The problem most EU businesses don't know they have
If you're using Typeform, Google Forms, JotForm, or Wufoo to collect data from EU citizens, there's a good chance you're violating GDPR without realizing it.
Here's why: these tools are operated by US companies. Even when they claim to store data in European servers, the parent company is subject to US law — specifically, the CLOUD Act (Clarifying Lawful Overseas Use of Data Act).
The CLOUD Act allows US law enforcement to compel US companies to hand over data stored anywhere in the world, including on European servers. This directly conflicts with GDPR's requirements for data protection.
What the law actually says
GDPR Article 48 states that any judgment of a court or tribunal of a third country (like the US) requiring a data controller or processor to transfer personal data shall not be recognized or enforceable unless based on an international agreement.
In simpler terms: if a US court orders Typeform to hand over your form data, Typeform is legally obligated to comply under US law — but doing so would violate GDPR under EU law.
This isn't theoretical. The Schrems II ruling (July 2020) invalidated the EU-US Privacy Shield precisely because of this conflict. Since then, EU Data Protection Authorities have been actively enforcing against US data transfers.
What this means for your forms
If your forms collect any personal data from EU residents — names, emails, phone numbers, health information, financial details — you need to ensure that:
- The data is stored in the EU — on servers physically located in an EU member state.
- The data processor is an EU entity — not a US company with EU servers, but an actual EU-incorporated company.
- No US subprocessors have access — every link in the chain must be EU-based.
- You have a Data Processing Agreement — a legally binding document outlining how the processor handles your data.
Who is most at risk?
Industries that handle sensitive personal data face the highest compliance risk:
- Healthcare — patient intake forms, medical questionnaires, consent forms
- Legal — client intake, case evaluation forms, document requests
- Human Resources — job applications, employee surveys, onboarding forms
- Financial services — KYC data collection, risk assessments, account applications
- Government contractors — any form collecting citizen data
If you're in one of these sectors and using a US-based form builder, you should treat this as an urgent compliance issue.
What to look for in a GDPR-compliant form builder
When evaluating alternatives, check for:
- EU data residency — data stored on servers in the EU, not just "EU regions" of a US cloud provider
- EU-incorporated company — the legal entity operating the service should be based in the EU
- No US subprocessors — verify the entire processing chain
- Data Processing Agreement — should be available without having to ask
- Right to deletion — you should be able to permanently delete all form data
- Data portability — export your data in a standard format at any time
The solution
FormGuard was built specifically for this problem. Every piece of form data is processed and stored exclusively on EU infrastructure in Frankfurt, Germany. The hosting provider is EU-incorporated (Lithuania). No form data is ever transmitted to any US-based service.
This isn't a feature we bolted on — it's the foundation of the product.