Top 10 GDPR-Compliant Contact Form Services in 2026

Which GDPR contact form is best for each need?

Each row names the service that wins that need on the details in this page, plus the closest alternative. splitforms wins only where its plan data does.

At-a-glance comparison

Ten contact form services compared on five GDPR criteria: EU data residency, DPA availability on the free tier, native consent-field support, retention-policy controls, and sub-processor transparency. Rows are alphabetical; there is no overall ranking. DPA gating and prices reflect vendor terms as read on September 29, 2026; confirm them with the vendor before relying on them.

For deeper background on what GDPR actually requires for form submissions, see GDPR-compliant form submissions.

How we compared compliance

Marketing pages claim "GDPR-compliant" for any tool that ever signs a DPA. That bar is too low. For this comparison, each tool is described against five criteria a Data Protection Officer would actually ask about:

1. EU data residency. Where the submissions are stored at rest, and whether email notifications route through EU SMTP. US-only vendors aren't automatically out, but they add Standard Contractual Clauses overhead.
2. DPA availability on the free tier. Article 28 makes a Data Processing Agreement mandatory the moment any personal data is processed. Vendors that paywall DPAs effectively lock free-tier users out of compliance.
3. Native consent-field support. A checkbox is trivial to add in HTML — but does the tool log the consent state with the submission, version the consent text, and make it exportable for audit?
4. Retention controls. Auto-delete after N days beats manual purges every time. Indefinite storage by default is a GDPR foot-gun.
5. Sub-processor transparency. Public, dated list of every third party that touches submission data (email relay, analytics, storage). If the page doesn't exist, you can't complete a Transfer Impact Assessment.

Residency, DPA and retention details come from each vendor's own documentation (linked under Sources) and from our reading of their terms; they are not legal advice, and the services are listed alphabetically with no overall score.

Basin

Basin is a Canadian shop (Moonshot Ventures Inc., British Columbia) focused on simple HTML-first form endpoints — closest in philosophy to splitforms. Its GDPR page lists DigitalOcean (hosting and database, Canada), AWS (file storage, US) and Hetzner (backups, Germany) as infrastructure and CleanTalk (spam processing, EU). Basin's docs say a DPA is published at usebasin.com/dpa, but that address returned a not-found page when we checked on October 10, 2026, so ask support for a copy if you need one.

Free is 50 submissions a month on one form with 30-day retention. Starter is $15/month ($12.50 billed yearly) for 250 submissions a month with 365-day retention and per-form retention settings. Its GDPR page says submissions are deleted automatically after 48 months.

Verdict

Good HTML-first ethos and more retention control than most; weaker on residency (no EU primary storage). splitforms vs Basin. Full Basin review.

Cognito Forms

Cognito is the standout for consent UX. The form builder has first-class consent blocks: versioned consent text, separate checkboxes per data-use purpose, and an audit log of which version each submission accepted. Retention presets (30/90/365 days) are built in.

The downside is residency — Cognito is US-only with no EU storage option. They DPF-certify, so SCCs work, but it's extra paperwork. Free tier covers 500 submissions total including a DPA. Paid starts at $19 per month.

Verdict

The strongest consent UX on this list. Pick it if your DPO cares more about consent audit trails and retention presets than EU storage. Otherwise splitforms covers the basics at a lower paid price, with the same US storage.

Formspree

Formspree is a mature US-based service with a well-documented API. Its security page says it is hosted on AWS in the US, completed a SOC 2 Type II audit, and states GDPR compliance through Standard Contractual Clauses. There is no EU residency option, so strict-regulator deployments need a Transfer Impact Assessment.

Pricing: Free is 50 submissions a month; Personal is $15/month ($10/month billed yearly) for 200 a month. We could not confirm from public pages which plan includes a signed DPA, so ask Formspree before relying on it for a commercial site.

Verdict

Workable if you're US-focused or comfortable with SCC-based transfers. For EU-hosted storage, see Tally or Jotform below. Side-by-side: splitforms vs Formspree. Cut-over guide: migrate from Formspree. Full Formspree review.

Formstack

Formstack targets the enterprise and healthcare segment. The HIPAA-compliant tier is real, audit logs are real, and the integrations catalogue is huge. For a plain GDPR contact form it is more than you need — $50/month Starter to get in the door, and EU residency is a paid add-on. DPA is Enterprise-tier.

