GDPR check

Is Google Forms GDPR compliant? What researchers and universities should check

Google Forms is free, familiar and often already part of a university's Google Workspace. The answer to the GDPR question depends heavily on which account a form is created in. This page sets out what Google documents for consumer accounts and for Google Workspace for Education, and what that means for research surveys.

Published 7 October 2026 · Sources checked 7 October 2026

Short answer

There are two different situations. In Google Workspace for Education, Google Forms is a Core Service covered by the Cloud Data Processing Addendum, with ISO 27001, 27017, 27018 and 27701 certifications that name Forms in scope, no advertising use of Core Service data, and EU data regions on the Education Standard and Plus editions. In a personal Google account, Google Ireland is the controller under consumer terms and we found no processor agreement. For research data, which account the form lives in matters more than the tool itself.

Prefer a tool built in the EU? Kahubi, from Avidemic AB in Sweden, covers research surveys with EU hosting and, for institutions, only European subprocessors. See how Kahubi handles research data

What Google documents publicly

Everything in this table comes from Google's own pages and the official Data Privacy Framework list, read on 7 October 2026. Numbers in brackets refer to the sources at the end of the page.

Topic	What the vendor states	Source
Company and establishment	Plan-dependent Workspace: the contracting entity for customers billed in EMEA (except France, Italy and Poland, which have local entities) is Google Cloud EMEA Limited, Ireland. Consumer accounts: Google Ireland Limited is the provider and the data controller for users in the EEA and Switzerland.	[1] [2] [3]
Where responses are stored	Plan-dependent Data regions (United States, European Union or no preference) are supported on Education Standard and Education Plus, among other paid editions; Education Fundamentals is not in the list of supported editions. For Google Forms, data regions cover "text, embedded images, responses, and draft responses" at rest but not during processing. A linked Google Sheet and uploaded files in Drive are covered at rest and during processing. Consumer accounts: no storage location commitment found.	[4] [5]
Data processing agreement	Documented Workspace and Workspace for Education: the Cloud Data Processing Addendum, incorporated into the Education terms. Google Forms is listed among the Main Core Services. Consumer accounts: no processor agreement found; Forms falls under the general Google Terms of Service.	[6] [7] [8] [2]
Subprocessors	Public Workspace subprocessor list naming Google affiliates in several countries and third-party providers used for technical support and security, with locations including India, the US, Canada and Romania. No separate list for Education.	[9]
International transfers	Documented The DPA relies on adequacy, an alternative transfer solution where adopted, or the SCCs. Google LLC is an active participant in the EU-U.S. DPF, the UK Extension and the Swiss-U.S. DPF, per the official list and Google's own statement.	[6] [10] [11]
AI training on customer content	Plan-dependent Workspace: content "is not human reviewed or otherwise used for Generative AI model training outside your domain without permission". Consumer: the privacy policy says Google uses "your interactions with AI models and technologies like Gemini Apps to develop, train, fine-tune, and improve these models". A statement specific to consumer Forms content was not found in public documentation (checked 7 October 2026).	[3] [12]
Retention and deletion	Responses can be held in the form, a linked Google Sheet, or both; these are separate files, and deleting responses in the form does not delete attached files or the Sheet. Workspace DPA: customer-deleted data is removed within a maximum of 180 days.	[6] [13] [14]
Security certifications	Documented Google Forms is named in scope for Google's ISO/IEC 27001, 27017, 27018 and 27701 certifications and SOC 2 report. These cover Workspace, not consumer accounts.	[15] [16] [17] [18] [19]
Institution controls	Documented Admins can turn Forms on or off by organisational unit or group, and control whether forms in the domain accept outside responses. By default, forms are restricted to people in the organisation and respondents must sign in. Education Core Services show no ads and personal information in them is not used for advertising.	[20] [21] [22] [23]

Google deserves credit for the depth of its Workspace documentation: a public subprocessor list, a DPA that covers Education, certifications that name Forms explicitly, a published table showing exactly which Forms data is covered by data regions, and admin settings that let an institution keep forms inside the organisation by default.

