GDPR requirements for contact forms. The complete checklist.

Name, email, phone number and a free-text message: an ordinary contact form collects personal data from the very first field. That makes the form – and everything that happens to the messages afterwards – part of your GDPR responsibility. The good news: the requirements are manageable when you take them one at a time.

01Lawful basis – you usually don't need a consent checkbox

A common misunderstanding is that every form needs a consent checkbox. When a customer writes to you of their own accord to get an answer, the basis is typically legitimate interest or steps prior to a contract – not consent. The checkbox is required if you want to use the details for something other than answering the inquiry, such as newsletters or marketing.

02Duty to inform: link to your privacy policy

You have to tell people what happens to their data – at the latest when you collect it. In practice: a short line by the form linking to your privacy policy, describing purpose, retention period and rights.

03Data minimisation: ask only for what you need

• Drop fields you don't use – company registration number, address and date of birth rarely belong in a contact form.
• Make the phone number optional if email is enough to reply.
• Avoid inviting sensitive information (health, trade union membership and so on) in the free-text field.

04Retention and deletion – where most companies fall down

Inquiries must not sit in a shared inbox "forever". You need a deletion policy: for example, that ordinary inquiries are deleted after 24 months. The problem is practical – in an Outlook inbox with a thousand mails, nobody deletes anything. A system with structured storage turns deletion into a rule rather than an intention.

05A data processing agreement (DPA) with your vendors

If a tool handles inquiries for you – a form plugin, a helpdesk, a CRM – the vendor is a data processor, and you need a DPA. Check where the data is hosted too: EU hosting makes the compliance work markedly easier than US services with transfer mechanisms.

06Security: encryption and access control

• HTTPS across the whole site – form data must never travel unencrypted.
• Access control: only the colleagues who answer inquiries should be able to read them. A shared inbox with a shared login is the opposite.
• Sign-out routines and two-factor authentication on the system that stores the inquiries.

The checklist – print it

• Lawful basis settled (consent only for marketing)
• Link to the privacy policy by the form
• Only necessary fields in the form
• A fixed retention limit + a system that can enforce it
• A DPA with every vendor that touches the inquiries
• EU hosting or a valid transfer mechanism
• HTTPS + access control with individual logins