All Research Guides

A Guide From Domandata

GDPR-Compliant Survey Software for Researchers

Written by Domandata, which makes a survey platform. We name our product where it fits and say where another tool fits better. Claims about other tools link to their own documentation, checked ; confirm anything decisive with the vendor or your institution.

Researchers at European institutions, or surveying people in the EU, are often told to use a GDPR-compliant survey tool. That phrase is misleading: compliance belongs to the study, not the software. You, as part of the controlling institution, decide the lawful basis, what you collect, and how long you keep it. The tool's job is to make those decisions possible and to process data on your behalf under a proper agreement.

This guide lists what to require from a platform, what to configure yourself, and which tools offer EU hosting or self-hosting.

The short answer

Ask your data-protection officer first; many universities already approve a specific tool. Otherwise, require a data-processing agreement under Article 28, a clear answer on where data is stored, and a list of sub-processors. SoSci Survey and LimeSurvey offer EU hosting or self-hosting, Gorilla hosts in Ireland for experiments, and KoboToolbox has an EU server for fieldwork. Domandata does not currently offer EU hosting or publish a data-processing agreement, so it is not the right choice when those are required.

What to require, and what stays your responsibility

  1. 1

    A data-processing agreement

    When a vendor stores responses for you, it acts as a processor, and GDPR Article 28 requires a contract that limits what it may do with the data. Ask for it before fieldwork, not after.

  2. 2

    Where the data lives

    EU or EEA hosting avoids most international-transfer questions. Hosting elsewhere can still be lawful with transfer safeguards, but your data-protection officer has to assess them.

  3. 3

    Sub-processors

    Hosting, email, analytics, and AI features may involve other companies. A vendor should list them so you can describe the data flow in your privacy notice and ethics application.

  4. 4

    Data minimization in the instrument

    Turn off IP and location capture you do not need, avoid free-text fields that invite identifying details, and separate recruitment IDs from responses when you can. These choices are yours whichever tool you use.

  5. 5

    Consent and information

    The information sheet and consent wording, including how participants withdraw, belong in your survey. Check that the tool lets you route people who decline away from the questions.

  6. 6

    Retention and deletion

    Decide how long identifiable data is kept, and confirm that the tool can delete individual responses on request and whole projects when the retention period ends.

Tools with EU hosting or self-hosting

General academic surveys

SoSci Survey runs on servers in Munich, but its free server does not allow personal data, which needs the paid server. LimeSurvey offers cloud regions in Germany and Finland with a processing agreement, or self-hosting on your institution's servers.

SoSci Survey

Professional questionnaire tool from Munich, widely used in European social science.

Pricing model
Free for non-commercial scholarly projects and non-profits; commercial use is paid.
Where it runs
Cloud servers in Munich, or install it on your own server.

Strengths

  • Free for most academic projects.
  • Labelled exports for SPSS, R, and Stata, plus a codebook.
  • Programmable survey paths for complex designs.

Watch out for

  • Free projects are time-limited and may not collect personal data under the GDPR; that requires the paid server.

Sources:SoSci Survey for AcademicsSoSci Survey Data Download

LimeSurvey

Open-source survey platform you can host yourself or use as a hosted cloud service.

Pricing model
Community Edition is free to self-host under the GPL; LimeSurvey Cloud has a free tier and paid subscriptions, with education discounts.
Where it runs
Self-hosted or cloud, with cloud regions including Germany and Finland and a GDPR data-processing agreement.

Strengths

  • Full control of the data when you host it yourself.
  • Exports to SPSS, R (via a plugin), Stata, CSV, and Excel.

Watch out for

  • Self-hosting requires someone to maintain, secure, and update the server.
  • Routing is written as relevance equations, and some statistical exports need extra configuration.

Sources:LimeSurvey PricingLimeSurvey Exporting ResultsLimeSurvey ExpressionScript

Behavioral and psychology experiments

Hosted on Microsoft Azure in Ireland with an Article 28 processing agreement available.

Gorilla Experiment Builder

No-code builder for online behavioral experiments and questionnaires, common in psychology.

Pricing model
Building and testing are free; you pay per participant with tokens, with academic discounts and lab or institution subscriptions.
Where it runs
Cloud only, on Microsoft Azure in Ireland, with a GDPR data-processing agreement.

Strengths

  • Reaction-time tasks and questionnaires in one study without coding.
  • A code editor is available when the visual builder is not enough.
  • Recruitment targets cap how much a study can spend.
  • Exports trial-level (long) or one-row-per-participant data as CSV or Excel.

