How to choose a GDPR-friendly form service
No form service makes your form GDPR compliant on its own: you stay the controller and decide the lawful basis, the privacy notice and how long you keep answers. What a service does decide is where your visitors' data goes and what you can prove about it. These seven questions separate a vendor you can document from one you have to take on trust.
A practical guide, not legal advice. For a decision about your own processing, check with your data protection officer or a lawyer.
1. Where are submissions stored?
Look for the vendor's own statement of where the database and file storage run, not a marketing line. "EU hosting available" often means an option on a higher plan while the default stays in the US. If submissions are stored outside the EU, you have a transfer to document for every one of them.
2. Is there a public sub-processor list?
A sub-processor list names every third party that touches the data, with its location and purpose. Without one you cannot tell whether email, spam checks or AI features send data elsewhere.
3. Is the DPA published?
Article 28 of the GDPR requires a contract with every processor. A DPA you can read before you sign up, and accept in the product, is easier to document than one available on request.
4. Can you set retention, and what about backups?
Check whether you can set a retention period per form, whether it applies automatically, and how long deleted data stays in backups. A default of keeping everything forever works against data minimisation.
5. What happens to IP addresses?
An IP address is personal data. A service that stores raw IPs alongside every submission keeps more than it needs; one that hashes them for rate limiting keeps less.
6. Where do copies go?
Notification emails, webhooks and integrations copy submissions to wherever those destinations are hosted. EU storage at the vendor does not reach a US-hosted inbox.
7. Do the claims hold up?
Compare the marketing page with the DPA and the privacy policy. If they disagree about location or retention, the legal documents are what you can rely on.
How Formward answers them
- Stored in Sweden; email through Mailjet's EU data centre; AI on Mistral AI in France (EU data residency).
- A public sub-processor register; the only optional non-EU service in the submission path is Cloudflare Turnstile, off unless a form enables it.
- The DPA is published in full and accepted in the dashboard.
- Free forms delete after 30 days; paid plans set a period per form; backups are gone within 30 days (retention).
- Raw IPs are never stored, only a keyed hash (IP addresses).
Questions
- Does an EU-hosted form service make my form GDPR compliant?
- No. It removes a transfer from the vendor's own processing, but you still need a lawful basis, a privacy notice, a sensible retention period and a DPA, and copies you send elsewhere follow their own rules.
- Is a US form service with SCCs allowed?
- It can be lawful, but each submission is then a transfer you document and assess. An EU-hosted service avoids that work for the vendor's own processing.
- What is the most common gap?
- Notification email. Many teams store submissions in the EU but send every answer to a US-hosted mailbox.
Check Formward against the list
The DPA, the sub-processor register and the retention rules are all public.