Google Forms data privacy: where your responses actually go

Last updated September 2026 · ~10 minute read

Short answer: every response is written to the form's own response store, and if you have linked a spreadsheet, a second copy is written there. Identity is not collected by default on a personal Google account — it is a setting you turn on — and of the three settings that force respondents to sign in to Google, only one records who they are. Uploaded files land in the form owner's Drive. Everything past that point depends on whose account the form lives on and what your organisation has configured.

This page sticks to what Google publishes, quotes it, and is explicit where Google publishes nothing. It is not legal advice, and it deliberately does not tell you whether any of this satisfies GDPR, HIPAA, FERPA or anything else — that depends on your jurisdiction, your role and your organisation's own agreements, and it is a question for the people who advise you.

A response is written to two places, not one

The mental model most people have is that responses live “in the spreadsheet”. They do not, or rather they do not only. Google's Apps Script reference states it plainly under Form.removeDestination(): “All forms, including those that do not have a destination set explicitly, save a copy of responses in the form's response store.”

So the form always keeps its own copy. A linked Google Sheet is a destination — an additional copy, populated as responses arrive, with a consequence people meet at the worst moment: unlinking the sheet does not claw the data back. Google says so in the same place: “The unlinked former destination still retains a copy of all previous responses.”

Count your stores before anything else. A form with a linked sheet that someone exported to CSV and emailed on is four copies, three of them outside Google Forms' control — and a Sheet keeps version history, which holds rows after they are deleted from the current view.

Identity is a decision, and it is not the same as sign-in

Three settings make a respondent sign in to a Google account before they can submit:

• Collect email addresses set to Verified — the address is read from the signed-in account.
• A file upload question — “To answer this question, responders need to sign in to a Google Account.”
• Limit to 1 response — Google's tip is “To access and fill out the form, users must sign in to their Google Account.”

Only the first of those records an identity against the response, and Google says so directly. Under the heading “Limit users to one response” on Publish & share your form, immediately after that sign-in tip, it adds: “Their usernames won't be recorded unless you turn on the “Responses” setting to collect email addresses.” That sentence is scoped to the one-response setting rather than offered as a general rule, but it names the distinction exactly. Forcing a sign-in and recording who answered are different switches, and the confusion runs both ways: owners who believe they hold identities and do not, and respondents who assume that signing in has named them.

Which value your form started on depends on the account. Google's Forms API reference documents DO_NOT_COLLECT as the “Default value if the form owner uses a Google account” and VERIFIED as the “Default value if the form owner uses a Google Workspace account”. A form built on a work or school account has most likely been recording verified addresses since the day it was made. Check rather than assume.

The two neighbouring questions are covered in full elsewhere: how to make a Google Form anonymous, including what turning collection off does not guarantee, and how to see who responded.

Uploads leave the form and land in your Drive

A file upload question does not store the file with the response. Google's Choose a type of question for your form says “For the form owner, uploaded files are stored in a new folder on Google Drive” — and, on the same page, “To answer this question, responders need to sign in to a Google Account.” The response itself holds only a pointer: the API describes a file upload answer's fileId as “Output only. The ID of the Google Drive file.”

Two consequences follow. They are copies you own, and Google's storage rule is that “Only the files you own count toward your Google storage” — so an upload consumes the owner's quota, not the respondent's. Google does not spell that out on the Forms pages; the ceilings are in Google Forms file upload limits. And the files sit in a Drive folder governed by Drive's sharing rules, not the form's: share that folder, or put it in a shared drive, and the uploads follow those permissions instead.

Where Google publishes nothing

A page that lists only what is documented is misleading by omission. These are questions we have checked repeatedly against Google's own pages and found unanswered — not answered badly, just not addressed.

• De-duplication. Google does not publish any statement that Forms detects or removes duplicate submissions. What the responses list actually shows.
• Deleting responses through the REST API. The forms.responses resource documents get and list and nothing else — there is no delete method. The routes that do exist.
• Deleting a row in the linked spreadsheet. No Google page states what that does to the copy in the form's response store.
• Uploaded files when a response is deleted. The file-upload help page does not mention deletion, and the Apps Script note about surviving copies is scoped to “an external response destination (like a spreadsheet)”. Assume the Drive file is still there until you have looked.
• Per-question redaction of a shared summary. There is no documented way to publish the results summary with one question hidden; it is all questions or none. What each sharing route hands over.

Before you collect anything sensitive

These are questions to ask, not rules to follow. The right answers depend on your jurisdiction, your organisation's policies and the agreements it has already signed — none of which we can see from here.

1. Whose account owns the form? That decides whose Drive holds the uploads, whose admin console governs the data, and who keeps it when the builder leaves.
2. Do I need identity at all? If the analysis works without an email address, collecting one creates an obligation you did not have to take on.
3. How many copies will exist a month from now, and who can open each? Count the linked sheet, the exports, the notification emails and anything an add-on writes. Editors see every response, and the linked sheet has its own sharing list that does not track the form's.
4. What is the plan for deleting it? Decide before the first response arrives, while it is still a design choice rather than a cleanup.
5. Does the wording promise more than the settings deliver? “This survey is anonymous” above a question asking for a staff number is a promise the settings cannot keep.
6. Who signs off? If any answer above is “I am not sure”, that is a question for whoever handles data protection where you work — before you send the link.