The consent UI is strong on the HIPAA tier but standard plans default to a manual checkbox, the same as Formspree or Basin.

Verdict

The right tool for regulated industries with budget (HIPAA plus GDPR). Heavier than a marketing-site contact form needs. See our Formstack review for plans and limits.

JotForm EU

Jotform has a European data center in Frankfurt — EU data stays in the EU. It is switched on automatically for accounts created in the EU, and other accounts can move under Settings, Data, GDPR Datacenter. That is one of the strongest residency stories in this comparison, alongside Tally. Jotform also publishes a sub-processor list and says it is certified under the EU-U.S. Data Privacy Framework; HIPAA features start on its Gold plan.

The catch: the free Starter plan is small (5 forms, 100 submissions a month, Jotform branding), and paid plans start at $39/month ($34/month billed yearly) for Bronze. DPA paperwork is on paid plans in our reading of its terms. The builder is feature-rich but the embed is heavy compared to a plain HTML form.

Verdict

A strong choice when you need EU-only storage together with a full form suite (payments, signatures, HIPAA add-ons) and have the budget. More than a simple contact form needs. Migration path: splitforms vs JotForm. Full Jotform review.

Paperform

Paperform is design-led with a strong visual builder, US/AU hosting, no EU residency option, and a DPA gated behind the Agency tier ($199 per month). Consent fields are native and look good. Sub-processor list is published and dated.

Starts at $24/month Essentials.

Verdict

A good fit if visual design is the dominant requirement and you can absorb the residency tradeoff; less so where EU storage or a low-cost DPA matters.

splitforms

splitforms doesn't sell compliance as an upsell. Its DPA is part of the Terms and applies automatically to every account, Free included; the subprocessor list is published; the honeypot and time-trap spam checks set no cookies; and you can delete submissions from the dashboard on any plan, with CSV export on paid plans. A consent checkbox is a normal field in your HTML, stored with the submission.

The free tier is 500 submissions total. Paid is $5/month for 5,000 submissions, or $49/year on Annual for 15,000 a month — the lowest paid price in this comparison. Rule-based spam filtering and the subprocessor list are on every plan, including Free; signed webhooks come with the paid plans.

What's good

• DPA on every plan, Free included — nothing to sign.
• Honeypot spam filter doesn't require cookie consent.
• Delete any submission from the dashboard for erasure requests; export to CSV on paid plans for access requests.
• Public subprocessor list on the GDPR page and in the DPA.

What's missing

• No EU data residency: data is stored in AWS US regions, with Standard Contractual Clauses for EU transfers. An EU-resident option is planned, not live.
• No automatic retention: submissions stay until you delete them, so you have to purge old ones yourself. A custom auto-delete policy is available on request via hello@splitforms.com.
• No consent-text versioning or audit log; the checkbox value you send is stored with the submission.
• No self-hosted edition. If you need full self-hosting, see self-hosted vs SaaS form backend.

Verdict: a low-cost path to a GDPR-ready contact form if US storage under SCCs is acceptable for your use case. If it isn't, choose an EU-hosted service such as Tally or Jotform's EU data center. Start free at splitforms.com/login.

Tally

Tally is a Belgian company (Tally BV, Ghent), and its GDPR page says form data is stored in Europe — on Google Cloud in Belgium, with file uploads on Cloudflare in the EU. Some opt-in features send data to US providers: SendGrid for email notifications and Stripe for payment forms. Professional users accept Tally's Data Processing Agreement with the terms, so there is nothing separate to sign.

The free plan has unlimited forms and submissions under a fair-use policy. Submissions stay until you delete them (deleted ones sit in the Trash for 90 days), and automatic deletion after a set period is a Business feature. Free forms carry a "Made with Tally" badge; Pro is $29 per month.

Verdict

The best pick on this list for EU-hosted storage at no cost. Its spam tooling is a single reCAPTCHA block and retention is manual on lower plans. splitforms vs Tally covers cost differences. Full Tally review.

Typeform

Typeform builds conversational forms but is a heavier GDPR lift for a plain contact form. The embed loads typeform.com assets, sets cookies for session tracking, and pings their analytics endpoints, so a site embedding a Typeform form needs a cookie banner before the embed renders. Standard accounts are hosted on AWS in Virginia, USA; EU data hosting is available only on Enterprise and Growth Custom plans.