What this means for research and teaching

Validemic's analysis

The account decides the legal position. A form created in a personal Gmail account sits under Google's consumer terms, with Google Ireland as controller [3]. The university then has no processor agreement for the research data. A form created in the university's Workspace for Education account is covered by the institution's DPA [6] [7]. For research, ask researchers and students to use their institutional account only.

Survey content decides the risk level. Questions about health, sexual orientation, religion, political opinions or trade union membership collect special category data under Article 9(1) GDPR [24]. Google Forms is easy to share widely, so a survey can reach large numbers of people quickly.

EU storage depends on the edition. Data regions are not listed for Education Fundamentals [4]. Where they are available, Forms responses are covered at rest but not during processing, while the linked Sheet is covered in both [5]. If EU storage is a requirement for a study, confirm the edition and the data region policy with your Workspace administrators.

Anonymity and sign-in. The default restriction to organisation members with sign-in is good for internal surveys but works against anonymity. Verified email collection records the respondent's Google account email [14]. For an anonymous research survey, switch off email collection, decide whether to allow outside respondents, and avoid identifying questions. Data is only anonymous under the GDPR if individuals cannot be identified by any means reasonably likely to be used (Recital 26) [24].

Gemini features. Gemini can help create forms and summarise responses on eligible plans [25] [26]. In Workspace, Gemini prompts and responses are customer data covered by the privacy hub commitments [12]. Check whether your institution has enabled Gemini and whether ethics applications should mention AI-assisted analysis.

DPIA likelihood. Large surveys on special category topics or of vulnerable groups will often meet the criteria for a data protection impact assessment under Article 35 GDPR [24]. Ask your DPO whether your institution already has an assessment for Workspace before starting a new one. Our DPIA screening tool gives a first view.

Reviewing a vendor right now? Validemic checks the vendor's documents against GDPR and the EU AI Act and cites every finding. Try the demo workspace

Questions to ask before approving Google Forms for research

For Google Forms the questions are mostly for your own Workspace administrators and DPO, with some for Google.

Which Workspace for Education edition do we have, and is a data region policy set to the EU for research users?
Is Google Forms switched on for students and researchers, and are personal-account forms prohibited for research data in our guidance?
Are forms allowed to accept responses from outside the domain, and who decides?
Has our institution enabled Gemini in Forms, and is it covered by our DPIA?
What retention rules apply to forms and linked Sheets after a project ends, and who deletes them?
Can we obtain the current ISO 27701 certificate and SOC 2 report through Google's Compliance Reports Manager?
Which subprocessors could access Forms data for support, and how are we notified of changes?
Has our institution recorded Google's transfer mechanisms in its records of processing?

The EU AI Act angle

The EU AI Act, Regulation (EU) 2024/1689, applies alongside the GDPR [27]. For a form tool the points are brief. AI literacy under Article 4 has applied since 2 February 2025; the Digital Omnibus on AI, Regulation (EU) 2026/1744, reworded it in July 2026 as a duty to take measures to support staff AI literacy [27] [28]. Creating forms with Gemini or summarising responses is not one of the high-risk education uses in Annex III, which include evaluating learning outcomes [27]. A university that uses Forms with AI to grade quizzes should check that line more carefully. We found no emotion recognition feature in Google Forms.

