Automation and integrations

Online forms

Collecting personal data with Google Forms or Microsoft Forms: the account, the settings and the notice

The account a Google or Microsoft form is made in decides which terms cover the responses. On a Google Workspace or Microsoft 365 business account the provider handles them for you under a data processing addendum; a personal account comes without one.

By Oscar CobbeCurrent as at 6 minute read19 sources

Step 1: make the form in the business account

The business that decides why a form collects personal data, and how, is the controller of the answers (Article 4(7) of the GDPR). A provider that stores and handles them on the business's behalf is a processor (Article 4(8)), and Article 28(3) requires a contract between the two. Controller or processor explains the test. What each kind of account comes with:

AccountTerms that cover the responsesThe provider's role
Google, personal accountGoogle's Terms of Service, which contain no data processing terms, and its Privacy PolicyThe Privacy Policy names Google Ireland Limited as data controller for users in the EEA
Google WorkspaceThe Cloud Data Processing Addendum, part of the Workspace agreement; Forms is one of Workspace's core servicesProcessor, with the business as controller
Microsoft, personal account (Outlook.com, Hotmail or Live)Microsoft's privacy statementThe statement names Microsoft Ireland Operations Limited as controller for people in the EEA
Microsoft 365 business planMicrosoft's Product Terms and its Products and Services Data Protection AddendumProcessor, with the business as controller

Personal accounts also lose settings

On a personal Microsoft account, Microsoft Forms cannot limit responses to your organisation, record who responded or take file uploads: Microsoft keeps those settings for work or school accounts.

Step 2: know where the responses are kept

Google Forms keeps responses in the form, and can also send them to a linked Google Sheet. The sheet is a separate file in Drive: deleting the form does not delete the sheet, or the other way round, and people who collaborate on the form get access to a new response sheet automatically. Files uploaded through a form go into a new folder in the form owner's Drive.

On Workspace, where the data is stored depends on the edition. Business Standard and Business Plus include data regions, which let an administrator keep Forms content, responses and draft responses stored in Europe; Business Starter is not among the editions Google lists. Without a data region policy, the Cloud Data Processing Addendum lets Google process the data in any country where Google or its subprocessors have facilities.

Microsoft Forms stores data according to the default geography of your Microsoft 365 organisation. Where that is a country in the EU or the European Free Trade Association, Microsoft stores Forms data in its European Union and EFTA region. Files uploaded through a form go to the form owner's OneDrive, in the Apps folder, under Microsoft Forms.

Step 3: change the settings that matter

In each form's settings, before it goes out:

  1. 1Who can respond. A Google Form made in Workspace starts restricted to people in your organisation; to take responses from customers, turn off the restriction to users in your domain. Microsoft Forms offers anyone, only people in your organisation, or specific people in your organisation.
  2. 2Email addresses. Google can collect them as Verified, the respondent's own Google Account address, which they confirm, with a notice on each page of the form; as Responder input, which they type; or not at all. Microsoft's Record name setting keeps track of who responded, on work or school accounts only.
  3. 3No names is not the same as anonymous. Microsoft points out that a question asking for a name, a form sent to only a few people, or the time a response arrived can still tie an answer to a person. Information that can identify someone, directly or indirectly, is personal data (Article 4(1)).
  4. 4File uploads. To upload to a Google Form, the respondent has to sign in to a Google Account. Microsoft takes uploads only on forms limited to your organisation, with up to 10 files per question.
  5. 5Response receipts. Google can send respondents a copy of their answers, when they ask or always, if the form collects email addresses. Microsoft's receipt setting lets respondents save or print a PDF of their answers, and lets respondents inside your organisation ask for an email receipt.
  6. 6Results summary. Google's View results summary setting shows the full text answers and charts for each question to anyone who can respond, so leave it off on any form that collects personal data.

Step 4: tell people what happens to their answers

Article 13 of the GDPR requires the information below at the time the personal data is collected, which for a form means on the form. The description at the top can carry it, or link to your privacy notice where it is set out in full: what a privacy notice must say. A form that feeds a regular job, such as enquiries, bookings or staff details, belongs in your record of processing as well.

