SurveyMonkey and the GDPR: AI training, data location and DPA

Trains on your data, with no documented way to stop it.

Yes. SurveyMonkey uses de-identified customer data, or synthetic data, to train its own AI models. It says personal data is excluded and the AI providers it uses (such as OpenAI) do not train on the data shared with them.

Vendor's wording: “we use de-identified customer data or synthetically-generated data to train and build our proprietary AI models”

Source: surveymonkey.comFAQs: Is my data used to train AI models?Checked on 19 October 2026

United States by default: if no regional data centre is shown in Account Details, data is on US servers. Depending on plan and region a regional centre (Canada or Ireland) is offered on some plans and regions.

Vendor's wording: “If you don't see anything listed, your data is stored on servers located in the United States.”

Source: help.surveymonkey.comWhere Your Data Is StoredChecked on 19 October 2026

EU hosting not documented.

Enterprise plan only: Enterprise users can choose where some of their data is stored (Ireland, Canada or US). Not described for Team Advantage.

Vendor's wording: “Enterprise users can select the physical location for the storage of some of their data.”

Source: surveymonkey.comFAQs: data centresChecked on 19 October 2026

DPA in the terms.

Yes. An online DPA applies to self-serve customers and contains the EU transfer mechanisms automatically; EEA/UK customers contract with SurveyMonkey Europe UC (Ireland), US customers with SurveyMonkey Inc.

Vendor's wording: “If you are a self-serve Customer, our online DPA contains these transfer mechanisms automatically.”

Source: surveymonkey.comPart I, contracting entitiesChecked on 19 October 2026

Published.

Yes, public at https://www.surveymonkey.com/mp/legal/subprocessor-list/: 21 rows (13 apply to the main SurveyMonkey product). AI providers: OpenAI, Amazon Web Services (Bedrock) and Abacus.ai for SurveyMonkey; Anthropic (professional services) and Google (GetFeedback) for other services.

Vendor's wording: “Cloud hosting and data storage; generative AI technology for SurveyMonkey's AI features (AWS Bedrock)”

Source: surveymonkey.comPart II: Onward Transfers to SubprocessorsChecked on 19 October 2026

On the list.

Active (SurveyMonkey Inc.; EU-US DPF, Swiss-US DPF, UK Extension)

Source: dataprivacyframework.govSearch 'SurveyMonkey'Checked on 19 October 2026

Data is kept while the account is active and the customer controls deletion. Deleted surveys and data are permanently removed from SurveyMonkey's systems after 1 year; deleted accounts likewise after 1 year.

Vendor's wording: “Once deleted from your account, the survey or data won’t be accessible and you may not be able to restore it. The deleted data is permanently removed from our system in 1 year.”

Source: help.surveymonkey.comData Retention and Restoration of Deleted DataChecked on 19 October 2026

3 named: SOC 2 Type II, ISO 27001 (certified since 2019) and PCI DSS. SurveyMonkey also reports Data Privacy Framework self-certification and a HIPAA add-on for Enterprise only.

Vendor's wording: “SurveyMonkey has been ISO 27001-certified since 2019, and SOC 2-certified since 2021.”

Source: surveymonkey.comCertificationsChecked on 19 October 2026

€30 / user / mo.

EUR 30 per user per month, starting at 3 users, billed annually. VAT treatment is not shown.

Vendor's wording: “Starting at 3 users, billed annually”

Source: surveymonkey.comTeam plans, Team Advantage cardChecked on 19 October 2026