Free form builders and data residency
Google Forms is free and takes three minutes. Where the responses live, who processes them and under which contract is worth asking before the survey goes out.
Disclaimer: this is an overview for technical leads, not legal advice. Talk to your own counsel before making a decision.
Half the customer surveys in small and mid-sized companies run on Google Forms, because it is free, familiar and takes three minutes. The part that rarely gets discussed before launch is where those answers physically end up, and what you have committed to by collecting them.
Why “where the data lives” is a real question
Most privacy regimes care about three things that a free form builder quietly decides for you:
- Location. Which country’s infrastructure holds the responses, and therefore which jurisdiction can compel access to them.
- The processing relationship. If you are the controller, you need a processor agreement with whoever runs the form. Free consumer-tier tools frequently do not offer one.
- Onward transfers. Whether the provider moves data between regions, and on what legal basis.
None of that is exotic. It is the same checklist that a GDPR data-processing agreement, a US state privacy law, or Russia’s data-localisation rules all approach from slightly different angles. What varies is how strict the answer has to be.
What counts as personal data
More than people expect. Typically:
- A full name, or a surname with initials
- An email address
- A phone number
- A home address, region or city
- An IP address, in many regimes
- Any combination that lets you identify a specific person
Which means an ordinary “name + email + comment” feedback form is already personal-data processing, with everything that implies.
Where a free tool leaves you exposed
Consumer-grade form tools tend to share the same gaps:
- No processor agreement available on the free tier, so you cannot document the relationship at all.
- No control over the region where responses are stored.
- No consent log: you can prove the person filled in a form, but not what they agreed to and when.
- No deletion workflow beyond “delete the spreadsheet”, which does not cover backups.
None of this matters for an internal team poll. All of it matters the moment the form is customer-facing and the customers are identifiable.
What to compare instead of price
| What to check | Why it matters |
|---|---|
| Where responses are stored | Determines jurisdiction and access |
| Whether a processor agreement is offered | Required in most controller/processor setups |
| Self-hosting option | The only way to make the question moot |
| Consent logging | Proof of what was agreed, and when |
| Export and deletion | Both need to actually work, backups included |
Where Askyo stands, honestly
Our hosted version runs on infrastructure in Russia. That is the right answer for customers who need Russian data localisation and the wrong answer for a lot of other people, so we do not pretend otherwise.
If your requirement is that the data must stay somewhere specific, or must never touch a vendor at all, the answer is the self-hosted build: we deploy Askyo on infrastructure you choose and control, and responses never reach us. That is part of the Enterprise track, and it is the option we point European and US buyers at when the question comes up.
Beyond that: a survey in Askyo is a portable file. You can export the schema and every response and leave whenever you want. That does not solve the compliance question by itself, but it does mean you are never stuck with a provider whose answer to it has changed.
A migration checklist
- List every active form that collects identifiable data.
- For each one, write down where the responses currently sit and under which agreement.
- Move the ones you cannot answer for. We support import from Google Forms via CSV export.
- Add an explicit consent step to any survey collecting personal data, and make sure the consent is logged. In Askyo that happens automatically.
- Check that deletion requests can actually be fulfilled end to end.
None of this is exciting work. It is considerably less unexciting than doing it after an incident.