Privacy Policy for Surveys

Surveys help organizations remain competitive by providing feedback that can be used to improve products and services and give customers the best experiences possible. However, privacy and liability issues can arise when personal information is collected, analyzed, stored, and shared.

If you use personal information in any of the aforementioned ways, including a well-written Privacy Policy with your surveys and questionnaires will provide numerous protections.

In this article, we'll explain why you must have a Privacy Policy for your surveys, what to include in your policy, and how to create, display and get consent to yours with relative ease.

What is a Privacy Policy?

A Privacy Policy is a formal legal notice that details your data collection and processing practices. Basically it lets the world know what personal information you collect, how you collect it, and what you do with it.

They're legally required in most places around the world whenever you in fact do collect or use personal information of others.

Are Privacy Policies Required for Surveys?

Your survey is legally required to have a Privacy Policy if it collects any personal information, such as an email address or date of birth. As you can see, most surveys will indeed require a Privacy Policy.

In the U.S., state privacy laws like the California Consumer Privacy Act (CCPA/CPRA) and international ones like the General Data Protection Regulation (GDPR) may not address surveys specifically, but their terms generally apply to all data collection and processing activities within their jurisdictions.

If you or your organization conducts surveys and collects personal information from residents of a regulated state or the European Union, you should include a Privacy Policy to promote transparency and stay on the right side of the law.

What is Personal Information?

In addition to collecting responses from survey questions themselves, you may need to collect protected personal information including:

• Names
• User names
• Email addresses
• Physical locations of survey participants

Furthermore, you may be subject to additional rules and regulations if you collect sensitive personal information pertaining to race, religion, political affiliation, and sexual orientation.

You may choose not to collect sensitive information of this nature, but many organizations like knowing as much about their customers and potential customers as possible because it allows them to tailor their sales and marketing efforts accordingly.

What to Include in Your Privacy Policy for Surveys

Below are the most common general clauses that practically every Privacy Policy should contain.

Note that the specific details of your Privacy Policy will differ, for example you may collect a lot of data from third parties, or you may not. Put differently, while every policy should disclose where you collect your information from, the details of that section will differ.

Introduction

You can professionally introduce your Privacy Policy by providing your survey participants with the following information:

• Who you are as a company
• When your Privacy Policy was last updated
• Definitions of terms found in the Privacy Policy
• A linked Table of Contents or an overview of what the Privacy Policy will cover

Survey Junkie's UK website includes the following Introduction with its Privacy Policy:

Survey Junkie's Introduction clearly states that its Privacy Policy covers cookies too, and that the policy applies to residents of the EU and European Economic Area (EEA).

The company also defines three terms (website, surveys, and services) that are used throughout its policies.

Below this information, Survey Junkie gives users more background information regarding the nature of its business:

What Types of Data Will be Collected

Surveys are valuable tools for multinational corporations, local non-profits, and nearly every organization and business type in between. But because surveys can vary so greatly, it's important to lay out exactly what types of data will be collected.

Here's how Survey Junkie discloses the different types of data it will request:

How Data Will be Used

You must disclose how you will use the data that you collect. This can be everything from technical aspects (automatic account login functionality) to selling the data to third parties for a profit.

Here's how Survey Junkie notes that it will use the General Profile information to match the user with appropriate surveys:

It also has a more detailed clause that specifically addresses how information is used, including to comply with laws, to communicate with the user, and to manage its rewards program:

Towson University addresses the issue of Data Usage for freshmen and seniors participating in the National Survey of Student Engagement as follows:

How Data Will be Shared

If you share the data you collect with any other party, you should disclose this. This includes whether you're selling the data to third parties or sending it to other companies within your own network.

Here's how Survey Junkie discloses in a list format who it may give information to:

The Cleveland Clinic lets users know that participants may be contacted by a third party consulting company and that their conversations may be recorded:

How Data Will be Protected

Data protection is usually a big concern for anyone considering participating in a survey. Without assurances that their personal information will be in good hands, some prospective participants may choose to err on the side of caution and keep their data to themselves.

Here's how Survey Junkie includes a clause that lists a number of different ways in which it helps secure the information it collects:

The Open University has a dedicated Data Protection and Confidentiality page that specifically deals with student surveys:

The first paragraph states that:

• Survey results are stored securely
• Data is only accessible by authorized personnel
• Data is only used when necessary for analysis and reporting

Children's Data

Because children are particularly vulnerable and enjoy beefed-up protections in many jurisdictions, most Privacy Policies specifically address the topic of children's data.

Different jurisdictions have different requirements on how such information is to be handled, so check local laws and make sure to abide.

