GDPR check

Is SurveyMonkey GDPR compliant? What researchers and universities should check

Students and researchers often reach for SurveyMonkey for questionnaires. This page sets out what SurveyMonkey publicly documents about where responses are stored, its contract terms, subprocessors, transfers and AI features, and what that means for research surveys at a university.

Published 7 October 2026 · Sources checked 7 October 2026

Short answer

SurveyMonkey provides a data processing agreement with the EU Standard Contractual Clauses built in, contracts with customers outside the US through SurveyMonkey Europe UC in Ireland, holds ISO 27001 and is certified under the EU-U.S. Data Privacy Framework. By default responses are stored in the United States; its EU data centre is only available on Enterprise. It uses de-identified customer data to train its own AI models. Whether it suits a research survey depends on the plan, the data centre and how anonymity settings are used.

Prefer a tool built in the EU? Kahubi, from Avidemic AB in Sweden, covers research surveys with EU hosting and, for institutions, only European subprocessors. See how Kahubi handles research data

What SurveyMonkey documents publicly

Everything in this table comes from SurveyMonkey's own pages and the official Data Privacy Framework list, read on 7 October 2026. Numbers in brackets refer to the sources at the end of the page.

TopicWhat the vendor statesSource
Company and establishmentSurveyMonkey Inc. (San Mateo, California) and SurveyMonkey Europe UC (Dublin). For customers outside the United States, SurveyMonkey Europe UC is the contracting entity under the DPA. The privacy notice says its Data Protection Officer is registered with the Irish Data Protection Commission and gives a DPO contact.[1] [2]
Where survey responses are storedPlan-dependent Data centres in the US, Canada and Ireland. The help centre says "Most European customer data is stored on servers in the US". The EU data centre "is only available for SurveyMonkey Enterprise Customers"; there, survey questions and responses are stored in the EU, while de-identified response data may go to the US for product improvement and service monitoring, and AI survey generation prompts go to a US vendor. Accounts opened before 2019 cannot migrate existing surveys.[3] [4]
Data processing agreementDocumented Incorporated into the agreement, dated 27 December 2025. Self-serve customers get the transfer clauses automatically. Customers may object to a new subprocessor within 30 days.[2] [5]
SubprocessorsPublic list with processing location and service. Hosting on AWS (USA, Canada, Ireland), including AWS Bedrock for AI features. OpenAI for AI product features, Google for translation and language processing, Abacus.ai for running machine learning models, Snowflake for analytics including quality analysis of de-identified response data. Anthropic is listed for professional services.[5]
International transfersDocumented EU, UK and Swiss SCCs. SurveyMonkey Inc. is an active participant in the EU-U.S. DPF, the UK Extension and the Swiss-U.S. DPF, per the official list and the vendor's transfer statement.[5] [6]
AI training on customer content"We use de-identified customer data or synthetically-generated data to train and build our proprietary AI models." AI features using Azure OpenAI, OpenAI or a self-hosted Anthropic model: the providers do not use the data to train their models. Sentiment Analysis and Response Quality use SurveyMonkey's own models. An opt-out from de-identified training was not found in public documentation (checked 7 October 2026).[7] [8]
Retention and deletionAfter account deletion, the account is disabled immediately and account and survey data are permanently removed within one year; residual backup copies may remain for a short time. Respondent IP addresses in backend logs are deleted after 13 months.[9] [10]
Security certificationsDocumented ISO 27001 certified; hosting in SOC 2 accredited data centres; HIPAA-compliant Enterprise product; PCI DSS for payments.[11]
Institution controlsPlan-dependent SAML 2.0 single sign-on on Enterprise, which can also require respondents to authenticate. Primary admins on some Team and Enterprise accounts can switch AI features off. Enterprise admins can set a team-wide default for anonymous responses. Discounts for students and educators exist; institution-wide academic terms were not found publicly.[8] [10] [12]

SurveyMonkey deserves credit for a self-serve DPA that includes the transfer clauses without negotiation, an Irish contracting entity for non-US customers, an ISO 27001 certificate, a subprocessor list that names the service each provider supports, a clear description of what happens to data in each AI feature, and admin controls for AI and anonymity on business plans.

What this means for research and teaching

Validemic's analysis

Survey content decides the risk level. Questions about health, sexual orientation, religion, political opinions or trade union membership collect special category data under Article 9(1) GDPR [13]. Even a short student project survey can fall into this category.

Plan tier decides where data lives. On individual and team plans, responses are stored in the US. That is lawful with the DPF certification and the SCCs, but some universities and ethics boards require EU storage for sensitive research data. The EU data centre requires Enterprise and a new account; existing older accounts cannot be moved.

Personal accounts are the common problem. A student or researcher who signs up individually accepts the terms personally, outside the university's procurement and DPA. For research data, the institution normally needs to be the controller with a processor agreement in place. Ask your DPO whether your university has a SurveyMonkey agreement or a preferred survey tool.

Anonymity is a setting, not a default. IP addresses are recorded unless Anonymous Responses is turned on in every collector, and they remain in backend logs for 13 months [10]. Data is only anonymous under the GDPR if individuals cannot be identified by any means reasonably likely to be used (Recital 26) [13]. Participant information should promise anonymity only when the settings and the questions support it.

AI and de-identified data. SurveyMonkey's use of de-identified customer data to train its own models is described in its public principles. Participant information sheets rarely mention this kind of secondary use, so the ethics application should state which platform is used and link its privacy notice.

