
Typeform
GDPR CompliantSpanish form and survey builder with a published DPA and sub-processor list, running on AWS with a US affiliate in the chain.
Subject to the US CLOUD Act: a US provider in this tool's processing chain can be compelled to disclose data it holds, including data stored in the EU. The vendor itself is European-owned.
Freemium
GDPR Compliance Data
Not independently verified| GDPR Status | GDPR Compliant |
| HQ Country | Spain |
| Ownership | European-owned |
| Foreign Disclosure Exposure | US CLOUD Act / FISA 702 |
| Data Hosting Location | European UnionPrivacy policy references the European Economic Area and Ireland as processing locations, and states Google Calendar OAuth data is "stored exclusively in a PostgreSQL database hosted on AWS RDS within our production VPC". Source: typeform.com/legal/privacy-policy (read 2026-08-24). No single authoritative region statement was found. |
| EU Servers Available | |
| Data Processing Agreement | View DPA |
| Sub-processor List | Not verified |
| Schrems II Risk | Medium Risk |
| SCCs in Place | |
| Last Verified | 24 August 2026 |
How we reached this
Controller is TYPEFORM, S.L., "an entity incorporated in accordance with the laws of Spain", per the privacy policy. EU-owned. The published DPA states Typeform "shall be entitled to seek the assistance of its affiliates TYPEFORM US LLC, conducting business in the US" and its transfer clause covers sub-processors located outside the UK/EEA receiving personal data as an onward transfer, naming Amazon among them, under standard contractual clauses. Exposure is therefore US_CLOUD_ACT despite EU incorporation and an EEA primary region. Typeform publishes a DPA and maintains a sub-processor mailing list with a 15 calendar day objection window on changes, which is why this is COMPLIANT rather than PARTIAL.
About Typeform
Forms People Actually Finish
Typeform's whole design argument is one question per screen. Completion rates on longer forms tend to beat a conventional multi-field page, which is why it shows up in lead capture, onboarding surveys and research screeners rather than as a general form tool.
Logic jumps, hidden fields, calculated scores and recall of earlier answers cover most of what a marketing team needs without a separate survey platform, and the results feed CRM and email tools through native integrations or webhooks.
Spanish Company, American Sub-processor
The privacy policy names the controller as "an entity incorporated in accordance with the laws of Spain", TYPEFORM, S.L. That makes it European by ownership, which is more than can be said for several tools marketed as European alternatives.
The data path is more complicated than the incorporation. The DPA states that Typeform "shall be entitled to seek the assistance of its affiliates TYPEFORM US LLC, conducting business in the US", and the sub-processor annex covers onward transfers to processors outside the UK and EEA, Amazon among them. Ireland appears as a processing location. In practice: European company, European primary region, and a documented route by which US-based entities process personal data under standard contractual clauses.
That is a normal arrangement and it is properly documented, which is the point. Typeform publishes a DPA and maintains a sub-processor list customers can subscribe to, with a fifteen day window to object to changes. Compare that to the many vendors who publish neither.
What to Check Before Buying
If your requirement is that personal data never becomes reachable by a US entity, the US affiliate in the sub-processor chain is the thing to resolve before the pricing page, not after. If your requirement is a documented, GDPR-shaped transfer with SCCs and a right to object to new sub-processors, Typeform meets it.
More options in surveys and feedback.
Key Features
Pros & Cons
Categories
Typeform GDPR & data protection: common questions
Is Typeform GDPR compliant?
Yes. On the evidence we checked, Typeform meets the requirements European businesses usually need. Typeform is a European company headquartered in Spain, data is hosted within the European Union, and a Data Processing Agreement is published.
Where does Typeform store data?
Typeform states: "Privacy policy references the European Economic Area and Ireland as processing locations, and states Google Calendar OAuth data is "stored exclusively in a PostgreSQL database hosted on AWS RDS within our production VPC". Source: typeform.com/legal/privacy-policy (read 2026-08-24). No single authoritative region statement was found.". Data is hosted within the European Union.
Does Typeform offer a Data Processing Agreement (DPA)?
Yes. Typeform publishes a DPA at https://www.typeform.com/legal/data-processing-agreement/. A DPA is required under Article 28 GDPR whenever a provider processes personal data on your behalf.
What a DPA has to cover →Is Typeform a European company?
Yes. Typeform is headquartered in Spain and, as far as we can establish, European-owned.
Is Typeform subject to the US CLOUD Act?
Indirectly. Typeform itself is European-owned and headquartered in Spain, so the company is not subject to US jurisdiction. The exposure runs through a US provider in its processing chain, a host, CDN or other sub-processor, which can be compelled to disclose data it holds even when that data sits on EU servers. That is a narrower exposure than a US-owned vendor, and the compliance notes above say which provider it is. Standard Contractual Clauses are in place for transfers, which is the required safeguard but does not override a lawful US order.
Schrems II compliance checklist →Related Tools

Formbricks
Open-source survey and feedback platform hosted in Germany.

Survicate
Multichannel survey platform with AI analysis from Poland.

Mopinion
Dutch digital feedback platform with AI analysis. ISO 27001 certified.
Spotted something wrong?
Martech moves fast. Vendors change hosting regions, get acquired, publish a new DPA or rewrite their pricing, and they rarely announce it. We check what we publish and date every compliance review, but some of what you see here will be out of date before we catch it.
If you work at Typeform and something on this page is wrong, tell us and we will fix it. Readers, same invitation. Pointing us at the page that proves it gets it changed fastest.