GDPR check

Is Qualtrics GDPR compliant? What researchers and universities should check

Qualtrics is a survey and experience management platform used for research questionnaires and course evaluations. This page sets out what Qualtrics publicly documents about data centres, contracts, subprocessors, transfers and AI features, and what it means for universities collecting research data.

Published 7 October 2026 · Sources checked 7 October 2026

Short answer

Qualtrics documents the main elements a DPO looks for: a data processing agreement with the EU Standard Contractual Clauses, a data centre region selected by the customer, an EU representative in Ireland, an active Data Privacy Framework certification and a broad set of ISO and SOC certifications. Generative AI features are off until an administrator enables them, and Qualtrics says raw customer data is not used to train its AI models. Survey-level anonymisation and automatic retention policies are available. How well it fits a study depends on your institution's licence, data centre and settings.

Prefer a tool built in the EU? Kahubi, from Avidemic AB in Sweden, covers research surveys with EU hosting and, for institutions, only European subprocessors. See how Kahubi handles research data

What Qualtrics documents publicly

Everything in this table comes from Qualtrics' own pages and documents and the official Data Privacy Framework list, read on 7 October 2026. Numbers in brackets refer to the sources at the end of the page.

Topic	What the vendor states	Source
Company and establishment	Qualtrics LLC, Provo, Utah, USA. Qualtrics Ireland Limited (Dublin) is its EU representative and QUL Technologies Limited (London) its UK representative. The privacy statement does not cover data Qualtrics processes for customers, such as survey responses; that data is governed by the customer's agreement and DPA. The contracting entity is set in the order form.	[1] [2]
Where survey responses are stored	Plan-dependent The DPA refers to "the data center region selected by Customer". Qualtrics runs on AWS, with regions across the US, Europe, Asia Pacific and Japan, including AWS Frankfurt and AWS London. The DPA allows processing outside the selected region where needed to provide and support the service, under the transfer terms in the DPA. Generative AI inference may run in another data centre within the same broad region, such as Europe.	[2] [3] [5]
Data processing agreement	Documented Exhibit A to the General Terms and Conditions, "Personal Data Processing Agreement for Qualtrics Services". Personal data is deleted within a reasonable time after the subscription ends, not exceeding six months.	[2]
Subprocessors	Public list. Mandatory: AWS for hosting and storage, plus content delivery, security and support providers. Optional AI subprocessors, used only if the customer enables the features: Amazon Web Services, Microsoft, OpenAI and Google. Qualtrics affiliates include entities in Ireland, Germany, the Netherlands and Sweden.	[4]
International transfers	Documented The DPA incorporates the 2021 EU SCCs (Modules 2 and 3), governed by Irish law with disputes before Irish courts. Qualtrics, LLC is an active participant in the EU-U.S. DPF, the UK Extension and the Swiss-U.S. DPF, per the official list and its privacy statement.	[1] [2] [6]
AI training on customer content	Documented "Qualtrics doesn't use your raw customer data to train its AI models." For first-party models it creates anonymised and aggregated datasets from customer data; contracts prohibit third-party AI vendors from training on customer data. Generative AI features are not enabled "until turned on by a Brand Administrator".	[5] [7]
Retention and deletion	Brand administrators can set retention policies that delete responses by age or anonymise name, email, IP address and location. The "Anonymize responses" survey option removes IP address, location data and contact fields for anonymous links.	[8] [9]
Security certifications	Documented SOC 2 Type II; ISO 27001, 27017, 27018 and 27701; FedRAMP authorised. Qualtrics also cites ISO 42001 for its AI management. Certificates are available through the Trust Center.	[7] [10] [11]
Institution controls	Documented Brand and division administrators, SAML or OAuth single sign-on (a paid feature, depending on the licence), two-factor authentication, allowed email domains, organisation-wide AI settings and retention policies. The Trust Center lists a HECVAT.	[5] [11] [12] [13]

Qualtrics deserves credit for the level of administrative control it offers institutions. Generative AI is off by default and can be enabled feature by feature, retention and anonymisation can be enforced centrally rather than left to each researcher, and its certifications include ISO 27701, the privacy extension to ISO 27001. The public subprocessor list separates mandatory providers from optional AI providers, which makes it easier to see what changes when an AI feature is switched on.

What this means for research and teaching

Validemic's analysis

Survey content decides the risk level. A survey about health, sexual orientation, religion, political views or trade union membership collects special category data under Article 9(1) GDPR [14]. A course evaluation with free-text comments can also contain personal data about staff and students. The platform settings matter, but so do the questions.

Use the institutional licence. The data centre region, SSO, retention policies and AI settings are set at brand level. Researchers should run studies in the university's Qualtrics brand rather than a personal account, so that the institution's DPA and configuration apply.

"Anonymous" needs care. The Anonymize responses option removes IP address and location data, which helps. Under the GDPR, data is only anonymous if individuals cannot be identified by any means reasonably likely to be used (Recital 26) [14]. Small groups, free-text answers and combinations of demographic questions can still identify people. Participant information should describe the survey as anonymous only when that is true, and otherwise explain how responses are stored and for how long.

AI features and participant information. If a brand administrator enables generative AI features, responses may be processed by the optional AI subprocessors listed. Check which features your institution has enabled and whether the participant information sheet and ethics application cover them.

DPIA likelihood. Large surveys on special category topics, or surveys of vulnerable groups, will often meet the criteria for a data protection impact assessment under Article 35 GDPR [14]. Ask your DPO whether an assessment already exists for your institution's licence before starting a new one. Our DPIA screening tool gives a first view.

