An online form response review should identify the form owner, who can submit, who can see answers, where responses are stored, which spreadsheets or exports contain copies, and how long each copy should remain. Stop collection when the purpose ends, export only when retention is approved, remove unnecessary collaborators, and verify deletion separately in the form, linked files, and downloaded archives.
Map the form and every response store
Record the form URL, owner, purpose, audience, collection period, questions, fields containing personal or confidential information, collaborators, and response count. List the platform's internal response view, linked spreadsheets, notification emails, downloads, dashboards, automations, and backups.
Google's response destination guidance explains that Google Forms responses can appear in the form and in a linked Google Sheet. The form and spreadsheet are separate files: unlinking stops new rows from reaching the sheet but leaves existing data, and deleting one file does not delete the other.
Microsoft's Forms export guidance documents opening responses in Excel. Treat every exported workbook or PDF as a new copy that needs an owner, access rule, and retention date.
Review collection and visibility
Confirm who can respond and whether sign-in, email collection, or anonymous submission is appropriate. Read the confirmation message and any privacy notice from the responder's perspective. Remove questions that are not needed for the stated purpose.
Inspect collaborators on the form and the linked response file separately. Google notes that form collaborators automatically receive access to a newly created response spreadsheet, but later changes to form permissions do not automatically synchronize with the sheet. A person removed from the form can therefore retain access to the response file until that access is changed separately.
Check dashboards, add-ons, scripts, and notification routes. An automation may continue sending response data after the visible form is closed unless the integration is disabled.
Set a retention decision
For each copy, record the approved retention period, owner, storage location, and reason. Separate operational records from test submissions. If policy, contract, or law determines retention, have the responsible owner confirm the requirement rather than inventing a period for convenience.
When collection ends, unpublish or close the form and run a harmless submission test to confirm new responses are blocked. Export only the records that should be retained, place them in approved storage, and restrict access. Do not leave an unmanaged workbook in a personal download folder.
Delete carefully and verify every copy
Google warns that deleting form responses cannot be undone. Preserve the approved archive and deletion authorization before removing data. Delete test responses first when practical and confirm the expected result.
Review the form response view, linked spreadsheet, exported files, dashboards, email notifications, backups, and downstream systems. Removing answers from one surface does not prove that another copy is gone. Record what was deleted, by whom, when, and how the remaining archive was tested.
Review checklist
- Name the form owner, response-data owner, and backup owner.
- Inventory the form, linked sheets, exports, automations, and backups.
- Review responder access, collaborator access, and sensitive questions.
- Assign a retention decision and storage location to every copy.
- Stop collection and verify with a controlled submission.
- Export only approved records and open a representative sample.
- Remove data from every required location and preserve deletion evidence.
Repeat the review after the form changes owner, a campaign ends, a linked sheet changes, or an automation is replaced. The practical unit of control is not just the form; it is the full chain of response data and every copy created from it.
Sources
- Choose where to save form responses — Google Docs Editors Help
- How do I export my form responses? — Microsoft Support