Can we use Google Forms to collect personal data?

[fiza]

Is it possible to use Google Forms to collect personal information from parents from a Data protection point of view?

SLT want to send out consent forms for the 12-15 vaccinations. The form will collect home addresses, DOB, contact numbers, NHS number etc.

[jmak]

Yes - if the proper precautions are taken. Assuming you are already using G Suite, you should have a DPIA, but it probably doesn't cover what you're more proposing to use it for, so it should be revisited.

 

The platform has measures in place to keep data suitably secure. Your SLT need to ensure that they have suitable controls too.

 

Edit: This article has information about how it is/can be used in the NHS

 

https://cloud.google.com/security/compliance/nhs-uk

Edited September 20, 2021 by jmak

[mikes]

I have used it to collect parent names and contact details in the context of booking out open evening appointments. As long as you don't set the form with the option to show all the results of course. I am the only one with access to the forms results and it'll be printed off to provide a register. I think I'd trust the Forms over something I might make myself in PHP that could be vulnerable to an SQL injection for example, as I'm not a full time developer.

[GrumbleDook]

With the correct security controls, I’m sure it could be, but we’ve had a recent post reminding us all how wrong it can go.

Not Google’s fault it gets set up poorly.

Remember, if this is a new type of processing, risk assess it.