Typeform publishes a Data Processing Agreement (updated July 20, 2026) that uses the EU Standard Contractual Clauses and a UK addendum. Consent fields are built in, which is the one bright spot. Basic is $25/month; the free plan allows 10 responses a month.

Verdict

A poor fit for a plain contact form if cookie-banner cleanliness or EU storage matters; a fine fit when the conversational format is the point and your site already has a cookie banner. Compare directly: splitforms vs Typeform. Full Typeform review.

Wufoo

Wufoo is the SurveyMonkey-owned legacy player. The product still works, but the GDPR story is limited: US-only storage, DPA only on Enterprise (custom pricing), no native consent block, manual export for Subject Access Requests. SurveyMonkey's sub-processor list is public, which helps.

Paid starts at $14.08/month for the Starter tier. Free tier is 100 submissions/month with Wufoo branding.

Verdict

Mostly relevant if you're already on the SurveyMonkey stack; for a new GDPR-minded form, the options above cover residency and consent better.

Which one should you pick?

• You need EU-only storage on a budget: Tally (EU-hosted, free plan). Forminit (AWS Ireland) is another EU-hosted backend.
• You need EU-only storage plus a full form suite, and have budget: JotForm with its Frankfurt data center.
• Your DPO is focused on consent audit trails and retention presets: Cognito Forms. Best consent UX in this comparison, but US-hosted.
• You're in healthcare or fintech and need HIPAA plus GDPR: Formstack, or Jotform's Gold plan.
• You're an indie dev, freelancer, or small business under 5,000 submissions per month, and US storage under SCCs is acceptable: splitforms. Free tier, DPA on every plan, dashboard deletion, $5 per month or $49 per year when you outgrow free. Start at splitforms.com/login.
• You're embedding a long survey, not a contact form: Jotform EU or Cognito. Typeform works if your site already has a cookie banner.

Browse more comparisons on the blog index, or look at the best free form backend services for 2026 for a wider lens that isn't GDPR-only.

When is splitforms not the right choice for GDPR?

• You need EU data residency. splitforms stores data in AWS US regions under Standard Contractual Clauses (see the DPA); Tally, Jotform's EU data center and Forminit host in the EU.
• You need automatic retention. splitforms has no auto-expiry for submissions; Cognito Forms has presets, Basin has per-form retention, and Tally auto-deletes on Business.
• You need versioned consent text and an audit log. Cognito Forms covers that; splitforms stores the consent checkbox value you send.
• You need HIPAA or a BAA. Formstack and Jotform (Gold and above) cover that; splitforms does not.
• You need a self-hosted edition. splitforms is hosted only.

How to switch to splitforms

Migration is HTML-only. Change the form's action URL and add a hidden access_key:

<form action="https://splitforms.com/api/submit" method="POST">
  <input type="hidden" name="access_key" value="YOUR_ACCESS_KEY" />
  <input type="text"  name="name"    required />
  <input type="email" name="email"   required />
  <textarea           name="message" required></textarea>
  <input type="checkbox" name="botcheck" style="display:none" tabindex="-1" />
  <button type="submit">Send</button>
</form>

To collect explicit GDPR consent, add a visible checkbox bound to a field name splitforms will log alongside the submission:

<label>
  <input type="checkbox" name="gdpr_consent" value="2026-05-10" required />
  I agree to the <a href="/privacy">privacy policy</a> and consent to my data being stored to respond to this enquiry.
</label>

The value attribute timestamps the consent-text version, so if you update your privacy policy later you can prove which version each submission accepted. Delete submissions older than your retention period on a schedule, then empty the Recycle bin where dashboard deletes land (splitforms has no auto-expiry), keep the splitforms DPA link in your records, and you've covered the basics.

Framework-specific recipes: Next.js form backend, React form backend, Astro form backend. Grab a pre-wired template at /free-contact-form.

Need the migration steps from Formspree, Typeform, or JotForm? See migrate from Formspree and migrate from Typeform. Sign up at splitforms.com/login. API reference: /api-reference. FAQ: /faq.

FAQ

More best-of lists