Is LimeSurvey GDPR compliant? Self-hosted versus LimeSurvey Cloud for universities
LimeSurvey is open-source survey software from LimeSurvey GmbH in Hamburg. Universities either install the free Community Edition on their own servers or use the hosted LimeSurvey Cloud. The two raise different questions. This page sets out what LimeSurvey publicly documents about hosting, contracts, anonymity and AI, and what that means for research surveys.
Short answer
LimeSurvey GmbH is a German company. Its software is open source, so a university can host it entirely on its own infrastructure. LimeSurvey Cloud stores each survey site, including backups, in the country the customer chooses, and LimeSurvey recommends Germany or Finland for GDPR surveys. A GDPR agreement signed by LimeSurvey can be generated from the account. Saving IP addresses and linking answers to participants are survey-level settings. ISO 27001 is described as in progress, and the provider behind the AI features the home page announces as a coming beta was not found. Whether it suits a research survey depends on the hosting option and the survey settings.
Prefer a tool built in the EU? Kahubi, from Avidemic AB in Sweden, covers research surveys with EU hosting and, for institutions, only European subprocessors. See how Kahubi handles research data
Self-hosted or Cloud: two different assessments
With the Community Edition, LimeSurvey says "all your data is stored on your or your provider's server" [3]. LimeSurvey GmbH is then a software supplier, not a processor of your survey data, and the GDPR questions are about your own hosting, patching and access control. With LimeSurvey Cloud, LimeSurvey GmbH hosts the survey site and processes responses on your behalf. The table below covers the Cloud service unless stated otherwise.
What LimeSurvey documents publicly
Everything in this table comes from LimeSurvey's own pages, help centre and manual, read on 7 October 2026. Numbers in brackets refer to the sources at the end of the page.
| Topic | What the vendor states | Source |
|---|---|---|
| Company and establishment | LimeSurvey GmbH, Papenreye 63, 22453 Hamburg, Germany. The privacy notice names an external data protection officer through heyData. For survey participants, LimeSurvey says it processes personal data "exclusively as a Data Processor" on the survey owner's instructions. | [1] |
| Where survey responses are stored | Customer choice Cloud regions: Australia, Canada, Finland, Germany, Singapore, the United Kingdom and the USA. "For surveys under the GDPR, choose Germany or Finland." The survey site "and all its data, including backups, stay in the country you chose". An older FAQ entry recommends the German server as the location where LimeSurvey can "guarantee full EU GDPR compliance". | [2] [3] [4] |
| Data processing agreement | Documented An online contracting tool under "GDPR agreements" in the account profile produces a PDF "already signed by us". Which plans include it is not stated on the FAQ page. | [5] |
| Subprocessors | Not public The privacy notice for LimeSurvey's own website names Hetzner Online GmbH (hosting, Germany), Zoho (CRM and support, including an Indian Zoho entity) and Google Ireland (analytics). A subprocessor list for Cloud survey data, including the data centre used in each region, was not found in public documentation (checked 7 October 2026). | [1] |
| International transfers | For its own website and customer data, the privacy notice relies on EU Standard Contractual Clauses or adequacy decisions. Survey data stays in the chosen region; choosing a non-EU region is itself a transfer decision for the customer. | [1] [2] |
| Encryption and backups | Each Cloud instance has its own database and credentials, and browser connections use SSL. Responses are not encrypted at rest by default, but chosen question types and participant fields can be set to be encrypted. Daily backups are encrypted and kept at the same hosting location. | [6] |
| AI features | Partly documented The home page lists "AI (beta)" as coming soon, under the line "Smarter surveys with AI built-in". The AI provider, processing location and any training use were not found in public documentation (checked 7 October 2026). The privacy notice, dated 26 April 2024, does not mention AI. | [1] [9] |
| Security certifications | In progress The home page states "ISO 27001 is in progress". | [9] |
| Open source | The source code is published on GitHub under the GNU GPL (version 2 or later), and a Community Edition can be self-hosted. | [3] [13] |
LimeSurvey deserves credit for open-source code that a university can inspect and run itself, a German contracting entity, a clear choice of hosting country with EU options and backups kept in the same country, a self-service GDPR agreement signed in advance, and survey settings that make anonymity and IP storage explicit choices. It also documents optional field-level encryption.
Anonymous responses and IP addresses
Two settings matter most for research. Anonymized responses defaults to No. When set to Yes, "there will be no way to connect answers and participants", and submission and completion dates are set to 1 January 1980 so that responses cannot be matched with server logs [7]. Save IP address stores the respondent's IP address "together with his or her answers" when enabled; the related Date stamp, Save timings and Save referrer URL settings also add metadata to each response [8]. The manual pages read did not state their defaults, so check each survey before it goes live.
What this means for research and teaching
Validemic's analysisSelf-hosting moves the work, not the responsibility. A self-hosted installation keeps survey data inside the university, which some ethics boards prefer. It also means your IT department carries patching, backups, encryption and access logging. A self-hosted installation that falls behind on updates is a risk of its own.
For Cloud, the region choice is the key decision. LimeSurvey offers non-EU regions, and it recommends Germany or Finland for GDPR surveys. Make the region part of your approval and check it on existing survey sites, because the country is chosen for each survey site [2].
Personal accounts are the common problem. A student or researcher who opens a Cloud account individually signs the GDPR agreement personally, outside the university's procurement. For research data, the institution normally needs to be the controller with a processor agreement under Article 28 GDPR [10]. Ask your DPO whether your university runs its own LimeSurvey server.
