Consent — the participant explicitly agrees to their data being collected and processed for the stated purpose. This is the most common basis for voluntary research surveys and requires that consent be freely given, specific, informed, and unambiguous.
- Legitimate interests — the data collection is necessary for a legitimate interest and does not override the individual's rights. This is less commonly applicable to survey research.
- Public task — relevant for publicly funded academic research, where the processing is necessary for the performance of a task carried out in the public interest.
The lawful basis must be identified before data collection begins and documented in your data protection impact assessment where one is required. See the IRB compliant survey design guide for how consent requirements under GDPR relate to IRB approval processes.
Data Minimisation in Survey Design
GDPR Article 5 requires that personal data be "adequate, relevant and limited to what is necessary" for the stated purpose. In survey design, this means every question must be justifiable in terms of your research objectives. Questions that collect data you do not need for your stated analysis create GDPR risk.
Practical data minimisation steps:
- Remove demographic questions that are not required for your analysis
- Avoid collecting names or contact information unless the research design requires it
- Use age ranges rather than exact dates of birth unless specific ages are analytically required
- Review every open-text question for whether the response could identify a participant
The AI Survey Advisor reviews survey instruments for methodology issues including overly specific demographic questions and open-text fields that may inadvertently collect identifying information.
Consent Language Under GDPR
GDPR consent requirements go beyond standard research consent. The consent statement must specify exactly what data is being collected, how it will be processed, who will have access to it, how long it will be retained, and the participant's right to withdraw consent and request erasure.
A GDPR-compliant survey consent section should include:
- Identification of the data controller (researcher or institution)
- Legal basis for processing
- Specific description of data collected
- Retention period
- Right to withdraw consent at any time
- Right to request erasure of data
- Contact details for data protection queries (and DPO if applicable)
- Link to the full privacy notice
Platform Considerations for GDPR Compliance
| Platform | Data Residency | GDPR Suitability |
|---|---|---|
| Qualtrics (EU region) | EU servers available | Suitable with EU data centre selected |
| REDCap (institutional) | Institutional servers | Suitable when hosted within EU institution |
| Google Forms (Workspace) | EU region available with Workspace agreement | Suitable with appropriate data processing agreement |
| SurveyMonkey (EU) | EU data processing available | Requires GDPR-specific plan configuration |
Your institution's data protection officer can advise on which platforms have approved data processing agreements in place. Using a platform without a valid data processing agreement for EU data is a GDPR compliance risk regardless of how well the survey instrument itself is designed.
Right to Erasure and Survey Data
GDPR gives individuals the right to request deletion of their personal data. For survey research, this means your data handling procedures must support identifying and deleting an individual's response if they request it. Fully anonymised data — where no individual can be identified — is not subject to erasure requests. Data that is pseudonymised but could be re-identified is still subject to GDPR and erasure rights.
Design your data handling procedures so that a participant's survey response can be identified and deleted if requested, or document clearly why full anonymisation means erasure requests do not apply to your dataset.
GDPR and IRB compliance together
GDPR compliance and IRB approval address overlapping but distinct concerns. IRB approval covers the ethical treatment of human subjects. GDPR covers the legal requirements for processing personal data. A survey can have IRB approval and still be non-compliant with GDPR if the data processing arrangements are not in order. Both must be addressed before data collection begins from EU participants.
Frequently Asked Questions
Yes, if the survey collects personal data from individuals in the European Union. This applies regardless of where the researcher or institution is based. A US university collecting data from EU students or participants must comply with GDPR for that data.
IRB consent covers the ethical treatment of human subjects and is a research governance requirement. GDPR consent is a legal basis for processing personal data under EU law. A survey can have IRB approval and still be GDPR non-compliant if the data processing arrangements are not in order. Both must be addressed separately before collecting data from EU participants.
Google Forms can be used for GDPR-compliant research if your organisation has a Google Workspace agreement that includes a data processing agreement with Google and EU data residency is configured. Without these arrangements, the default Google Forms settings do not meet GDPR requirements for research data.
Questions that collect unnecessary personal data create GDPR risk under the data minimisation principle. This includes collecting exact dates of birth when age ranges would suffice, collecting names or email addresses for anonymous studies, and open-text questions that could result in participants inadvertently sharing identifying information.
Convert Your IRB-Approved Instrument Without Altering a Word
From document to platform-ready survey in minutes. No manual programming required.
Start Converting Free