GDPR and your contact form: what to include to comply with the regulation

A contact form collects personal data (name, email, phone). That is why it is subject to the General Data Protection Regulation (GDPR) and national rules. Complying is simple if done in an orderly way.

This article is indicative and does not replace legal advice. Validate your texts with a professional.

1. Inform before collecting the data

Next to the form there must be a clear notice with, at least:

• Who the controller is (name or company name, tax ID, address and contact).
• What for the data will be used (replying to the enquiry, sending a quote).
• Legal basis (consent or pre-contractual measures at the data subject’s request).
• Who it is shared with (hosting or email providers as data processors).
• How long it is kept.
• People’s rights and how to exercise them.
• A link to the full privacy policy.

A very common format is the two-layer one: a short summary next to the form and the full text in the policy.

2. Consent: an unticked checkbox

When you need the user’s consent:

• It must be an affirmative action: a checkbox not pre-ticked.
• It cannot be mandatory for purposes other than the enquiry (for example, to receive advertising).
• If you want to send commercial communications, ask for it with a separate checkbox.

3. Collect only what is necessary

Apply the principle of minimisation: ask only for the data you really need. A phone and an email at the same time, when one is enough, is an unnecessary field.

4. Protect the data

• HTTPS connection.
• Spam protection (honeypot field, sending limits, verification).
• Store and send data securely; access limited to those who need it.
• If you use third-party services (email, CRM), formalise the data processing agreement.

5. Retention and rights

• Define a reasonable retention period and delete data when it expires.
• Prepare a procedure to handle access, rectification, erasure, objection, restriction and portability requests.
• Reply within the legal deadlines.

6. Cookies and the form

The form itself does not require cookies, but your website may have other tools (analytics, advertising). These must be blocked until the visitor accepts, with a banner that lets them reject as easily as accept.

7. Record of processing activities

If you process data regularly, keep a simple record of processing activities: what data, for what, legal basis, periods and processors.

Quick checklist

• ☐ Controller identified
• ☐ Clear purpose
• ☐ Legal basis stated
• ☐ Unticked acceptance checkbox
• ☐ Link to the privacy policy
• ☐ Separate checkbox for advertising (if applicable)
• ☐ Anti-spam protection
• ☐ Retention period and rights
• ☐ Contracts with data processors

We build compliant forms and legal pages by design; if you want to review yours, write to us.