Survey content decides the risk level. Questions about health, sexual orientation, religion, political opinions or trade union membership collect special category data under Article 9(1) GDPR [10]. Data is only anonymous if individuals cannot be identified by any means reasonably likely to be used (Recital 26) [10], so combine anonymised responses with IP saving switched off and careful question design before promising anonymity.
DPIA likelihood. Large surveys on special category topics, or surveys of children or other vulnerable groups, will often meet the criteria for a data protection impact assessment under Article 35 GDPR [10]. Our DPIA screening tool gives a first view.
Reviewing a vendor right now? Validemic checks the vendor's documents against GDPR and the EU AI Act and cites every finding. Try the demo workspace
Questions to ask LimeSurvey before approving Cloud
- Which data centre provider hosts each EU region, and who are the subprocessors for survey data?
- Which AI provider will power the AI (beta) features, where is data processed, and can the features be disabled for all our survey sites?
- Is any survey content or response data used to train AI models?
- When is ISO 27001 certification expected, and what security evidence is available now?
- Can the GDPR agreement be concluded by the university for all staff and student accounts?
- What are the default values of Save IP address and Anonymized responses on new surveys?
- How long are backups kept after a survey or site is deleted?
The EU AI Act angle
The EU AI Act, Regulation (EU) 2024/1689, applies alongside the GDPR [11]. For a survey tool the points are brief. AI literacy under Article 4 has applied since 2 February 2025; the Digital Omnibus on AI, Regulation (EU) 2026/1744, reworded it in July 2026 as a duty to take measures to support staff AI literacy [11] [12]. Running research surveys is not one of the high-risk education uses in Annex III [11]. If LimeSurvey's AI features generate or analyse survey content, staff should know what the feature does and where data goes, which is part of the AI literacy measures an institution takes.
Sources
- Privacy Notice | LimeSurvey, updated 26 April 2024, retrieved 7 October 2026
- Where and how is my survey data hosted/stored? | LimeSurvey Help, retrieved 7 October 2026
- Where and how is my survey data hosted/stored? | LimeSurvey FAQ, retrieved 7 October 2026
- Is your LimeSurvey Cloud service compatible with the GDPR? | LimeSurvey FAQ, retrieved 7 October 2026
- GDPR contract agreement | LimeSurvey FAQ, retrieved 7 October 2026
- Is my survey data in LimeSurvey Cloud encrypted? | LimeSurvey FAQ, retrieved 7 October 2026
- Participant settings | LimeSurvey Manual, retrieved 7 October 2026
- Notifications & data | LimeSurvey Manual, retrieved 7 October 2026
- LimeSurvey home page, hosting, open source, AI and ISO 27001 statements, retrieved 7 October 2026
- Regulation (EU) 2016/679 (General Data Protection Regulation), Recital 26 and Articles 9, 28 and 35, retrieved 7 October 2026
- Regulation (EU) 2024/1689 (Artificial Intelligence Act), Article 4 and Annex III, retrieved 7 October 2026
- Regulation (EU) 2026/1744 (Digital Omnibus on AI), retrieved 7 October 2026
- LimeSurvey source code and licence | GitHub, retrieved 7 October 2026
About this page
We read LimeSurvey's privacy notice, help centre and FAQ entries on data protection, the LimeSurvey Manual and the LimeSurvey home page on 7 October 2026. LimeSurvey GmbH is an EU company with EU hosting options, so the EU-U.S. Data Privacy Framework is not relevant to the EU regions. "Not found" means we could not find the information in public documentation; it does not mean the vendor lacks it.
This page describes public documentation and gives our own analysis. It is not legal advice and it is not a statement that the tool is or is not GDPR compliant, which depends on your contract, configuration and use. If you work for LimeSurvey and see an error, please contact us and we will correct it.
Frequently asked questions
Can I use LimeSurvey for research surveys under GDPR?
LimeSurvey can be run on your university's own servers, in which case no survey data goes to LimeSurvey GmbH at all, or used as LimeSurvey Cloud, where LimeSurvey GmbH in Hamburg acts as processor and offers a signed GDPR agreement. For Cloud, LimeSurvey recommends choosing a server in Germany or Finland for surveys under the GDPR. Check with your DPO which option your institution supports.
Where does LimeSurvey Cloud store survey data?
In the country you choose when creating the survey site: Australia, Canada, Finland, Germany, Singapore, the United Kingdom or the USA. LimeSurvey says data, including backups, stays in that country, and recommends Germany or Finland for surveys under the GDPR.
Does LimeSurvey store IP addresses?
Only if the survey owner enables the Save IP address setting, in which case the respondent's IP address is stored with the answers. The Anonymized responses setting, which defaults to No, removes the link between answers and participants and sets response dates to 1 January 1980.
Does LimeSurvey sign a data processing agreement?
For LimeSurvey Cloud, yes. LimeSurvey offers an online contracting tool under GDPR agreements in the account profile, and the resulting PDF is already signed by LimeSurvey. For a self-hosted Community Edition, LimeSurvey GmbH does not process your survey data, so the relevant agreements are with your own hosting provider, if any.
Is the self-hosted LimeSurvey free?
The Community Edition is open source under the GPL and can be installed on your own servers. Your institution then becomes responsible for security, updates, backups and access control.