GDPR-Compliant Customer Feedback Software: 2026 Checklist

GDPR compliance isn’t a single feature — it’s a bundle of technical and organizational requirements. Four dimensions matter most:

Hosting location: EU/Germany vs. third-country transfer
If data is stored or processed on servers outside the European Economic Area (EEA), this constitutes a third-country transfer. Under Art. 44 ff. GDPR, this is only permitted under certain conditions — for example, via Standard Contractual Clauses (SCCs) or an adequacy decision. EU hosting, ideally on German servers, avoids this issue structurally.

Data Processing Agreement (DPA) under Art. 28 GDPR
As soon as an external provider processes personal data on a company’s behalf, a DPA is legally required. Without this contract, using the tool is unlawful — regardless of how secure the infrastructure is. The DPA must regulate, among other things, the purpose and duration of processing, the processor’s obligation to follow instructions, and the list of sub-processors.

Encryption at rest and in transit
Data should be encrypted both during transmission (TLS/HTTPS) and at rest. Both are standard practice today, but should be explicitly confirmed in the provider’s data protection documentation.

Certifications as proof of an ISMS
ISO 27001 is the best-known international standard for information security management systems. A corresponding certification demonstrates that a provider organizes information security systematically and undergoes regular audits. It doesn’t replace GDPR compliance, but it’s a recognized proof of technical and organizational measures (TOMs) under Art. 32 GDPR.

The following checklist helps evaluate providers systematically. Each point should be actively raised with the provider, with answers documented.

1. EU or German server location
Is all data stored and processed exclusively on servers within the EEA? Is there a clear commitment to EU hosting without silent outsourcing to third countries?

2. DPA under Art. 28 GDPR available
Does the provider offer a DPA covering the legally required minimum content? Can it be signed without lengthy negotiation, or is it only available at the enterprise tier?

3. Sub-processor list transparent and current
Which third-party providers does the vendor itself use — for email delivery, analytics, or infrastructure? Are these listed in the DPA or a publicly accessible list? Are changes communicated in advance?

4. Encryption at rest and in transit
Is customer data encrypted during transmission (TLS 1.2 or higher) and at rest? Is this documented in the technical data protection documentation?

5. Deletion policy and retention periods
Does the tool offer configurable deletion periods? Can data be fully and verifiably deleted on request, in line with the right to erasure under Art. 17 GDPR?

6. Certifications and ISMS proof
Does the provider or the data center it uses hold ISO 27001 or a comparable certification (e.g., SOC 2, TISAX)? Are current certificates available on request?

7. Support for data subject rights
Does the tool enable efficient handling of access, rectification, and deletion requests under Art. 15–17 GDPR? Are there workflows for this, or at least clearly defined processes on the provider’s side?

8. Data export and portability
Can all collected feedback data be fully exported at any time (Art. 20 GDPR)? In which formats? Is export guaranteed even after contract termination?

9. Standard Contractual Clauses (SCCs) for US providers
If the provider is a US company or uses US infrastructure: does it use the European Commission’s current 2021 SCCs? Is a Transfer Impact Assessment (TIA) in place?

10. Accountability and documentation
Does the provider supply documentation that supports your own accountability obligations under Art. 5(2) GDPR — such as records-of-processing templates, support for a Data Protection Impact Assessment (DPIA), or technical documentation?

The table below gives an overview of relevant providers against the key GDPR criteria. Note: Certifications and hosting configurations can change. Always request current proof directly from the provider.

US providers are subject to the CLOUD Act, which allows US authorities access to data under certain conditions — even if that data is physically stored on EU servers. The EU-US Data Privacy Framework (DPF), in effect since 2023, does provide a new adequacy decision for certified US companies. However, the legal situation remains volatile: the DPF has already been challenged politically and legally on multiple occasions.

For CX teams in Germany and Europe, this means concretely: a US provider can be used in a GDPR-compliant way, but only with greater effort. SCCs, a Transfer Impact Assessment, and complete documentation are mandatory, not optional. With an EU provider using EU hosting, this overhead is structurally avoided.

This isn’t a fundamental argument against US providers — but it is a real difference in the compliance burden placed on your own team.

zenloop is a German company headquartered in Schönefeld, in the Berlin region. The platform captures customer feedback — primarily via NPS surveys — at critical points in the customer journey and uses AI-driven analysis to identify and automatically trigger action options: for example, proactively reaching out to dissatisfied customers or activating promoters for advocacy programs.

From a GDPR perspective, the following points are confirmed:

• EU hosting: Data is stored and processed within the EU.
• German company: Headquartered in Germany, and therefore directly subject to German and European data protection law.
• DPA under Art. 28 GDPR: A Data Processing Agreement is available.
• GDPR-compliant architecture: The platform is designed for use by European companies.

What zenloop doesn’t claim: a proprietary ISO 27001 certification is not publicly confirmed. CX teams for whom such a certification is a selection criterion should ask the provider directly and request the current technical data protection documentation.

For companies looking for an NPS-focused feedback tool with German hosting and an available DPA, zenloop is a relevant candidate — with a clear structural advantage over US providers, where third-country transfer requirements create additional compliance overhead.

The DPA isn’t an optional document — it’s a legal requirement. Art. 28 GDPR specifies what it must include:

• Subject matter, duration, nature, and purpose of processing
• Type of personal data and categories of data subjects
• Obligations and rights of the controller
• The processor’s duty to follow instructions
• Confidentiality obligations for staff
• Technical and organizational measures (TOMs)
• Provisions on sub-processors
• Support obligations for data subject rights and data breaches
• Deletion or return of data after contract termination

A DPA that doesn’t fully cover these points doesn’t protect your company. Before signing a feedback-tool contract, the DPA should therefore be reviewed by your own data protection team or Data Protection Officer.

The two terms often come up in the same breath — but they describe fundamentally different things.

ISO 27001 is an international standard for information security management systems. It certifies that a company organizes information security systematically, assesses risks, and implements measures. A corresponding certification is a strong signal of technical and organizational maturity.

GDPR is European data protection law. It regulates how personal data may be processed, what rights data subjects have, and what obligations controllers and processors carry.

ISO 27001 can serve as evidence of TOMs under Art. 32 GDPR, but it doesn’t replace GDPR compliance. A provider can be ISO 27001-certified and still transfer data to third countries without a sufficient legal basis. Conversely, a provider without ISO 27001 certification can operate in a GDPR-compliant way if it documents and demonstrates the requirements by other means.

For provider selection, the rule is: certifications are helpful, but they don’t replace your own review of the DPA, hosting location, and sub-processor list.