Transfers. With an EU data centre region, responses are stored in the EU. Support access and some processing may still involve Qualtrics, LLC in the US, which is covered by the DPF certification and the SCCs in the DPA.

Reviewing a vendor right now? Validemic checks the vendor's documents against GDPR and the EU AI Act and cites every finding. Try the demo workspace

Questions to ask Qualtrics before approving it

Which data centre is our brand on, and can that region be confirmed in the order form?
Which Qualtrics entity is our contracting party, and which affiliates may access our data for support?
Which generative AI features are enabled in our brand, and which subprocessors does each one use?
For AI inference within a broader region, which data centres in Europe may be used?
How are the anonymised and aggregated datasets used for first-party model training created, and is there an option to exclude research brands?
Can we set default retention and anonymisation policies for all research surveys?
Is SSO included in our licence, and can we require two-factor authentication for all users?
Can we receive the latest ISO 27701 certificate, SOC 2 report and HECVAT through the Trust Center?
How will we be notified of changes to the subprocessor list?

The EU AI Act angle

The EU AI Act, Regulation (EU) 2024/1689, applies alongside the GDPR [15]. For a survey platform the points are brief. AI literacy under Article 4 has applied since 2 February 2025; the Digital Omnibus on AI, Regulation (EU) 2026/1744, reworded it in July 2026 as a duty to take measures to support staff AI literacy [15] [16]. Running research surveys is not one of the high-risk education uses in Annex III [15]. Qualtrics offers Text iQ, which calculates sentiment in text responses [5]. Sentiment analysis of written answers is not the same as emotion recognition, which the Act defines as inferring emotions from biometric data (Article 3(39)) and prohibits in education institutions under Article 5(1)(f), except for medical or safety reasons [15].

Sources

Privacy Statement - Qualtrics, updated 23 April 2026, retrieved 7 October 2026
General Terms and Conditions - Qualtrics, including Exhibit A, Personal Data Processing Agreement (version 250523), retrieved 7 October 2026
Qualtrics to go live on Amazon Web Services Cloud Infrastructure in the UK, 11 May 2022, retrieved 7 October 2026
Qualtrics Subprocessors, retrieved 7 October 2026
Artificial Intelligence (AI) Administration - Qualtrics, retrieved 7 October 2026
Data Privacy Framework List, entry for Qualtrics, LLC, retrieved 7 October 2026
Why the most secure organizations trust Qualtrics with their AI, retrieved 7 October 2026
Retention Policies - Qualtrics, retrieved 7 October 2026
Security Survey Options - Qualtrics, retrieved 7 October 2026
Security Statement - Qualtrics, retrieved 7 October 2026
Qualtrics XM Trust Center, retrieved 7 October 2026
Single Sign-On (SSO) Basic Overview - Qualtrics, retrieved 7 October 2026
Organization Settings - Qualtrics, retrieved 7 October 2026
Regulation (EU) 2016/679 (General Data Protection Regulation), Recital 26 and Articles 9 and 35, retrieved 7 October 2026
Regulation (EU) 2024/1689 (Artificial Intelligence Act), Articles 3(39), 4, 5(1)(f), 113 and Annex III, retrieved 7 October 2026
Regulation (EU) 2026/1744 (Digital Omnibus on AI), retrieved 7 October 2026

About this page

We read Qualtrics' privacy statement, General Terms and Conditions with the DPA, subprocessor list, security statement, Trust Center and support articles on 7 October 2026, and checked the official Data Privacy Framework list on the same day. EUR-Lex was partly unavailable on that date, so the legal texts were read from the Official Journal copies published by the EU Publications Office. We did not find a current public list of data centre locations; the locations above come from a Qualtrics news release. "Not found" means we could not find the information in public documentation; it does not mean the vendor lacks it.

This page describes public documentation and gives our own analysis. It is not legal advice and it is not a statement that the tool is or is not GDPR compliant, which depends on your contract, configuration and use. If you work for Qualtrics and see an error, please contact us and we will correct it.

Frequently asked questions

Can I use Qualtrics for research surveys under GDPR?

Qualtrics provides a data processing agreement with the EU Standard Contractual Clauses, lets the customer select a data centre region, holds ISO 27001, 27017, 27018 and 27701 certifications and offers anonymisation and retention settings. Whether a particular study can use it depends on your institution's licence and configuration, so check with your DPO and the brand administrator.

Where does Qualtrics store survey responses?

Qualtrics' DPA refers to the data centre region selected by the customer. Qualtrics runs on Amazon Web Services and has described regions in the US, Europe, Asia Pacific and Japan, including an AWS region in Frankfurt and one in London. Your institution's brand administrator can see which data centre your account uses.

Does Qualtrics use survey responses to train AI?

Qualtrics says it does not use raw customer data to train its AI models. For its own models it creates anonymised and aggregated datasets from customer data, and its contracts prohibit third-party AI vendors from training on customer data. Generative AI features are off until a brand administrator turns them on.

Does Qualtrics sign a DPA?

Yes. Qualtrics' standard General Terms and Conditions include a Personal Data Processing Agreement as Exhibit A, which incorporates the 2021 EU Standard Contractual Clauses (Modules 2 and 3) governed by Irish law.

Can Qualtrics surveys be anonymous?

Qualtrics has an Anonymize responses survey option that removes IP address, location data and contact fields for anonymous links, and brand administrators can set retention policies that delete or anonymise responses automatically. Whether a dataset is truly anonymous also depends on the questions asked.