We teach University students that if they produce surveys in order to gather data they need to ensure survey data sets containing personal info have security and privacy controls in place. If those data sets are kept outside of Europe, the survey takers can be penalised for any third party breach.
GDPR obligates survey builders to be transparent about what data they share and for what reasons. People need to know this so they can opt out of the survey or not deal with you the creator of the survey.