GDPR at the contact form: the points that matter in practice

Every contact form processes personal data: a name, an e-mail address, often a phone number and a free-text message that can contain almost anything. GDPR does not forbid any of that, but it sets a few expectations – for the form itself, for what loads around it and for what happens to the message afterwards.

At the form: inform, and ask for little

Article 13 GDPR requires you to inform people at the time you collect their data. For a contact form, that means at the form – not only via a footer link far below. The common approach is layered: one short sentence next to the submit button, such as “We use your details only to answer your enquiry – more in our privacy policy”, with the policy linked. The policy then covers the full details.

The second principle is data minimisation (Article 5(1)(c)). To answer, you usually need a way to reply and the message itself. A name helps, a phone number is sometimes useful, a postal address rarely is. Leave out what you do not need, and mark nice-to-have fields as optional. Imagine a dental practice whose form makes the phone number mandatory: everyone who prefers e-mail is pushed into handing over more than the purpose requires.

Answering a request usually needs no consent checkbox

Many forms carry a mandatory box saying “I consent to the processing of my data”. It looks careful, but it is usually the wrong tool. When someone asks a question or requests a quote, the legal basis is typically Article 6(1)(b) – steps taken at the person’s request before entering into a contract – or Article 6(1)(f), your legitimate interest in replying. Consent brings obligations of its own: it must be freely given and can be withdrawn at any time. Special categories of data are different: if a form asks for health information, for example at a medical or dental practice, Art. 9 GDPR applies and the legal basis needs a separate check.
Marketing is different. A newsletter needs genuine consent: a separate checkbox, unticked by default – Recital 32 states that pre-ticked boxes do not count – and the form must work without it.

What else loads on the form page

The fields are rarely alone on the page. A CAPTCHA from an external provider, an ad or analytics pixel or a session-replay tool may run while someone types. Each can send data – at least the IP address – to a third party, and storing or reading information on the device generally requires consent under the ePrivacy rules as implemented nationally, in Germany and Poland as elsewhere, unless it is strictly necessary. Session replay is the most delicate: without masking, it may record what people type before they even click Send.
This is where the consent banner has to deliver: after “Decline”, pixels must stay silent. Whether a third-party CAPTCHA is strictly necessary is debated. If it only loads after consent, give people who declined another way to reach you, such as a plain e-mail address. Protection without a third party – a honeypot field, a time check, a proof-of-work challenge – avoids the question altogether.

• Open the form page in a private window, decline the banner and check the network tab in the developer tools: which external requests still go out?
• Check for ad and analytics pixels on the form page and on the thank-you page after sending.
• If you use session replay, make sure form fields are masked or form pages are excluded.
• Note which CAPTCHA provider loads, and when – before or after consent.
• Name every remaining third party, with its purpose, in your privacy policy.

Where the messages go – and how long they stay

Every service that handles the messages on your behalf – hosting, mail provider, a form SaaS the form posts to, a helpdesk or CRM – is a processor under Article 28 GDPR. You need a data processing agreement (DPA) with each of them; most providers offer a standard one. If data is processed outside the EU/EEA, the transfer also needs a basis under Chapter V, such as an adequacy decision – for example the EU–US Data Privacy Framework for certified companies – or standard contractual clauses.

Enquiries should not be kept forever. Under the storage limitation principle (Article 5(1)(e)) you set a retention period and actually delete – including copies in mailboxes, plugin databases and the CRM. If an enquiry turns into a business relationship, commercial and tax rules – Germany and Poland both have them – may require keeping some correspondence for years; then that duty sets the period. Finally, security: Article 32 names encryption as an example of an appropriate measure. A form served without HTTPS or with an expired certificate sends personal data unprotected.

The formexposed scanner looks at several of these points from the outside: a privacy policy link at the form, whether declining the cookie banner really stops tracking, pixels and session-replay tools on form pages, and whether the recipient address is visible in the page source. It submits nothing. A free check without an account gives you the overall level and the core protection findings; the GDPR details are in the full report.