Contact form and GDPR. How many fields you really need and where the messages end up

Someone fills in the contact form on your website. Their name, a phone number and a short question about a free slot. They click “Send” and forget about it. Their details stay in your inbox, and often also in the site’s database and on the phone of whoever reads that inbox. The form collects personal data, and that is GDPR territory.

We do not write here what exactly your privacy notice should say. That is for a lawyer to decide. We write about what is in the regulation itself and what you can sort out on the technical side before you go to one. In Poland the same regulation is called RODO.

What GDPR itself says about a contact form

The regulation has no article about forms. It does have several provisions that apply wherever data is collected.

Article 13 lists the information given to a person when data is collected from them. It includes the identity and contact details of the controller, the purposes and legal basis of the processing, the recipients of the data, how long the data will be stored or the criteria used to decide that, the person’s rights and the right to lodge a complaint with a supervisory authority.

Article 5 sets out data minimisation. Data should be “adequate, relevant and limited to what is necessary” for the purposes it is processed for. The same article says data should not be kept for longer than is necessary.

Where something is based on consent, Article 7 says the controller must be able to demonstrate that it was given, and that withdrawing consent must be as easy as giving it. Recital 32 says directly that “silence, pre-ticked boxes or inactivity should not therefore constitute consent”.

What this means for your form, and how the text next to it should read, is worth checking with a lawyer. Below is the part you can prepare yourself.

Only the fields you really need

For every field, think about what you will actually do with that information. If you answer enquiries by email, the phone number can be optional. If you call people back, it may be the other way round. A home address field on an appointment enquiry rarely has a good reason to be there.

Forms often ask for more because the template had those fields and nobody removed them. A shorter form is also easier to fill in on a phone, and fewer fields means less data to look after later.

A separate, unticked box for marketing

Whether sending an enquiry needs a consent box at all, or a note next to the form is enough, is something to settle with a lawyer. Consent to marketing is a separate matter.

If you want to send a newsletter or offers, the request for that consent usually sits as a separate box under the form. The person ticks it themselves. A box ticked in advance is exactly the case recital 32 describes, and our scan flags it as something to check. Paragraph 2 of Article 7 also says that when consent is part of a written declaration covering other matters too, the request for it must be clearly distinguishable from the rest.

On the technical side, the form should record when someone ticked the box and what the consent text said at that moment. Without that, it is hard to show anything a year later. Ask your developer whether your form does this.

Whether you need consent for marketing at all, and in what form, also depends on laws other than GDPR. That is another question for a lawyer.

Where messages land and how long they stay

Check where enquiries from your form really go. Sometimes it is a shared inbox that several people read, or the owner’s private address. Sometimes a copy also stays in the site’s database, and the admin panel holds every enquiry since launch.

The storage period is among the information listed in Article 13. To state it, you first have to decide it. Settle the length with a lawyer, then ask your developer to have old messages in the site’s database delete themselves after that time. The mailbox needs the same done separately.

The form should send data only over an encrypted connection, that is over https. If the site also opens over plain http and does not move visitors to the encrypted version, data from the form can travel as plain text. Article 32 of GDPR names encryption among example security measures.

Without spam protection, a form will sooner or later fill your inbox with junk. A simple guard is a hidden field that people do not see and bots fill in, plus a limit on how many messages can come from one place in a short time. Some anti-spam tools are scripts from outside companies that load for every visitor. Whether they need a mention in your privacy policy is a question for a lawyer.

What our scan shows, and what it does not

Our free website scan looks at your site’s code for privacy and cookie signals. It checks whether a form has a consent box or a link to the privacy policy, whether a consent box is ticked in advance and whether analytics tools start before cookie consent. In the same run it also checks whether http moves visitors to https.

The scan reads the code the server sends, so a form drawn later by a script stays invisible to it. It is not a legal assessment. It shows what is missing in the code, not whether your documents comply with the law. No outside scan can see where your messages go and who reads them either. How to test a form step by step is in our website handover checklist.

Send one enquiry through your own form today and write down where it went, who can see it and how long it will stay there. With those three answers, the conversation with your lawyer will be shorter.