Is Microsoft Forms GDPR compliant? What researchers and universities should check
Microsoft Forms comes with most Microsoft 365 Education licences, so many universities already have it switched on for every student and member of staff. Whether it suits a research survey depends on the account, the tenant's location and a few admin settings. This page sets out what Microsoft documents and what that means for a university.
Short answer
In a Microsoft 365 Education tenant, Microsoft Forms is covered by the organisation's agreement with Microsoft and the Microsoft Products and Services Data Protection Addendum (DPA). Microsoft states that Forms data for tenants in EU or EFTA countries is stored in its EU/EFTA geography, and that Forms is fully within the EU Data Boundary. Microsoft's Copilot documentation says customer prompts and data are not used to train foundation models. Forms made with a personal Microsoft account sit under consumer terms instead. For research data, the account and a handful of admin settings, especially name recording and external sharing, matter most.
Prefer a tool built in the EU? Kahubi, from Avidemic AB in Sweden, covers research surveys with EU hosting and, for institutions, only European subprocessors. See how Kahubi handles research data
What Microsoft documents publicly
Everything in this table comes from Microsoft's support, Learn and licensing pages, read on 7 October 2026. Numbers in brackets refer to the sources at the end of the page.
| Topic | What the vendor states | Source |
|---|---|---|
| Account types | Plan-dependent Office 365 Education and Microsoft 365 business users should create forms in line with their organisation's terms with Microsoft. Personal account users (Hotmail, Live, Outlook.com) create forms under the Microsoft consumer terms of use. Admin settings exist only for Education and business customers. | [1] [2] |
| Where responses are stored | Documented Tenants whose default geography is an EU or EFTA country: "Macro Region Geography 4 - European Union/EFTA". Other European tenants: Geography 1 Europe. Tenants in most countries outside Europe and Australia: the United States. | [3] |
| EU Data Boundary | Documented For EU Data Boundary services, Microsoft commits to store and process customer data and pseudonymised personal data in the EU and EFTA, subject to documented limited transfers. Microsoft 365 customers with a sign-up location in the EU or EFTA are in scope, unless they have bought Multi-Geo. An April 2024 change log entry says a Forms exception had been listed in error and that Forms is fully compliant with the EU Data Boundary. | [4] [5] |
| Data processing agreement | Documented The Microsoft Products and Services DPA (May 2026 version) governs processing for online services. Microsoft is a processor for customer data and acts as an independent controller for limited "business operations", which it may not use for profiling or advertising. | [6] |
| Subprocessors | Documented The DPA authorises Microsoft affiliates and subprocessors, makes Microsoft responsible for their compliance, and says information about subprocessors is published on a Microsoft website. | [6] |
| International transfers | Documented Transfers out of the EU/EEA, UK and Switzerland are subject to the 2021 Standard Contractual Clauses implemented by Microsoft. The DPA and privacy statement say Microsoft Corporation is certified under the EU-U.S. DPF, the UK Extension and the Swiss-U.S. DPF. The official DPF list API was not responding on the check date, so this relies on Microsoft's statements. | [6] [7] |
| AI features and training | Plan-dependent Copilot in Forms drafts questions and summarises results; Microsoft says it needs a Microsoft 365 account and a Copilot licence. Microsoft says prompts, responses and data accessed through Microsoft Graph are not used to train foundation LLMs. Copilot is an EU Data Boundary service for EU customers, but models provided by Anthropic as a subprocessor are currently excluded from the boundary. | [8] [9] |
| Retention and deletion | Documented Customers can access, export and delete customer data during the subscription. After a subscription ends, data is kept in a limited-function account for 90 days and then deleted within a further 90 days. | [6] |
| Security | Documented Forms data is encrypted at rest and in transit. Microsoft says Forms met GDPR requirements as of May 2018 and points to the Service Trust Portal for compliance reports. | [1] [10] |
| Institution controls | Documented Admins can control four external sharing options (all on by default), the "Record names by default" setting (on by default), internal phishing scanning (on by default), Bing and YouTube content, and can turn Forms off per user or for the whole organisation. | [2] |
Microsoft deserves credit here: a Forms-specific storage table, a published EU Data Boundary programme with a public change log that names Forms, a DPA with a clear deletion timeline, and admin settings that let an institution decide whether forms can leave the organisation at all.
What this means for research and teaching
Validemic's analysis
The account decides the legal position. A form in a personal Outlook.com account falls under consumer terms [1], and the university has no processor agreement covering it. A form in the institutional tenant is covered by the DPA [6]. Research guidance should say that institutional accounts are the only acceptable place for participant data.
Check your tenant, not the brochure. EU storage and the EU Data Boundary depend on the tenant's default geography and sign-up location, and Multi-Geo tenants are outside the boundary commitment [3] [4]. Most universities in the EU will be in scope, but a quick check with the Microsoft 365 administrators is worth doing before a sensitive study.
Names are recorded by default. Inside the organisation, the admin default records respondents' names [2]. That suits course feedback that is not anonymous, but it works against anonymous research surveys. Data is only anonymous under the GDPR when people cannot be identified by means reasonably likely to be used (Recital 26) [11]. If anonymity matters, check who can respond and whether names are recorded for that form, and avoid identifying questions.
External respondents. All four external sharing options are on by default [2]. Many universities leave them on because Forms is used for outreach and events. For research, the question is less whether sharing is allowed and more whether researchers know which setting each form uses.
Copilot and the Anthropic exception. If your institution licenses Copilot, summaries of free-text answers are processed by Microsoft's AI services [8]. Microsoft states that EU traffic stays within the EU Data Boundary, but also that models provided by Anthropic as a subprocessor are currently excluded [9]. Ask whether that exclusion affects any Copilot feature your staff can use on research data.