If the answer to the second question is that you do need identity, and the form is asking people to agree to something rather than simply to answer it, the record Google keeps is narrower than most people expect: building a consent form in Google Forms covers what a required question and a description can capture, and what Google stores when someone agrees.

What Google publishes for Workspace customers

Everything above applies to any form. If the form lives on a work or school account, there is a second layer belonging to the organisation rather than to you. None of it exists behind a personal @gmail.com account, because there is no admin console there.

A data processing addendum

Google publishes the Cloud Data Processing Addendum (Customers), which states that it “is incorporated into the Agreement(s)… between Google and Customer” and notes that it “was formerly known as… the ‘Data Processing Amendment’ under an Agreement for Google Workspace or Cloud Identity”. The customer there is the organisation, not the person who built the form.

It is not automatically in force for everyone. Google's privacy compliance page puts it conditionally: “You only need to opt in to the Cloud Data Processing Addendum (CDPA) if your Google Workspace or Cloud Identity agreement does not already incorporate the CDPA (or the DPA) by reference.” Whether yours does, and what it covers, is a question for whoever signed it.

Data regions — and Forms is on the list

Workspace has a policy for storing covered data at rest in a chosen region. Google's list of data covered by data regions names Google Forms in its own row, describing the covered data as “Text, embedded images, responses, and draft responses” and ticking it in the at-rest column. Read the whole row, though: the table has a second column for data covered during processing, and Forms is not ticked in it.

It is edition-gated, and it comes in tiers. Google's Choose a geographic location for your data lists the supported editions as “Frontline Starter, Frontline Standard, and Frontline Plus; Business Standard and Business Plus; Enterprise Standard and Enterprise Plus; Education Standard and Education Plus; Enterprise Essentials Plus”. Google also separates fundamental from enterprise data regions, so the tier varies within that list. If your edition is not on it at all, the control is not available to your admin.

Retention and Vault

Google Vault handles retention rules, holds and export. Its supported services and data types page does mention Forms — but read how. It appears once as a Drive file, in “Versions of files in Google Docs, Sheets, Slides, Forms, new Sites, Drawings, Vids, and Pics”, and once as mail traffic, in “Forms—Email messages containing forms or links to forms”. That is the form as a document and the emails about it. Nothing on the page addresses form response data — Google is silent there rather than negative. Check with your admin rather than assume a retention rule reaches responses. Google Forms itself offers no built-in retention or auto-expiry setting.

What Forms+ does about this

Forms+ is a native iPhone and iPad client that signs in to your own Google account and works on the forms already in your Drive through the official Google Forms API, rather than copying responses to a separate server. Two of its features are relevant here.

Find a person's data (GDPR) searches one open form for everything tied to a person: type an email address or any answer text, and it matches respondent names and answer values, lists the matching responses, and can export them as a text file through the share sheet. It is scoped to the form you have open, so a request spanning several forms means running it once per form — and it only reads; it has no delete action. What you type is never sent to our analytics.

Redact personal info on export (on newer installs) is a switch stored on your device. With it on, exports are masked before they leave the app: emails, social security numbers, dates of birth, IP addresses, Luhn-valid card numbers, phone numbers, credential-shaped answers, and whole answers to questions whose titles look sensitive. It covers the CSV and XLS exports, the PDF report, the gradebook CSV and the subject-data export above — which can also export unmasked, since a verified request often needs that. It does not cover name badges, certificates, Drive backups or a synced Sheet, and the app says so on each screen. It is pattern matching, so it asks you to acknowledge that it is best effort: read the file before you send it.

The access itself is revocable without our involvement, which matters if you are the person who has to answer for which third parties can read a form. Forms+ reads your forms through your own Google account rather than holding them on a server of ours, and you withdraw that access from your Google account’s security settings, not from us. Our support page says so in those words, next to the address to write to if you want it confirmed in writing.

Frequently asked questions

Where are Google Forms responses stored?

In the form's own response store. Google states that “All forms, including those that do not have a destination set explicitly, save a copy of responses in the form's response store.” If you have linked a spreadsheet, a second copy is written there as well.

Does unlinking the spreadsheet remove the responses from it?

No. Google's Apps Script reference says “The unlinked former destination still retains a copy of all previous responses.” Unlinking stops new responses arriving; it does not remove the ones already there.

Does Google Forms collect email addresses by default?

It depends on the account that owns the form. Google's API reference documents “Do not collect” as the default for a personal Google account and “Verified” as the default for a Google Workspace account.

Does making respondents sign in mean I can see who they are?

No. Under “Limit users to one response”, Google writes: “Their usernames won't be recorded unless you turn on the “Responses” setting to collect email addresses.” Forcing a sign-in and recording an identity are separate settings; only Collect email addresses records one.

Whose Google Drive do uploaded files go to?

The form owner's. Google documents that “For the form owner, uploaded files are stored in a new folder on Google Drive”. Since Drive counts “only the files you own” toward storage, they consume the owner's quota, not the respondent's.