--- title: "GDPR and employee surveys - compliance guide | Sparkbay" description: "What the GDPR requires when you survey employees in Europe, and how Sparkbay meets each obligation as your processor." url: "https://sparkbay.com/en/gdpr" language: "en" --- Compliance # Employee surveys and the GDPR ## What the GDPR requires when you survey your employees in Europe, and how Sparkbay protects their data as your processor. - ISO/IEC 27001 certified - Hosted in Quebec - Hosted in Canada - Hosted in Europe - Hosted in Canada or Europe - Results by group, never by person [Schedule a demo](https://sparkbay.com/en/request-demo) [Talk to our team](https://sparkbay.com/en/contact-form) ![Two groups compared on one engagement driver and each of its questions](https://sparkbay.com/content/images/feature-compare-bg.png) [Obligations](https://sparkbay.com/en/gdpr#obligations) · [How Sparkbay helps](https://sparkbay.com/en/gdpr#sparkbay) · [Employee rights](https://sparkbay.com/en/gdpr#rights) · [FAQ](https://sparkbay.com/en/gdpr#faq) Obligations ## What the GDPR requires for an employee survey ### Survey answers linked to a person are personal data, and your organization is their controller. ### Choose a legal basis Every processing needs a legal basis. At work, consent is rarely freely given, because of the imbalance of power, so employers often rely on their legitimate interests. ### Inform employees Before the survey opens, tell employees who processes their data, for what purposes, on what legal basis, for how long, and what their rights are. ### Collect only what you need Collect only data that is adequate, relevant and limited to the survey's purpose, and keep it no longer than that purpose requires. ### Take care with special categories Health, ethnic origin, religion, trade union membership and sexual orientation are special categories of data, which may be processed only under strict conditions. ### Sign a processing agreement A survey provider that processes data on your behalf is a processor, and Article 28 requires a contract that sets out its obligations. ### Secure it and assess the risk Take security measures suited to the risk, and carry out a data protection impact assessment when the processing is likely to result in a high risk. How Sparkbay helps ## How Sparkbay meets each obligation ### Confidentiality and security built into the platform, and commitments in our contract ### Built into the platform - **A minimum for every score.** Scores appear only for groups that reach your anonymity minimum, 5 respondents by default and set per organization. - **Comments without names.** Comments appear without names, and only when enough different people have commented to reach your anonymity minimum. - **Same thresholds in exports.** PowerPoint decks and printable reports apply the same thresholds as the dashboard. - **Encrypted and protected.** Employee personal data is pseudonymized, encrypted in transit and at rest, and access is role-based. - **Access you control.** You decide who sees what. Managers can be limited to their own teams, and you choose who sees the whole organization. Access can follow your org chart automatically and be adjusted by hand. - **Activity log.** Your administrators can review an activity log of key actions taken in your account. ### Our commitments - **ISO/IEC 27001.** Sparkbay's information security management system is certified to ISO/IEC 27001:2022 and audited by an independent certification body. - **Hosting.** Your data is hosted on Microsoft Azure, in Quebec. - **Hosting.** Your data is hosted on Microsoft Azure, in Canada. - **Hosting.** Your data is hosted on Microsoft Azure, in Europe. - **Hosting.** Your data is hosted on Microsoft Azure. - **Hosting.** Your data is hosted on Microsoft Azure: in Quebec (Canada) for our Quebec and Canadian customers, and in the European Union for our European customers. - **Data processing agreement.** Sparkbay processes your employees' data on your behalf, as a processor under Article 28, and our data processing agreement sets out the obligations of each party. - **Representative in the European Union.** Sparkbay complies with the General Data Protection Regulation (GDPR). Our representative in the European Union is Prighter EU Rep GmbH, in Paris. - **Automated backups.** The database is backed up automatically, with point-in-time restore if something goes wrong. - **Never sold.** Sparkbay will not sell, rent or trade personal information to any third party. - **Deletion when your contract ends.** When your contract ends, we delete your organization's data from our production systems on request. Certification, hosting, encryption, sign-in and the documents for your security review: [Security and privacy →](https://sparkbay.com/en/security) [Schedule a demo](https://sparkbay.com/en/request-demo) Employee rights ## Employees in control of their own data ### The GDPR gives every employee rights over their data, and Sparkbay helps you honour them. ### Access Employees can ask what data is processed about them and receive a copy (Article 15). ### Correction Employees can have inaccurate data corrected (Article 16). If your organization allows it, they can also update their own details, such as their department. ### Erasure Employees can ask for their personal data to be removed and deleted from the dashboard, and can ask to reset their answers (Article 17). [Privacy policy →](https://sparkbay.com/en/privacy) FAQ ## Frequently asked questions ### Which legal basis applies to an employee survey? Often legitimate interests. European regulators consider that consent at work is rarely freely given, because of the imbalance of power between employer and employee. Your organization, as controller, chooses and documents the legal basis. ### Is Sparkbay a processor under the GDPR? Yes. Sparkbay processes your employees' data on your behalf, as a processor under Article 28, and our data processing agreement sets out the obligations of each party. Your organization is the controller. ### Where is our data hosted? On Microsoft Azure, in the European Union for our European customers. Service providers such as SendGrid (email), Twilio (text messages), OpenAI (AI comment summaries) and Cloudflare (network) also handle some data. Ask us for the full list. ### Does Sparkbay have a representative in the European Union? Yes. Our representative in the European Union is Prighter EU Rep GmbH, in Paris. ### When is a data protection impact assessment needed? When the processing is likely to result in a high risk to people's rights and freedoms. European guidelines count employees among the vulnerable data subjects, one of the criteria to weigh. Our team gives you the information your assessment needs. ### When should we involve our works council or employee representatives? Before the survey tool is introduced. In several European countries, employee representatives must be informed or consulted before certain tools are introduced: in Germany, the works council has a say over technical systems that can monitor employees, and in France, the CSE is consulted on new technologies. Present them what your organization will see and what stays private. ### How long do you keep survey answers? As long as your account is active, so you can follow trends over time. Answers from people who left stay in your results and in the departure report. When your contract ends, we delete your data on request. #### Need a GDPR compliant employee survey? [Schedule a demo](https://sparkbay.com/en/request-demo)