How GDPR-compliant surveys on self-hosted tools work in practice
Compliance for a survey comes from the controller's design choices and processes, not from the software that runs it. A LimeSurvey or Formbricks instance can be configured to support GDPR obligations, but the lawful basis, the consent wording, the questions asked, the retention periods and the way access is granted are decisions the controller owns. The GDPR requires no audit, attestation or certificate. Certification under Article 42 is voluntary, issued for at most three years, and does not reduce the controller's responsibility. DeployOpen prepares systems, controls and evidence for an assessment, but it does not issue audit reports or certifications; independent auditors and certification bodies do that work.
The practical starting point is a written record of each survey: why the data is collected, which lawful basis applies, what the consent text says if consent is the basis, which fields are truly necessary, and how long responses are kept. In a self-hosted deployment, the controller also decides where the database and file uploads sit, who holds administrator rights in LimeSurvey or the organization and team roles in Formbricks, and whether single sign-on is needed. Formbricks places OIDC and SAML SSO, teams and access roles behind its Enterprise license, so confirm that licensing against the required access model before design begins. Ask the implementation partner to map each control to a documented decision rather than to a feature toggle.
The legal ground is also still moving. As of October 2026 the GDPR text has not been amended, but the Omnibus IV proposal (procedure 2025/0130(COD)) has a text agreed in negotiations on 26 June 2026 that awaits Parliament's first-reading vote, and the Digital Omnibus proposal (procedure 2025/0360(COD)) awaits committee decision. Regulation (EU) 2025/2518 applies from 2 April 2027 to cross-border enforcement procedures. Build the survey governance so that changes can be made to consent text, retention rules and access lists without rebuilding the instance, and check the current status of these procedures with the organization's data protection officer before each major change.
Which GDPR requirements shape the survey design and how to configure LimeSurvey or Formbricks
This table maps the GDPR obligations that most affect a survey, from controller duties and security of processing to breach notification, transfers and the fine tiers, to the survey behavior each one requires and the LimeSurvey or Formbricks settings to review. Read each row as a design question to answer before the survey goes live, and treat the configuration column as a starting point to validate with your data protection officer.
| Requirement | What the survey must do | Configuration to apply in LimeSurvey or Formbricks |
|---|---|---|
| Controller and processor duties (Articles 24 to 28) | Name who decides why and how responses are collected, and who processes them on the controller's behalf under a written arrangement | Document the controller, the hosting provider and any processor in the record of processing; confirm the survey host's contract terms before collection starts |
| Data protection by design and by default (Article 25) | Collect only the fields the purpose needs and make the most privacy-protective option the default | Remove optional identifying questions, switch off response linking to user accounts or contacts unless needed, and review default response and metadata capture |
| Security of processing (Article 32) | Protect responses in transit and at rest, limit access to people who need it, and keep the platform patched | Enforce HTTPS, restrict admin roles, use SSO where the edition supports it, and set a patch routine for the platform version in use |
| Breach notification (Articles 33 and 34) | Detect a breach of survey data and notify the supervisory authority and, where risk is high, respondents within the set deadlines | Enable server and admin audit logging, forward logs to your monitoring stack, and write a runbook that names who decides on notification |
| Transfers to third countries (Chapter V) | Know where responses are stored and which integrations send data outside the EU or EEA | Choose EU hosting for the survey database, audit each webhook, export and third-party integration, and document any transfer mechanism that applies |
| Principles and lawful basis (Article 83 top tier, Articles 5 and 6) | State a purpose and a lawful basis, and avoid processing beyond that purpose; violations of these principles sit in the higher fine tier | Write the consent or information text per survey, keep consent records where consent is the basis, and block data reuse for other purposes |
| Data subject rights (Articles 12 to 22, Article 83 top tier) | Answer access, rectification, erasure and objection requests within the time limits | Make responses findable by a respondent identifier, set up an export and deletion procedure, and test it on a sample response before launch |
| Obligations tied to lower fine tier (Article 83, Articles 25 to 39) | Meet controller and processor duties such as records, impact assessment and security measures | Keep configuration records, run a data protection impact assessment for sensitive surveys, and retain change logs of survey settings |
LimeSurvey or Formbricks: which self-hosted platform fits which survey program
LimeSurvey and Formbricks solve different survey problems, and the GDPR obligations follow the program design more than the tool. The cards below compare licensing, versions, database and runtime requirements, edition limits and the access and audit features that a data protection review will ask about.
