GDPR-compliant contact form: checkbox, notice, fields

For many businesses a contact form is the most important way to win new jobs. Because personal data is processed, the GDPR applies. That sounds more complicated than it is. Here are the basics of a GDPR-compliant contact form, with a view to German practice. This is not legal advice.

What the GDPR requires for a contact form

• Information: visitors must learn what happens to their data. This belongs in the privacy policy, and a short note on the form links to it (Art. 13 GDPR).
• Legal basis: for enquiries about a possible job this is usually Art. 6 (1) (b) GDPR, for general questions the legitimate interest under (f).
• Data minimisation: only ask for fields you really need (Art. 5 (1) (c) GDPR).
• Security: transmission must be encrypted, so via HTTPS (Art. 32 GDPR).
• Retention: delete enquiries when they are no longer needed.

Is a checkbox required on a contact form?

If you handle the enquiry based on Art. 6 (1) (b) or (f) GDPR, you usually do not need consent and therefore no consent checkbox. Many websites still use a box such as "I have read the privacy policy". Legally that is not consent, but it makes the notice visible. Important: a box must never be ticked in advance. You need real consent if you want to use the data for something else, such as a newsletter.

The notice on the form

A short, clear sentence directly above the send button is enough, for example: "I only use your details to answer your enquiry. More in the privacy policy." The link must lead directly to the privacy policy.

Required fields in the contact form

Name, one way to get in touch and the message are usually enough. Phone number, address or company name can be offered as optional fields. Every extra required field also costs enquiries, because visitors are more likely to give up.

Spam protection without tracking

Well-known captcha services from large providers transfer visitor data to that provider and therefore, in the widespread view, require consent. It works without them too:

• An invisible field that only bots fill in.
• A time check: anyone who submits a form within a second is not human.
• A limit on how often one address can send in a short time.
• Checking all input on the server.

Where does the data go?

The enquiry is usually sent to you by email and often also stored on the server. Both belong in the privacy policy, together with the service providers involved, such as your host and email provider. You need a data processing agreement with them. External form services that transfer data to third countries make things considerably more complicated.

Checklist for a GDPR-compliant contact form

• The page runs over HTTPS.
• Only necessary required fields.
• A notice with a link to the privacy policy on the form.
• No pre-ticked box.
• Spam protection without sending data to third parties.
• A contact form section in the privacy policy, with legal basis and retention period.
• Delete enquiries regularly.

Frequently asked questions

May I use enquiries for advertising later?

Advertising by email usually requires explicit consent (in Germany § 7 UWG). An enquiry via the contact form is not such consent.

Isn't an email address enough instead of a form?

That works too. A form lowers the barrier because visitors do not have to open a mail program. In terms of data protection, similar rules apply to both.