Watch out for

  • Cost scales with sample size, since every participant uses a token.
  • Makes no HIPAA claim; compliance responsibility sits with the researcher.

Sources:Gorilla Pricing FAQGorilla Data ExportsGorilla Due Diligence

Fieldwork and humanitarian research

Offers a public EU server for organizations that prefer EU hosting, or a private server.

KoboToolbox

Data-collection platform from the nonprofit Kobo, built for field, humanitarian, and low-connectivity research.

Pricing model
Free Community Plan for nonprofit users, with a monthly submission cap; paid plans add capacity, and for-profit organizations contact sales.
Where it runs
Public global server, public EU server, or a private server.

Strengths

  • Offline data collection on Android and in offline-capable web forms.
  • GPS, photo, and audio capture for fieldwork.

Watch out for

  • SPSS export is a labels syntax file to apply to CSV data, not a ready .sav file.
  • Monthly submission cap on the free plan.

Sources:About KoboToolboxKoboToolbox ExportsKoboCollectKoboToolbox Accounts and Plans

Full control on your own infrastructure

Self-hosting keeps data on servers your institution controls, at the cost of running and securing them yourself.

LimeSurvey

Open-source survey platform you can host yourself or use as a hosted cloud service.

Pricing model
Community Edition is free to self-host under the GPL; LimeSurvey Cloud has a free tier and paid subscriptions, with education discounts.
Where it runs
Self-hosted or cloud, with cloud regions including Germany and Finland and a GDPR data-processing agreement.

Strengths

  • Full control of the data when you host it yourself.
  • Exports to SPSS, R (via a plugin), Stata, CSV, and Excel.

Watch out for

  • Self-hosting requires someone to maintain, secure, and update the server.
  • Routing is written as relevance equations, and some statistical exports need extra configuration.

Sources:LimeSurvey PricingLimeSurvey Exporting ResultsLimeSurvey ExpressionScript

jsPsych

Free JavaScript library for behavioral experiments that run in the participant's browser.

Pricing model
Free and open source under the MIT license.
Where it runs
None included; host it yourself or with a service such as JATOS, Cognition.run, or Pavlovia.

Strengths

  • Complete flexibility, with a large plugin ecosystem.
  • No license fees.

Watch out for

  • Requires JavaScript programming.
  • You arrange hosting, data storage, and security yourself.

Sources:jsPsych: Running ExperimentsjsPsych on GitHub

oTree

Python framework for interactive, multiplayer experiments such as economic games and markets, which also supports surveys.

Pricing model
Free under an MIT-style license that asks you to cite the oTree paper in publications.
Where it runs
Self-hosted on Heroku or your own server.

Strengths

  • Real-time interaction between participants, which survey platforms generally do not offer.
  • Free and open source.

Watch out for

  • Requires Python programming.
  • You set up and run the server.

Sources:oTreeoTree Server Setup

Before you collect personal data

  • Your data-protection officer has approved the tool or reviewed its agreement
  • A data-processing agreement is signed
  • You know the hosting location and every sub-processor
  • The privacy notice names the tool and the data it collects
  • IP, location, and other unneeded metadata collection is off
  • Identifiers are stored separately from responses where possible
  • You can delete one participant's data on request
  • A deletion date for identifiable data is set and recorded

Frequently Asked Questions

Is Qualtrics GDPR compliant?

No survey tool is compliant on its own; compliance depends on how your institution uses it. If your university licenses Qualtrics, ask your data-protection officer whether that agreement covers your study and where its data is stored.

Is Google Forms GDPR compliant for research?

It can be used lawfully under an institutional Google Workspace agreement that your data-protection office has approved, but personal Google accounts usually do not provide the processing agreement a research study needs. Check your university's guidance before using it for personal data.

Do I need EU hosting to comply with the GDPR?

Not strictly. Data can be transferred outside the EU with appropriate safeguards, such as an adequacy decision or standard contractual clauses. EU hosting avoids that assessment, which is why many data-protection officers prefer it.

Does Domandata support GDPR research?

Domandata does not currently offer EU data hosting or publish a data-processing agreement, and its infrastructure providers are U.S.-based. If your study requires either, use an EU-hosted or self-hosted tool. Domandata will provide security documentation for institutions assessing it.

Keep Reading

Choosing Free Survey Software

Free options, including European tools, and their catches.

Qualtrics vs REDCap

How the two common university tools handle regulated data.

Why Domandata

Our own case for Domandata, and when to use another tool.

Domandata Trust Center

Our compliance posture, self-assessments, and sub-processors.