LimeSurvey licensing and runtime
LimeSurvey is licensed under GPL v2.0 with the option to use any later GPL version, so you can self-host the Community Edition without a subscription. It requires PHP 8.1.29 or later with mbstring and PDO drivers, plus a supported database such as MySQL 8.0, PostgreSQL 14, MariaDB 10.3.38 or MSSQL 2019 or later. Confirm these versions against your hosting image before you plan the data location and backup scope, because they define where respondent data sits.
LimeSurvey version and end of support
The older 6.17.19 release reached end of support on August 31, 2026, so any LimeSurvey deployment still on that line has no supported security fixes for respondent data. LimeSurvey Community Edition 7.6.0 is the current stable release and should be the baseline for a new program. Build the upgrade path into the implementation plan and record the version in your processing records.
LimeSurvey question types and export
LimeSurvey supports more than 30 question types and multilingual surveys in more than 80 languages, which suits public and multinational programs. Export plugins such as ExportR and ExportSTATAxml move responses into analysis tools, and every export is a copy that falls under your retention and deletion rules. Ask who may export, where files are stored, and whether exports carry identifiers.
Formbricks core and Docker self-hosting
The Formbricks core application is licensed under AGPLv3 and can be self-hosted with Docker without a subscription, with a Helm chart for cluster hosting. Its Community Edition covers unlimited surveys, responses and users, full API access, website, app, link and email surveys, and webhooks. Because it is built around in-app and website feedback, it fits programs that trigger surveys from a product rather than from a mailing list.
Formbricks Community Edition limits
The Community Edition is limited to one workspace, so a program that separates teams, business units or data controllers into different workspaces will need a different design or the Enterprise license. Private forks must be released under AGPLv3 unless an Enterprise license covers the code. Have legal review the fork and workspace model before you assume one installation can hold several separated processing activities.
Access control and audit trails
OIDC and SAML single sign-on, teams and access roles, segments, contact management and audit logs are Enterprise features in self-hosted Formbricks, and they are the controls a data protection review usually asks for. Without them, you must document access by other means, such as tight infrastructure accounts and separate hosting. Confirm which controls your program needs before you choose the edition, and map each one to the access rules in your records of processing.
Choosing a lawful basis and writing consent text that holds up
The lawful basis is a decision the controller makes for each survey purpose, not a setting the survey tool makes for you. Under the GDPR, the controller must identify a basis under Article 6 before collecting responses, and a single project can need different bases for different purposes, such as a research questionnaire, a service feedback form and a marketing opt-in. LimeSurvey and Formbricks will record what you tell them and store the consent evidence you configure, but neither product determines whether consent, legitimate interests or another basis applies. Document the decision per survey in your records of processing before the first response is collected, and have your data protection officer confirm it.
When consent is the basis, the consent text has to be specific, informed and separable from other terms. In LimeSurvey, place the explanation on the welcome screen or in a mandatory first question that states the purpose, the controller, the retention period and how to withdraw. Keep the consent question as its own item rather than bundling it with terms of use, and make the participant take an affirmative action such as ticking an unticked box. In Formbricks, use the consent or hidden-field logic in the survey and link a full privacy notice from the introduction. Test each path, including the decline path, so that respondents who refuse are routed out without receiving the questionnaire. Confirm the exact legal wording with your data protection officer, because the wording must match your actual processing, your jurisdictions and any sector rules.
Which survey design questions trigger the most GDPR risk
Which survey questions should I cut to stay within data minimization?
Collect only the data each question needs for a stated purpose, and remove any question whose answer you cannot tie to that purpose. Article 5(1)(c) of the GDPR requires personal data to be adequate, relevant and limited to what is necessary, so every field is a decision you must justify. In LimeSurvey, use an attribute or hidden question only where a report needs it, and avoid asking for date of birth, full address or employer when a range or region answers the question. Document the purpose of each question in your processing record, and review the list before launch because survey drafts tend to accumulate fields copied from earlier surveys.
Should responses be anonymous or identified, and what about pseudonymous IDs?
