GDPR
GDPR and contact forms: what visitors need to know before sending
Ask for information you need and explain its purpose, access and retention clearly.
Question the fields before adding a checkbox
An initial enquiry needs enough information for a useful reply. For each field, ask what decision it supports and whether the detail can be requested later. A full home address or identity document in an ordinary contact form needs a specific justification. Collecting less also reduces the information you need to protect and manage.
Information and legal basis are separate
Visitors should be able to understand who handles their information, why, on which basis, for how long and with which rights. An acknowledgement checkbox does not establish a legal basis on its own. Steps towards a contract requested by the individual can have a different basis from a marketing campaign. Choose according to the purpose and circumstances, and make the notice reflect the actual workflow.
Follow every copy of an enquiry
The same message can exist in a CMS, an inbox and a sales tool. Map that route before writing a retention policy. Check who has access, which providers are involved and how an erasure request is handled. If the form does not automatically remove information after a set interval, do not promise automatic deletion simply because it sounds reassuring.
Keep replies and promotion separate
A quote request does not justify automatically subscribing someone to a newsletter. Assess promotional communication as a separate purpose under the applicable rules. Similarly, publishing a cookie notice does not justify loading any tracking tool. Inventory the real services before choosing a consent mechanism and make sure any required blocking happens before activation.
A practical pre-launch check
Send a test enquiry without real personal information and follow its storage, access and notifications. Read the notice beside the form on a phone. Confirm that the rights contact is monitored and a responsible person is assigned. This guide explains general principles; requirements for a particular activity need assessment against the relevant law and circumstances.