FormAssembly

What is FormAssembly?

FormAssembly is an enterprise data collection platform specialising in complex form creation with conditional logic, multi-step workflows, Salesforce native integration, and HIPAA-compliant configurations. It is used by healthcare organisations, financial services firms, nonprofits, and higher education institutions to collect sensitive data through secure online forms. Forms can be embedded on websites or accessed via hosted URLs. The platform processes form submission data including all personally identifiable information entered by respondents.

What data does FormAssembly collect?

FormAssembly collects all data entered by form respondents, which varies by form configuration but may include names, email addresses, phone numbers, addresses, dates of birth, health information, financial data, and any other fields defined by the form designer. It also collects IP addresses and browser information when the form loads. Submitted data is stored in FormAssembly's database and may be synced to Salesforce or other connected systems depending on integration configuration.

GDPR and ePrivacy implications

FormAssembly's GDPR compliance depends heavily on what data is collected in each specific form. For contact or inquiry forms, the legal basis is often legitimate interest or contract performance. For forms collecting consent to marketing, the form itself is the consent mechanism. For healthcare forms collecting health data, explicit consent under Article 9(2)(a) is required. Each form deployment should be assessed individually for its applicable legal basis, data minimisation compliance, and retention period.

Consent requirements

ePrivacy consent is required before the FormAssembly embed script loads for any non-essential cookies it sets. For the form data itself, the consent requirement depends on the purpose: contact forms may rely on legitimate interest or contract performance; lead generation forms require marketing consent captured in the form; forms collecting special category data require explicit consent under Article 9. Every form must include a privacy notice linking to your privacy policy before respondents submit their data.

Data transfers and EU residency

FormAssembly processes data on US infrastructure by default. EU data residency is available for Enterprise customers. For organisations collecting sensitive data from European users, evaluating EU data residency is strongly recommended. Standard Contractual Clauses apply for non-Enterprise customers. The Salesforce integration may create additional transfer obligations if Salesforce data is also processed in the US.

Practical compliance steps

To use FormAssembly compliantly: assess each form individually for its applicable legal basis; include a privacy notice on every form before submission; obtain ePrivacy consent before the embed script loads; for special category data forms, obtain explicit Article 9 consent; sign a DPA with FormAssembly; evaluate EU data residency for sensitive data forms; configure data retention and auto-deletion in the FormAssembly admin; document all form processing in your RoPA with the specific legal basis for each form type.