Choose anonymous collection when you do not need to link answers to a person, and identified collection only when a follow-up or consent record requires it. Pseudonymous IDs sit between the two: the response carries a random token instead of a name, but you can still re-link it using a separate mapping table, so the GDPR still applies. In LimeSurvey, disable "Save IP address" and avoid participant tokens when anonymity is promised. In Formbricks, avoid passing contact attributes or user IDs in hidden fields unless analysis needs them. Record the decision, who holds any mapping key, and how the key is destroyed.
How do special category data questions change the GDPR requirements?
Questions about health, religious beliefs, political opinions, sexual orientation, trade union membership or genetic and biometric data fall under Article 9, which prohibits processing unless a specific exception applies. Explicit consent is the most common route, but you must still show a lawful basis under Article 6 and a condition under Article 9. Avoid these questions unless the survey cannot meet its purpose without them. Where you do collect them, separate them into their own survey or section, restrict access to named roles, set a shorter retention period, and state the condition you rely on in the consent text and your record of processing.
Why do free-text fields create the most unexpected personal data?
Free-text answers invite respondents to type names, email addresses, account numbers and health details that you never asked for, so they are often the largest source of unplanned personal data. Limit length where the question allows, and place a clear notice above the box asking respondents not to include personal details. Review exports for identifiers before sharing results, and consider a text-analysis step that masks emails and phone numbers. Ask your team to confirm who can read raw text fields, because a free-text answer that identifies someone is still personal data even if the rest of the response is anonymous.
How long should survey responses be kept, and how is deletion configured?
Retention must be the shortest period that serves the stated purpose under the storage limitation principle in Article 5(1)(e), and you must set and document it before collection starts. Decide the period per survey, then configure deletion rather than relying on manual clean-up. LimeSurvey supports deleting responses and their data through its administration tools and scheduled tasks, while Formbricks lets you delete responses and contacts from the console and through its API. Confirm with your implementation partner how deletion reaches backups, exports, webhook targets and integrations such as Slack or Zapier, because copies outside the survey tool are often missed.
How do respondent rights requests work on a self-hosted survey tool?
Respondents can ask for access, rectification, erasure, restriction and objection under Articles 15 to 21, and you must answer within the deadlines in Article 12. Self-hosting does not change this duty, so you need a written procedure that names who receives requests, how the respondent is verified, and how the data is located. Search by contact ID, token or email where those fields exist, export the response in a portable format, and delete or correct it across the survey database, backups and integrations. Record each request and the outcome. Confirm with your partner which steps are manual and which the platform's API can automate.
Does the GDPR require a specific survey consent text?
The GDPR does not prescribe wording, but consent must be freely given, specific, informed, unambiguous and withdrawable under Article 7 and the conditions in Article 4(11). Name the controller, the purpose, the categories of data, the retention period, the recipients and the respondent's rights, and place the consent statement before the first question. Use an affirmative action such as an unticked checkbox, and do not bundle consent with terms of use. Keep a record of the version shown to each respondent. Have your data protection officer or legal counsel review the final wording, because the text should match the lawful basis you have actually chosen.
Setting retention, deletion and respondent request handling
This sequence turns the GDPR's storage limitation and data subject rights into concrete settings, roles and records on your self-hosted survey tool, so each response has a known lifespan and every request has an auditable answer.
Set a retention period for each survey
The survey owner, with the data protection officer, writes down how long responses are kept, why that period is needed for the stated purpose, and what happens at the end (deletion, anonymization or archive with a stated legal basis). The retention rule is recorded in the survey's project file before the survey goes live. Done means every active survey has a named owner and a written retention period that the team can point to during an audit or a complaint.
Limit access with roles before collection starts
The administrator assigns access roles in LimeSurvey or Formbricks so that only the people who need responses can view or export them. Survey editors, analysts and viewers should be separate roles, and single sign-on or user management should be checked against the approved identity list. Confirm in your edition which roles and identity options are available, since some Formbricks identity and access features sit under the Enterprise license. Done means a role matrix exists and a test account confirms what each role can see.
Configure export and scheduled deletion
The administrator sets up response export to the approved storage location, limits who can run exports, and applies the retention rule by deleting or anonymizing responses when the period ends. Exports are copies, so each export file needs its own location, owner and deletion date. Done means a test survey shows that the deletion step removes responses from the live tool and that the export folder follows the same rule.
