What the person filling in the form must know
Article 13 of the GDPR says what information must be given at the moment data is collected. Next to a contact form that's usually a few sentences and a link to the privacy policy.
A layered approach works: two or three sentences right next to the “Send” button and a link to the full privacy policy. Nobody reads a wall of text above a form.
Consent: when yes, when no
| Situation | Basis for processing | Is a consent tick box needed? |
|---|---|---|
| Replying to an enquiry from the form | Steps at the person's request before a contract, or legitimate interest | No |
| A newsletter or offers sent by email | Consent | Yes: separate and unticked |
| Keeping CVs for future recruitment | Consent | Yes |
A pre-ticked box is not consent. Neither is consent “included” in accepting the terms. Consent must be a separate, informed action, and it must be as easy to withdraw as it was to give.
Fewer fields, less trouble
- Email and a message are enough. Phone as an optional field.
- Don't ask for sensitive data, for example about health, in a general form. Clinics that need it collect it through a separate, better protected channel.
- Don't store the IP address or other technical data if you don't need it for anything.
- Remove fields nobody reads, such as “How did you hear about us?”.
Technology: where the data goes
- HTTPS across the whole site is the basis.
- The form service and the mailbox are recipients of the data. List them in the privacy policy.
- Spam protection without tracking: a hidden honeypot field instead of services that send visitors' data to an outside company.
- Retention put into practice, for example clearing old submissions in the form panel and the mailbox once a year.
reCAPTCHA and similar services pass visitors' data to an outside company. They have to be described in the privacy policy, and it's worth considering whether they require consent.
An example of a short notice next to the form
The data controller is [name or company], [email]. I process the data from the form to reply to your message (Article 6(1)(b) or (f) GDPR), for [period, e.g. 12 months after the last message]. Recipients: the hosting and email provider. You have the right to access your data, to rectify or erase it, to object and to complain to the supervisory authority. More in the privacy policy: [link].
This is a template, not legal advice. Adapt it to your situation, and with sensitive data or large-scale processing consult a lawyer.
Terms from this guide
- Privacy notice
The information required by Article 13 of the GDPR: who processes the data, why, on what basis, who receives it and how long it's kept.
Questions and answers
Does a form need a consent tick box for data processing?
To reply to a message, usually not. The basis is the enquiry itself or legitimate interest. A tick box is needed only for marketing, for example a newsletter.
Where should the privacy notice go?
Right next to the form, briefly, with a link to the full privacy policy.
I don't have a registered business. Does the GDPR apply to me?
Yes, if you collect data in connection with work for clients, even without a registered business. The exemption covers only purely personal or household activities.
Sources and documentation
- Regulation (EU) 2016/679 (GDPR): the full text on EUR-Lexeur-lex.europa.eu
- EDPB: Guidelines 05/2020 on consentedpb.europa.eu