DPIA likelihood. Surveys about health, sexual orientation, religion or political opinions collect special category data under Article 9 GDPR [11], and large-scale processing of such data is a typical trigger for an Article 35 DPIA [11]. Many universities already hold a DPIA for Microsoft 365; check whether it covers Forms used for research. Our DPIA screening tool gives a first view.
Reviewing a vendor right now? Validemic checks the vendor's documents against GDPR and the EU AI Act and cites every finding. Try the demo workspace
Questions to ask before approving Microsoft Forms for research
For Microsoft Forms the questions are mostly for your own Microsoft 365 administrators and DPO.
- What is our tenant's default geography, and do we have Multi-Geo or Advanced Data Residency?
- Does our institutional guidance forbid research data in personal Microsoft accounts?
- How are the external sharing and "Record names by default" settings configured, and who decided?
- Is Copilot licensed for researchers, and does our assessment cover AI summaries of survey responses, including the Anthropic exclusion from the EU Data Boundary?
- Does our existing Microsoft 365 DPIA cover Forms used for research with special category data?
- When researchers export responses to other files or systems, do the same retention and access rules apply there?
- Who deletes forms and responses when a project ends or a researcher leaves?
- Have we recorded Microsoft's transfer mechanisms in our records of processing?
The EU AI Act angle
Using Copilot to draft a questionnaire or summarise answers is a general productivity use and does not match the education uses listed as high-risk in Annex III, such as evaluating learning outcomes or monitoring students during tests [12]. Forms quizzes that are graded with AI assistance would deserve a closer look. The obligation that applies now is Article 4: deployers must take measures to support the AI literacy of staff using AI systems on their behalf [13]. Emotion recognition in education is prohibited by Article 5(1)(f) [14]; we found no such feature in Microsoft Forms. High-risk obligations for Annex III systems apply from 2 December 2027 under the amended Article 113 [15].
Sources
- Privacy and compliance, Microsoft Forms, Microsoft Support, retrieved 7 October 2026
- Administrator settings for Microsoft Forms, Microsoft Learn (updated 23 March 2026), retrieved 7 October 2026
- Data storage for Microsoft Forms, Microsoft Support, retrieved 7 October 2026
- What is the EU Data Boundary?, Microsoft Learn, retrieved 7 October 2026
- EU Data Boundary change log, Microsoft Learn, entry of 16 April 2024, retrieved 7 October 2026
- Microsoft Products and Services Data Protection Addendum, May 2026 version, retrieved 7 October 2026
- Microsoft Privacy Statement, Data Privacy Framework section, retrieved 7 October 2026
- Welcome to Copilot in Forms, Microsoft Support, retrieved 7 October 2026
- Data, privacy, and security for Microsoft 365 Copilot, Microsoft Learn, retrieved 7 October 2026
- Security and privacy in Microsoft Forms, Microsoft Support, retrieved 7 October 2026
- Regulation (EU) 2016/679 (GDPR), Recital 26 and Articles 9 and 35, text read from the Publications Office copy, retrieved 7 October 2026
- AI Act Annex III, AI Act Service Desk (consolidated text of Regulation (EU) 2024/1689 as amended by Regulation (EU) 2026/1744), retrieved 7 October 2026
- AI Act Article 4: AI literacy, AI Act Service Desk, retrieved 7 October 2026
- AI Act Article 5: Prohibited AI practices, AI Act Service Desk, retrieved 7 October 2026
- AI Act Article 113: Entry into force and application, AI Act Service Desk, retrieved 7 October 2026
About this page
We read Microsoft's Forms support and admin pages, the EU Data Boundary documentation and change log, the Products and Services DPA (May 2026), the Microsoft privacy statement and the Copilot privacy documentation on 7 October 2026. The official Data Privacy Framework list API returned errors on that date, so DPF status relies on Microsoft's own statements. Our own interpretation is labelled as Validemic's analysis. "Not found" means we could not find the information in public documentation; it does not mean the vendor lacks it.
This page describes public documentation and gives our own analysis. It is not legal advice and it is not a statement that the tool is or is not GDPR compliant, which depends on your contract, configuration and use. If you work for Microsoft and see an error, please contact us and we will correct it.
Frequently asked questions
Can I use Microsoft Forms for research under GDPR?
Forms created in your university's Microsoft 365 Education tenant fall under the organisation's agreement with Microsoft, including the Products and Services Data Protection Addendum. Forms created with a personal Microsoft account (Outlook.com, Hotmail, Live) fall under Microsoft's consumer terms instead. Use your institutional account for research and ask your DPO which settings apply.
Where does Microsoft Forms store data?
Microsoft's Forms data storage page says tenants whose default geography is in an EU or EFTA country have Forms data stored in its EU/EFTA macro region geography. Microsoft's EU Data Boundary change log says Forms is fully compliant with the EU Data Boundary.
Does Microsoft use Forms responses to train AI?
Microsoft's Copilot privacy documentation says prompts, responses and data accessed through Microsoft Graph are not used to train foundation large language models. Microsoft's Copilot in Forms page says a Microsoft 365 account and a Copilot licence are needed to use it.
Are Microsoft Forms responses anonymous?
Not by default inside an organisation. The admin setting Record names by default is on unless an administrator turns it off, and form owners choose who can respond. For an anonymous survey, check who can respond, switch off name recording and avoid identifying questions.
Is Microsoft certified under the EU-U.S. Data Privacy Framework?
Microsoft's privacy statement and its DPA say Microsoft Corporation is certified under the EU-U.S. DPF, the UK Extension and the Swiss-U.S. DPF. The official DPF list API was not responding on 7 October 2026, so we relied on Microsoft's own statements.