Plan deletion in backups and exports
The infrastructure team documents how database backups, snapshots and copies held by analysts are handled when a respondent asks for erasure. Backup retention cycles and restore procedures should be written down so that deleted data is not restored into live use without a check. Ask your hosting provider or internal backup team to confirm how long backups persist and how a restore would re-apply deletions. Done means a signed backup note explains the gap between deletion in the live tool and deletion in backups.
Route access, rectification and erasure requests
The privacy team publishes a single contact point on the survey's privacy notice and a short internal procedure. When a request arrives, staff identify the respondent's responses (often by a unique link, token or contact identifier), check the request against the legal basis, and either act or record the reason for refusing. Confirm the response time your own policy requires. Done means every request has a ticket with the request type, the search result, the decision and the date the action was completed.
Confirm the account status and response access after subscription changes
If you use LimeSurvey Cloud, the team checks what happens to collected responses when a paid subscription expires. The LimeSurvey pricing page states that the account falls back to the Free package and keeps access to collected responses, which means data may remain in the provider's service after a plan change. Confirm with the provider how long responses stay available and whether deletion can be requested. Done means the retention register records the provider's answer and the date it was confirmed.
Log each action and review the register
The survey owner records every retention action, export, deletion, access change and respondent request in a log that can be shown to a data protection authority or auditor. Logs should note who acted, when, and on which survey, without copying the personal data itself. Audit log features may depend on your edition, so confirm what is recorded natively and what must be kept in a separate system. Done means a periodic review of the log against the retention register finds no unexplained gaps.
What tooling alone does not satisfy under the GDPR
A self-hosted survey tool gives you control over where responses sit, but the GDPR assigns duties to the controller that no software setting can perform. The cards below cover the organizational work that remains after LimeSurvey or Formbricks is installed, and each one needs a named owner and written evidence.
Record of processing activities
Article 30 expects the controller to keep a written record for each survey: purpose, categories of respondents and data, recipients, transfers, and retention periods. The tool holds the responses but cannot describe why you collect them or who receives them. Check that every survey, including the integrations that forward responses to other systems, appears in the record before launch.
Lawful basis decision
Each survey needs a documented lawful basis under Article 6, and consent is only one option. Choosing consent, legitimate interests or another basis is a legal judgment made by the controller, and the survey platform cannot make it for you. Write the basis down per survey, and check that the consent text, where used, matches the processing you actually run.
Data protection impact assessment
Where a survey is likely to create high risk, such as large-scale profiling, sensitive topics or vulnerable respondents, Article 35 requires a data protection impact assessment before processing starts. The assessment weighs necessity, risks to respondents and mitigations, and it must be reviewed when the survey changes. Ask your data protection officer early whether your survey design triggers it.
Processor contracts with hosts
When you self-host on your own infrastructure, you still need written terms with any cloud, data center or managed-service provider that stores or can access responses, as set out in Article 28. Confirm who can reach the database and backups, where they are located, and what sub-processors are involved. If you use a vendor's cloud edition instead, the same contract duty applies to that vendor.
Breach response under Articles 33 and 34
A breach affecting survey responses requires notice to the supervisory authority within 72 hours of becoming aware of it under Article 33, and notice to affected respondents in high-risk cases under Article 34. The tool may log access events, but your incident team must decide severity, timing and wording. Write the playbook, name the decision makers, and rehearse it with the platform administrators.
Access governance and staff training
Administrators, survey designers and analysts often see identifiable answers they do not need. Define who holds admin, editor and export rights, review them on a set schedule, and remove leavers promptly. Train staff on minimization and on handling respondent requests, because a well-configured tool still fails when a designer adds a free-text field asking for national identifiers.
Pending procedural and Omnibus changes
Regulation (EU) 2025/2518 sets additional procedural rules for cross-border enforcement and applies from 2 April 2027. The Omnibus IV and Digital Omnibus proposals are still in the legislative process, so the GDPR text has not changed as of October 2026. Assign someone to track these files and record how each change would affect your survey procedures.
