Attest does not store or process personal identifiable information (PII) about respondents. This is in line with the General Data Protection Regulation (GDPR), which governs how personal data can be collected and used.
This applies to surveys sent to Attest panels as well as surveys sent to your own audience through the platform.
What counts as personal information
Personal information includes data that can directly identify an individual, such as:
names
email addresses
phone numbers
postal addresses
It also includes combinations of information that could reasonably identify a person when taken together. For example, surveying a small internal group and asking for team, age, and seniority may effectively identify an individual, even if no single question does so on its own.
What is not allowed in surveys
You cannot ask respondents for personal identifiable information in Attest surveys.
This means:
questions requesting personal details will be removed
directing respondents to another site to collect personal data is not permitted
collecting information that collectively identifies a respondent is not permitted
These restrictions apply regardless of whether you are surveying Attest panels or your own audience.
What data can be collected
Respondents may provide demographic information through Attest, such as age range, gender, or location, where this data is collected and processed in a GDPR-compliant way.
This data is used for targeting, analysis, and aggregation, and does not allow individual respondents to be identified.
If you need to collect personal data
If your research requires personal follow-up or identification, Attest may not be the appropriate tool for that part of the workflow.
In some cases, it may be possible to:
collect consented personal data outside the survey
link survey responses back to individuals using compliant identifiers, such as respondent IDs, without exposing personal data in the survey itself
See Sending surveys with respondent IDs for more detail.
Important note
This information is provided for general guidance only and should not be considered legal advice. If you are unsure about your organisation’s compliance with GDPR or other data protection regulations, you should seek advice from a qualified legal professional.
If you have any more questions, please get in touch with our Customer Research Team.