Can survey answers be personal data under GDPR?

Article 4(1) of the GDPR defines personal data as "any information relating to an identified or identifiable natural person". Someone is identifiable if they can be identified directly or indirectly, for example by a name, an identification number, location data or an online identifier.

Recital 26 says how to decide. You take account of "all the means reasonably likely to be used, such as singling out, either by the controller or by another person", including the cost and time identification would take and the technology available. Two points follow for surveys:

The ICO adds a limit: a remote, hypothetical chance of identification is not necessarily enough. Ask what is reasonably likely, and ask again as technology changes.

Recital 26 says the data protection principles "should therefore not apply to anonymous information", including for statistical or research purposes. A survey whose answers can't be linked to anyone, by you or anyone else, is outside the GDPR.

Article 4(5) describes pseudonymised data as data that "can no longer be attributed to a specific data subject without the use of additional information", with that information kept separately. A survey that stores respondent 4821 instead of a name, while another table maps 4821 to an email address, is pseudonymised.

The European Data Protection Board's guidelines on pseudonymisation, adopted for public consultation in January 2025, say such data is still personal data, even when the data and the key are held by different people. Deleting the key doesn't settle it either: the data becomes anonymous only if the conditions for anonymity are met.

In EDPS v SRB (C-413/23 P, September 2025), the Court of Justice of the EU looked at consultation comments that were pseudonymised and passed to a consultancy. The case was decided under Regulation 2018/1725, the data protection rules for EU institutions, not the GDPR itself, but three points in its press release are useful for surveys.

Personal opinions and views, "as an expression of a person's thinking, are necessarily closely linked to that person", so a comment relates to its author without anyone analysing what it says. Pseudonymised data is not personal data in every case and for every person: for a recipient with no reasonable way to identify anyone, it may not be. And for the duty to tell people what happens to their data, identifiability is judged when the data is collected, from the point of view of the controller who collected it.

So if you collected answers you could link back to people, the GDPR applies to you, even if the copy you share with an agency is stripped of names.

Most of these come from how the survey is set up and sent, not from the questions.

The IP row rests on Breyer (C-582/14, October 2016), where the Court of Justice of the EU held that a dynamic IP address logged by a website is personal data for the site's operator if the operator has the legal means to identify the visitor with extra information held by the visitor's internet provider. The case was decided under Directive 95/46, the law the GDPR replaced.

"As someone with long Covid, I found this guide too long" tells you about the page and about the writer's health.

Article 9(1) of the GDPR lists special categories, including health, political opinions, religious beliefs and sexual orientation. Processing them "shall be prohibited" unless an exception in Article 9(2) applies, such as explicit consent. Recital 35 says health data covers past, current or future physical or mental health.

If the comment can be linked to its writer, that health detail is special category data. If it can't, the GDPR doesn't apply to it. So keep free text apart from anything that identifies the writer, and put a line above the box such as "Please don't include names, contact details or health information."

If any answer could be linked to a person, the usual GDPR rules apply. Work through these six checks before launch.

If you are unsure about any of these, especially special category data or an old survey that already holds identifiable answers, talk to your DPO or lawyer before you launch.

Asklet is a feedback widget you embed on your pages with one iframe. It stores the answers, the page path and the time, with no name, email, IP address or device details, and it sets no cookies and uses no tracking identifiers or fingerprinting.

Emails and phone numbers typed into free-text answers are removed before storage. Spam protection counts recent answers per network under a code that changes every hour, and the address is never stored. The trade-off: readers can't be contacted or identified through Asklet, so there is no follow-up and no per-person history. Your privacy notice is still yours to write.