Sources

Google Contracting Entity | Google Cloud, retrieved 7 October 2026
Google Terms of Service (Ireland version), retrieved 7 October 2026
Google Privacy Policy (Ireland version), retrieved 7 October 2026
Choose a geographic location for your data, Google Workspace Admin Help, retrieved 7 October 2026
Data covered by data regions, Google Workspace Admin Help, retrieved 7 October 2026
Cloud Data Processing Addendum (Customers) | Google Cloud, retrieved 7 October 2026
Google Workspace for Education Terms of Service, retrieved 7 October 2026
Google Workspace Services Summary, retrieved 7 October 2026
Google Workspace subprocessors, retrieved 7 October 2026
Data transfer frameworks, Google Privacy & Terms, retrieved 7 October 2026
Data Privacy Framework List, entry for Google LLC, retrieved 7 October 2026
Generative AI in Google Workspace Privacy Hub, retrieved 7 October 2026
Choose where to save form responses, Google Docs Editors Help, retrieved 7 October 2026
View & manage form responses, Google Docs Editors Help, retrieved 7 October 2026
ISO/IEC 27001 - Compliance | Google Cloud, retrieved 7 October 2026
ISO/IEC 27017 - Compliance | Google Cloud, retrieved 7 October 2026
ISO/IEC 27018 Certified Compliant | Google Cloud, retrieved 7 October 2026
ISO/IEC 27701 - Compliance | Google Cloud, retrieved 7 October 2026
SOC 2: compliance | Google Cloud, retrieved 7 October 2026
Turn Forms on or off for users, Google Workspace Admin Help, retrieved 7 October 2026
Adding new admin settings to control Google Form responses, Google Workspace Updates, 17 June 2025, retrieved 7 October 2026
Create your first form in Google Forms, Google Workspace Learning Center, retrieved 7 October 2026
Google Workspace for Education Privacy Notice, retrieved 7 October 2026
Regulation (EU) 2016/679 (General Data Protection Regulation), Recital 26 and Articles 9 and 35, retrieved 7 October 2026
Use Gemini in Google Forms to quickly create a new form, Google Workspace Updates, 11 June 2025, retrieved 7 October 2026
Summarize & analyze responses with Gemini in Google Forms, Google Docs Editors Help, retrieved 7 October 2026
Regulation (EU) 2024/1689 (Artificial Intelligence Act), Articles 4, 113 and Annex III, retrieved 7 October 2026
Regulation (EU) 2026/1744 (Digital Omnibus on AI), retrieved 7 October 2026

About this page

We read Google's Workspace and consumer terms, privacy notices, the Cloud Data Processing Addendum, data region documentation, compliance pages and help articles on 7 October 2026, and checked the official Data Privacy Framework list on the same day. EUR-Lex was partly unavailable on that date, so the legal texts were read from the Official Journal copies published by the EU Publications Office. "Not found" means we could not find the information in public documentation; it does not mean the vendor lacks it.

This page describes public documentation and gives our own analysis. It is not legal advice and it is not a statement that the tool is or is not GDPR compliant, which depends on your contract, configuration and use. If you work for Google and see an error, please contact us and we will correct it.

Frequently asked questions

Can I use Google Forms for research under GDPR?

If your university has Google Workspace for Education, forms created in your institutional account are covered by the Cloud Data Processing Addendum, and Google Forms is a Core Service. Forms created in a personal Google account fall under Google's consumer terms, where Google Ireland is the controller and there is no processor agreement with your university. Ask your DPO which account and settings to use.

Where does Google Forms store responses?

Workspace data regions, available on Education Standard and Education Plus among other editions, let admins choose the United States, the European Union or no preference. For Google Forms, data regions cover text, embedded images, responses and draft responses at rest, but not during processing. A linked Google Sheet is covered at rest and during processing.

Does Google use Forms responses to train AI?

For Google Workspace, Google's privacy hub says content is not human reviewed or used for generative AI model training outside your domain without permission. For consumer accounts, Google's privacy policy says it uses interactions with AI models such as Gemini Apps to train them. We did not find a specific statement about consumer Forms content and AI training.

Does Google sign a DPA for Google Forms?

For Google Workspace and Workspace for Education customers, yes: the Cloud Data Processing Addendum applies and Google Forms is a Core Service. For personal consumer accounts we found no data processing agreement; those accounts use Google's general terms.

Are Google Forms anonymous?

It depends on the settings. In Workspace, forms are restricted to people in your organisation by default and respondents must sign in. Email collection can be set to Verified or Responder input, or switched off. For anonymous research surveys, check the restriction and email settings before sending.