Contact forms and the GDPR: what to include on your website
Damian Baranowski, websites for small businesses
Updated:
A contact form collects personal data (name, email, phone number and message content), so the GDPR requires you to tell people who processes it and why. A short notice beside the “Send” button and a link to your privacy policy are enough. A consent checkbox is only needed if you want to use the data for something else, such as a newsletter.
What the form collects and why the GDPR applies
Names, email addresses, phone numbers and message content are personal data. Even one contact form makes you responsible for the data of the person filling it in. Start with two simple steps: ask only for what you need (the data minimisation principle in Article 5(1)(c) GDPR, so a phone number can be optional, for example), and explain what happens to the data.
What the notice must include
When you collect data directly from a person, Article 13 GDPR applies (text of the Regulation). Provide the information when collecting the data, before the form is submitted. It should include:
- who is responsible for the data and how to contact you,
- processing purposes and legal basis (such as replying to an enquiry),
- data recipients (such as email, hosting and form system providers),
- how long you keep the data or the criteria used to decide this,
- the person’s rights: access, rectification, erasure, restriction, objection and portability,
- the right to lodge a complaint with the President of the Polish Personal Data Protection Office (UODO),
- whether providing data is mandatory and what happens if it is not provided,
- any intended transfer of data outside the European Economic Area.
Where to put it
This is usually done in two layers: a short notice beside the “Send” button and a link to the full privacy policy. You need that policy anyway, as it also brings together cookie and analytics information. Make the link visible rather than hiding it in the footer.
Is consent needed?
Consent is not needed just to reply to an enquiry: Article 6(1)(b) (steps before entering into a contract at the person’s request) or Article 6(1)(f) (legitimate interest, such as handling enquiries) provides a legal basis. A consent checkbox is needed if you want to use the data for something else, such as a newsletter. It must be unchecked by default and separate from consent to contact the person about their enquiry. Many website owners also include an “I agree to be contacted about my message” checkbox for a simple enquiry, for clarity. This is not required, but does no harm.
How long to keep messages
There is no single statutory retention period. The storage limitation principle says you must not keep data longer than necessary, so you set the period yourself and state it in your policy. In my booking and form systems, data is automatically deleted from the database after 12 months. Remember copies: a message delivered to an email inbox does not disappear automatically.
Who else sees this data
A form usually uses several services: hosting, email, a form system and sometimes spam protection. Companies processing data on your behalf are processors. You need a data processing agreement with each (Article 28 GDPR), and list them as data recipients in your privacy policy. For my implementations, if I have access to the data, we sign a data processing agreement and you create the database and email accounts in your name.
Contact form checklist
| Check | Why |
|---|---|
| The form asks only for necessary data | Data minimisation (Article 5 GDPR) |
| A short notice and policy link appear beside the button | Information duty (Article 13 GDPR) |
| The policy names the controller, purposes, recipients, retention period and rights | Full information for the person |
| The consent checkbox, if present, is unchecked by default | Consent must be freely given and informed |
| You have data processing agreements with providers | Article 28 GDPR |
| You know who keeps messages and for how long | Storage limitation |
This is guidance for small business owners, not legal advice. If you are unsure about your situation, seek legal or data protection advice.
Questions and answers
Does a contact form need a consent checkbox?
Not just to reply to an enquiry. Consent is needed when you use the data for an additional purpose, such as sending a newsletter. However, you must always provide the information required by Article 13 GDPR.
Is a privacy policy mandatory?
If you collect personal data, you must explain how it is processed. The easiest way is to put this in a privacy policy and link to it from the form.
Is forwarding messages by email data processing?
Yes. An email containing personal data involves processing, and the email provider is a data recipient or processor. List them in your policy.
How long can I keep customer messages?
As long as needed for the purpose, such as handling the enquiry and possible claims. You set the period yourself and explain it in your policy.