  1. 1Who you are and how to contact you, and your data protection officer's contact details if you have one (Article 13(1)(a) and (b)).
  2. 2Why you are collecting the answers and your legal basis, with the legitimate interests if you rely on them (Article 13(1)(c) and (d)).
  3. 3Who receives the answers (Article 13(1)(e)). A recipient is anyone the data is disclosed to, third party or not (Article 4(9)), so the form provider is one.
  4. 4Whether the answers leave the EEA, and on what basis (Article 13(1)(f)).
  5. 5How long you will keep them, or how you will decide (Article 13(2)(a)).
  6. 6The rights to access, correction, erasure, restriction, objection and portability; the right to withdraw consent where consent is the basis; and the right to complain to a supervisory authority (Article 13(2)(b) to (d)).
  7. 7Whether answering is a legal or contractual requirement, and what happens if someone does not answer (Article 13(2)(e)).
  8. 8Any automated decision-making based on the answers (Article 13(2)(f)).

Step 5: delete responses when the purpose is done

Article 5(1)(e) of the GDPR allows personal data to be kept in a way that identifies people for no longer than is necessary for the purpose. Decide the period when the form is made, give it in the notice, and delete on that date.

  1. 1Google Forms: Responses, then Summary, then More, then Delete all responses; single responses from the Individual tab. Google says deleting responses cannot be undone, and that it does not delete uploaded files. The linked sheet is a separate file, deleted separately.
  2. 2Microsoft Forms: Responses, then the menu beside Open in Excel, then Delete all responses. Microsoft says deleting is permanent.
  3. 3Close the form when collecting ends. Google's Accepting responses switch and Microsoft's Accept responses setting stop new answers arriving.

Health and other special category data

Article 9(1) of the GDPR prohibits processing data concerning health, racial or ethnic origin, political opinions, religious or philosophical beliefs, trade union membership, genetic data, biometric data used to identify a person, and data about a person's sex life or sexual orientation, unless one of the conditions in Article 9(2) applies. A form that asks about any of these needs one of those conditions, and questions limited to what the purpose needs (Article 5(1)(c)). It belongs in the business account, under the processing terms.

Special category data sets out the conditions a small business can use, and the free DPIA check runs the Data Protection Commission's list of the uses that need an impact assessment first.

Sources

  1. 1.Regulation (EU) 2016/679 (GDPR), Articles 4, 5, 9, 13 and 28 · EUR-Lex, Publications Office of the European Union
  2. 2.Google Terms of Service · Google
  3. 3.Google Privacy Policy · Google
  4. 4.Cloud Data Processing Addendum · Google
  5. 5.Google Workspace Services Summary · Google
  6. 6.Microsoft Privacy Statement · Microsoft
  7. 7.Microsoft Products and Services Data Protection Addendum · Microsoft
  8. 8.Adjust your form or quiz settings in Microsoft Forms · Microsoft Support
  9. 9.Set up your survey so names aren't recorded when collecting responses · Microsoft Support
  10. 10.Add questions that allow for file uploads in Microsoft Forms · Microsoft Support
  11. 11.Choose where to save form responses · Google
  12. 12.Choose a type of question for your form · Google
  13. 13.Choose a geographic location for your data · Google
  14. 14.Data covered by data regions · Google
  15. 15.Data storage for Microsoft Forms · Microsoft Support
  16. 16.Create your first form in Google Forms · Google
  17. 17.View and manage form responses · Google
  18. 18.Publish and share your form with responders · Google
  19. 19.Delete responses · Microsoft Support

Free, and no account needed

Does what the form collects need a DPIA?

Nine questions against the Data Protection Commission's list of uses that need an impact assessment, health data among them. The result prints as your record of the screening.

Run the free check

Form responses that go where they are needed

Build joins your forms to the systems you already use, so each response reaches the right person and the right record without anybody copying it across, and every automation retries and alerts a person when it fails. €1,500 for one connection, €3,000 for up to five workflows.

See Build

Who wrote this

Oscar Cobbe · Founder, FourWinds Digital

Writes and maintains the legal explainers on this site, and does the compliance work behind them. Every date and article number here is checked against the legislation itself before it is published, and each article shows the date it was last checked.

More about how we work →

Read next

More on Automation and integrations

Written on 30 October 2026; it describes the law as FourWinds read it on that date. This is general information about how the rules work, not legal advice on your situation. Where you need a solicitor, we say so. How we check the law.