DPIA likelihood. Large surveys on special category topics, or surveys of children or other vulnerable groups, will often meet the criteria for a data protection impact assessment under Article 35 GDPR [13]. Our DPIA screening tool gives a first view.

Reviewing a vendor right now? Validemic checks the vendor's documents against GDPR and the EU AI Act and cites every finding. Try the demo workspace

Questions to ask SurveyMonkey before approving it

  1. Can our institution's accounts be placed on the EU data centre, and what plan does that require?
  2. Which data still leaves the EU data centre (de-identified responses, prompts, account data, support access), and under which mechanism?
  3. How is response data de-identified before it is used to train your own models, and can research accounts be excluded?
  4. Can we switch off all AI features for every user in our organisation?
  5. Can we set Anonymous Responses as the default for all research surveys?
  6. Can the 13-month retention of IP addresses in backend logs be shortened for our account?
  7. Is there an institutional agreement for universities, so that staff and students do not sign up individually?
  8. Can we receive the ISO 27001 certificate and any SOC reports?

The EU AI Act angle

The EU AI Act, Regulation (EU) 2024/1689, applies alongside the GDPR [14]. For a survey tool the points are brief. AI literacy under Article 4 has applied since 2 February 2025; the Digital Omnibus on AI, Regulation (EU) 2026/1744, reworded it in July 2026 as a duty to take measures to support staff AI literacy [14] [15]. Running research surveys is not one of the high-risk education uses in Annex III [14]. SurveyMonkey's Sentiment Analysis classifies text responses as positive, negative or neutral [8]. That is analysis of written text and is not emotion recognition, which the Act defines as inferring emotions from biometric data (Article 3(39)) and prohibits in education institutions under Article 5(1)(f), except for medical or safety reasons [14].

Sources

  1. Privacy Notice | SurveyMonkey, updated 1 May 2026, retrieved 7 October 2026
  2. SurveyMonkey Data Processing Agreement, dated 27 December 2025, retrieved 7 October 2026
  3. International Data Center Overview | SurveyMonkey, updated 15 April 2025, retrieved 7 October 2026
  4. Data Processing Agreements, Storage, and Transfers (EU) | SurveyMonkey Help, retrieved 7 October 2026
  5. EU Data Transfer Statement and Subprocessor List | SurveyMonkey, retrieved 7 October 2026
  6. Data Privacy Framework List, entry for SurveyMonkey Inc., retrieved 7 October 2026
  7. Our Responsible AI Principles | SurveyMonkey, retrieved 7 October 2026
  8. AI Features in SurveyMonkey | SurveyMonkey Help, retrieved 7 October 2026
  9. Your SurveyMonkey Data | SurveyMonkey Help, retrieved 7 October 2026
  10. Making Responses Anonymous | SurveyMonkey Help, retrieved 7 October 2026
  11. Security Statement | SurveyMonkey, retrieved 7 October 2026
  12. Single Sign-On (SSO) | SurveyMonkey Help, retrieved 7 October 2026
  13. Regulation (EU) 2016/679 (General Data Protection Regulation), Recital 26 and Articles 9 and 35, retrieved 7 October 2026
  14. Regulation (EU) 2024/1689 (Artificial Intelligence Act), Articles 3(39), 4, 5(1)(f), 113 and Annex III, retrieved 7 October 2026
  15. Regulation (EU) 2026/1744 (Digital Omnibus on AI), retrieved 7 October 2026

About this page

We read SurveyMonkey's privacy notice, DPA, data centre overview, subprocessor list, security statement, AI principles and help centre articles on 7 October 2026, and checked the official Data Privacy Framework list on the same day. EUR-Lex was partly unavailable on that date, so the legal texts were read from the Official Journal copies published by the EU Publications Office. "Not found" means we could not find the information in public documentation; it does not mean the vendor lacks it.

This page describes public documentation and gives our own analysis. It is not legal advice and it is not a statement that the tool is or is not GDPR compliant, which depends on your contract, configuration and use. If you work for SurveyMonkey and see an error, please contact us and we will correct it.

Frequently asked questions

Can I use SurveyMonkey for research surveys under GDPR?

SurveyMonkey offers a data processing agreement with the EU Standard Contractual Clauses, contracts with non-US customers through SurveyMonkey Europe UC in Ireland, and holds ISO 27001. Responses are stored in the US unless the account is on its EU data centre, which is only available for Enterprise customers. Check with your DPO which plan and settings your study needs.

Where does SurveyMonkey store survey responses?

SurveyMonkey has data centres in the United States, Canada and Ireland. Its help centre says most European customer data is stored in the US. The European Union data centre is only available for SurveyMonkey Enterprise customers, and accounts opened before 2019 cannot have existing surveys migrated.

Does SurveyMonkey use survey responses to train AI?

SurveyMonkey says it uses de-identified customer data or synthetically generated data to train and build its proprietary AI models. For AI features that use Azure OpenAI, OpenAI or Anthropic models, it says those providers do not use the data to train their models.

Does SurveyMonkey sign a DPA?

Yes. SurveyMonkey's Data Processing Agreement is incorporated into its terms, and self-serve customers get the EU, UK and Swiss Standard Contractual Clauses automatically. For customers outside the United States the contracting entity is SurveyMonkey Europe UC.

Are SurveyMonkey surveys anonymous?

Not by default. Web links and email invitations record IP addresses unless the Anonymous Responses setting is turned on for each collector before sending. SurveyMonkey still records respondent IP addresses in backend logs and deletes them after 13 months.

Related reading