Evidence auditors and supervisory authorities ask for on a survey program
This table lists the records an assessor or supervisory authority is likely to ask for on a GDPR survey program, and which component or role produces each one. Use it to assign owners before fieldwork starts, since most gaps come from evidence nobody was asked to keep. DeployOpen prepares systems and records for review, but independent assessors and supervisory authorities decide what is sufficient.
| Evidence artifact | What it shows | Produced by | Where it usually fails |
|---|---|---|---|
| Record of processing entry | Purpose, categories of respondents and data, recipients, retention period and security measures for each survey | Process owner (controller), with DPO review | Entry exists but does not match the survey actually live in LimeSurvey or Formbricks |
| Lawful basis documentation | Which Article 6 basis applies to each survey and why, including any legitimate interest assessment | Process owner and DPO | Basis chosen once for a program and never revisited when questions change |
| Consent text versions | The exact wording shown to respondents, with dates and the survey version it appeared in | Process owner; stored as exports from the survey configuration | Only the current text is kept, so earlier responses cannot be tied to the wording they saw |
| Survey configuration export | Questions, mandatory fields, identifiers, hidden fields and anonymization settings at a point in time | LimeSurvey or Formbricks export, retained by the hosting team | Edits made in the live tool after launch with no saved copy of the earlier state |
| Retention schedule and deletion logs | How long responses and metadata are kept, and proof that scheduled deletion ran | Process owner sets schedule; hosting team or platform administrator produces logs | Schedule written down but no record that deletion or backup expiry actually happened |
| Access role list | Who can view, export or administer each survey, and when access was granted or removed | Platform administrator from user and role configuration; identity provider logs if SSO is used | Shared admin accounts, and former staff still holding export rights |
| Respondent rights procedure and request log | How access, erasure and objection requests are received, checked and answered, with timestamps | Process owner, with support staff and platform administrator for execution | No single intake point, so requests arrive by email and are never matched to response records |
| Hosting and processor agreements | Contracts covering where the servers sit, who operates them and what sub-processors are involved | Legal team with the hosting provider or in-house infrastructure team | Integrations such as webhooks or chat tools transfer data to a third party that is not in the contract chain |
| Security and breach procedures | Hardening baseline, backup handling, and the steps and contacts for reporting a personal data breach | Hosting team for controls and backups; process owner for the breach runbook | Runbook written but not tested, and no clear owner for the 72-hour notification decision |
What do buyers ask before hiring help for GDPR survey compliance?
How much does GDPR survey compliance work cost?
The cost depends on the written scope, and DeployOpen does not publish a price list, so a quote follows from the agreed scope. The main cost components are the implementation work on the survey platform, the design review of each survey, the integration work for any tool that receives responses, and the documentation your data protection officer needs. Most of the spend is one-time, while hosting, licences for any paid edition, and ongoing support or retainers recur. Ask each quote to separate these lines, state which surveys and integrations are covered, and name what is excluded. Costs rise with the number of surveys, special category data, and the number of connected systems. For subscription comparisons, the published LimeSurvey Cloud and Formbricks Cloud prices are a useful reference point, but they do not include the compliance work itself.
How long does a GDPR survey compliance engagement take?
Duration depends on scope, so no fixed timeline applies to every project. The phases usually include a review of current surveys and data flows, drafting of consent and information text, configuration of retention and access settings, testing, and handover of documentation. Timing expands when many surveys need individual design review, when special category data requires a stricter setup, or when an integration needs new contractual or technical controls. Ask for a phased plan with milestones in the written scope, and confirm which items depend on your legal team's sign-off, since those decisions can take longer than the technical work.
What does our team need to provide before work starts?
The engagement needs access and decisions from your side. Typically this includes an inventory of existing surveys and forms, the purpose and audience of each one, the questions asked, and the data currently collected. You should also name the controller and the decision makers for lawful basis, retention periods and respondent request handling. Technical inputs include hosting location, identity provider details if staff log in through SSO, and a list of connected tools such as spreadsheets, CRMs or automation platforms. Your data protection officer should confirm the legal positions, because DeployOpen prepares systems and evidence but does not decide the legal basis for your processing.
Can our internal team handle GDPR survey compliance alone?
An internal team can do much of this work if it has people who understand both the survey platform and data protection requirements. The platform side covers installation, PHP and database requirements for LimeSurvey, or Docker and Helm setup for Formbricks, plus access control and backups. The legal side covers lawful basis, consent wording, and deciding how long each dataset is kept. Teams often underestimate the operations side, such as patching, upgrades and export handling for an edition that is no longer supported. Ask yourself whether you can staff those roles for the life of the platform. If not, a partner can take on part of the build while your team keeps the decisions it must own.