Here's how Lightspeed addresses child safety:

Lightspeed's Children's Data Policy lets users know that it doesn't intentionally invite underage children to participate in online surveys. However, when they do get their parent's permission, the parents must still supervise them while they're completing the survey.

Survey Junkie's clause is shorter and more to the point, basically stating that it does not knowingly collect information from children under a certain age, and if the company does accidentally do so and become aware, it will delete the data:

External Links

Though external links are more common on websites and mobile apps, you should let participants know if they'll be included in your survey or questionnaire as well.

In the example below, Swagbucks informs readers that its site may contain external links and that the company isn't responsible for Privacy Policies or web content found there:

User Rights

Before creating an account, sharing personal information, and answering survey questions, some savvy participants will want to know what rights they have in regard to their personal data. These rights differ by jurisdiction, so check local laws.

In its Privacy Policy, Lightspeed spells out the Rights of Individuals in an easy-to-read numbered list:

In the following example, Tilburg University's website lists the following rights enjoyed by those who participate in official school surveys:

Tilburg survey respondents are also protected by the rights of Restriction, Removal, and Objection.

These rights allow them to restrict or prohibit data collection and processing indefinitely or until a particular objection has been addressed.

Governing Law/Jurisdiction

Because online surveys can be distributed to participants around the globe, governing law and jurisdiction must be considered.

You can use your Privacy Policy to disclose what laws govern your agreement, and what courts have jurisdiction over legal hearings that arise under the policy. This helps ensure that your global user base can't sue you in locations across the globe. You can see how this could be very costly to both your time and bank account.

Here's how SurveyMonkey addresses the issue of governing law and venue:

Right to Amend or Change the Privacy Policy

As your business grows and changes, and as privacy laws keep doing so as well, you'll likely need to review, evaluate, and update your Privacy Policy regularly to account for changes in laws, technology, market conditions, and business practices.

Lightspeed addresses this issue in its Privacy Policy as follows:

Contact Information

Since questions often arise throughout the survey process, it's important that participants know who they can contact to have their issues addressed.

Include a clause such as this one from Survey Junkie:

Include as many ways as possible to make it as easy as possible for users to contact you in a variety of ways.

The University of London includes the following Please Contact Us link for Student Experience Survey participants with questions:

This is a nice way to get your contact information out to help survey-takers. However make sure to include the contact information within your Privacy Policy as well.

Harvard includes the following contact information for survey participants:

How to Display and Get Agreement to Your Privacy Policy for Surveys

Depending on the nature and format of your survey, you may want to consider placing a link to your Privacy Policy in at least one, and possibly all of the following locations.

Website/Survey Footer

Including a link to your Privacy Policy on the footer of your website's homepage and at the bottom of each survey page are solid choices when it comes to noticeability and accessibility.

Here's an example of how you can link your Privacy Policy at the bottom of your website:

Swagbucks' website footer contains a number of links, but its Privacy Policy is relatively easy to find under the Legal heading along with other important informative links:

Sign-up/Sign-in Pages

Because new users may be required to register or create an account before beginning a survey, these are good opportunities to give them access to your Privacy Policy. However, you can also show this link to users every time they sign in for added surety that the Policy is accessible.

At the bottom of its Registration page, Toluna lets users know that by creating an account they accept the company's Terms and Conditions and Privacy Policies, both of which are linked:

Checkboxes for Agreement

The best way to get users to agree to your Privacy Policy or acknowledge that they've read it is to have them check a box to show this. An "I Agree" checkbox is a common best practice and is highly effective.

Before users create new accounts with Swagbucks, they must click in a box next to a statement that shows the user agrees to the company's Privacy Policy:

Before creating an account with SurveyMonkey, new users must add a checkmark to a box confirming that they agree to the company's Terms of Use and Privacy Notices:

Summary

Surveys and questionnaires can provide valuable feedback and insight that can help you attract new customers and improve products and service offerings for existing ones. On the downside, privacy and liability issues are relatively common when personal data is collected, analyzed, stored, and shared.

Thankfully, a well-written Privacy Policy will offer abundant protections and promote transparency by allowing you to lay out your data collection and processing practices.

Include the following sections in your Privacy Policy for surveys:

• An Introduction
• What types of data will be collected
• How data will be used
• How data will be shared
• How data will be protected
• Children's data
• External links
• User rights
• Governing law/jurisdiction
• Right to amend
• Contact information

For maximum visibility and accessibility, place links to your Privacy Policy in some or all of the following locations:

• Website footer and/or at the bottom of each survey page
• Registration or account creation
• Account sign-in for existing users

Get active consent via an "I Agree" checkbox that can be recorded and serve as proof of consent if issues arise down the road.