This is not legal advice — GDPR compliance depends on what you're collecting, why, and who your respondents are, and a real assessment should involve someone qualified to give it. What this is: a practical checklist of the things that most commonly go wrong when someone spins up a survey without thinking about data protection, written from having built a survey tool around exactly these questions.
1. Know what "personal data" actually includes
It's wider than most people assume. Under GDPR, personal data isn't just names and emails — it's anything that can identify a person, directly or indirectly. That includes:
- IP addresses (yes, even without a name attached)
- Free-text answers that happen to mention someone's role, department, or a specific incident
- Combinations of otherwise-anonymous answers that narrow down to one person in a small team
The most common mistake: labeling a survey "anonymous" while still logging the respondent's IP address in the background. If the IP is stored, the survey isn't anonymous in a legal sense, regardless of what the survey page tells respondents.
Checklist: If you're calling a survey anonymous, confirm the tool actually doesn't store an IP address for it — not just that it doesn't display one to you.
2. Have a lawful basis before you collect anything
You need one of GDPR's lawful bases — consent, legitimate interest, contractual necessity, etc. — before collection starts, not retrofitted afterward. For most feedback/research surveys, this is either explicit consent (a checkbox, clearly worded, not pre-ticked) or legitimate interest (harder to justify for anything beyond routine service-improvement feedback).
Checklist: Decide your lawful basis before building the survey, and make sure the intro/consent copy on the survey itself matches it.
3. Only ask for what you need
Data minimization isn't just a GDPR principle, it's also good survey design — every optional field you add is a chance for someone to abandon the form. If you don't have a concrete reason to collect an email address, don't make it required "just in case."
Checklist: For every field, ask "what do I lose if this isn't collected?" If the answer is "nothing," remove it.
4. Have a real retention policy — and actually enforce it
Keeping response data indefinitely "because storage is cheap" is one of the most common GDPR gaps. Data should be deleted (or properly anonymized) once it's no longer needed for the purpose you collected it for.
Checklist: Set an actual expiry or review date on old surveys, and don't let closed surveys accumulate responses forever with no plan to deal with them.
5. Be able to actually honor a data subject access/deletion request
GDPR gives respondents (and your own account, as the data controller's customer relationship) the right to request their data back, or ask for it to be deleted. This needs to be something you can do, not just a line in a privacy policy — if a request comes in and the answer is "I'd have to ask engineering to write a script," that's a gap.
Checklist: Confirm your survey tool has a working self-service export and delete flow, not just a policy that describes one.
6. Know where your data actually lives
Data residency matters for a lot of EU organizations' own compliance requirements, especially in the public sector and regulated industries. "It's in the cloud" isn't an answer — you should know which country, and ideally which legal entity, is hosting the data.
Checklist: Ask your survey tool where data is physically hosted, and get a real answer, not a marketing page that avoids the question.
7. Consider encryption for anything sensitive
If a survey collects anything genuinely sensitive — health information, whistleblowing reports, HR complaints — consider whether the tool can offer end-to-end encryption, where even the provider running the survey can't read the response content. That's a meaningfully stronger guarantee than "we encrypt data at rest," which just means the provider can still read it, but an attacker who steals the disk can't.
Where Surveyee stands on each of these, concretely: IP addresses aren't stored by default (see our anonymity post), data is hosted in Germany, account export and delete are real self-service flows, and any survey can turn on free end-to-end encryption where responses are encrypted in the respondent's browser before they ever reach our servers. None of that replaces getting your own compliance question answered by someone qualified to answer it — but it's the honest starting point.