How does fixed-scope pricing work for survey compliance projects?
Most DeployOpen engagements are fixed-scope, which means the scope, deliverables and timelines are agreed in writing before work starts. The written scope should list the platform and edition, the number of surveys in scope, the question types and special category content, the integrations, the documentation to be produced, and the acceptance criteria. Changes after signing are handled through a written change to that scope. Ask whether surveys added later are priced separately, and whether post-launch support is a retainer or a separate agreement, so the boundary of the fixed scope is clear.
What makes the effort go up or down for a survey project?
Effort rises with the number of surveys and questions, because each survey needs a review of its purpose, its questions and its consent text. Special category data, such as health, political opinion or trade union membership, requires a stricter design, tighter access roles and a narrower retention schedule. Integrations add effort when responses leave the survey platform, since each transfer needs a documented purpose, a processor agreement where applicable, and checks on where the receiving service stores data. Multilingual surveys add translation review of consent text. Effort falls when surveys are reused from a template, when response data is minimized at the design stage, and when the list of connected tools is short and well documented. For example, an illustrative project with ten surveys and one integration will generally require less review than a project with fifty surveys and several transfers to outside services.
Does DeployOpen issue GDPR certifications or audit reports?
No. DeployOpen prepares systems, controls and evidence for compliance assessments, but it does not issue audit reports, attestations or certifications. The GDPR itself requires no audit, attestation or certificate. Certification under Article 42 is voluntary, is issued by accredited certification bodies or supervisory authorities for at most three years, and does not reduce the controller's responsibility for compliance. Your data protection officer or an independent assessor should decide whether any formal assessment is needed. Ask a partner to show the evidence it will produce, such as configuration records, data maps and retention settings, so your assessor can review them.
Which parts of the GDPR should we confirm with our legal team first?
Before the technical build, confirm the lawful basis for each survey, the wording of any consent or information notice, the retention period for each dataset, and the process for handling access, correction and deletion requests. Also confirm whether any survey collects special category data, and where responses are hosted. Note that the GDPR text has not been amended as of October 2026, while the Omnibus IV proposal and the Digital Omnibus proposal are still moving through the EU legislative process, so ask your counsel to track both. Regulation (EU) 2025/2518 applies from 2 April 2027 to cross-border enforcement procedures, which may affect how a complaint is handled.
How DeployOpen scopes, deploys and documents a GDPR survey program
DeployOpen works from a written, fixed scope. Before any work starts, the scope document names the platform (LimeSurvey or Formbricks), the survey types in use, the hosting location, the identity provider, the integrations that receive respondent data, and the deliverables. Changes to that scope are agreed in writing and priced separately, so the controller knows exactly what has been built and what has not. The controller remains the party that decides why and how respondent data is processed, and that decision should be recorded in the scope before the first survey goes live.
Deployment planning covers the decisions that determine GDPR exposure. On LimeSurvey, that means the database engine, the survey-level settings for anonymized responses, the access roles for administrators and reviewers, and the export and plugin set. On Formbricks, it means the self-hosted deployment through Docker or the Helm chart, the decision on whether features such as SSO, access roles and audit logs are needed (which sit behind the Enterprise license), and how webhooks are restricted to approved destinations. DeployOpen hardens the server, sets up encrypted backups and access logging, and documents each setting with its reason. Confirm with the platform vendor which hardening options your edition exposes, because the Community and Enterprise feature sets differ.
Documentation is where the evidence for an assessment is built. DeployOpen can prepare a control register that maps each configuration to the GDPR obligation it supports, such as Article 32 on security of processing, along with retention settings, the record of processing activities inputs, and the runbook for handling access requests and deletion. Optional security testing of the survey application can be scoped separately to check authentication, authorization and data exposure. DeployOpen does not issue audit reports, attestations or certifications, and it does not hold the controller's legal responsibility. Independent auditors, supervisory authorities and certification bodies make those judgments. Ongoing upgrades, patching and support run under a retainer, which should be priced against the platform's release cycle and the support terms you agree.
