Blog
Contact forms and data protection: a plain guide for small businesses
What to think about when your website collects people's details. General information, not legal advice.
Every contact form collects personal details, so the data protection rules apply to it. They are less daunting than they sound. This is general information, not legal advice: if your business handles sensitive details, talk to a solicitor.
Ask only for what you need
If you only need an email address to reply, do not ask for a phone number, a date of birth and an address as well. Each extra question is something more to look after, and one more reason for someone not to send the form.
Say why you are asking
Tell people, near the form or in your privacy notice, what you will do with their details: reply to their enquiry, send the quote, confirm the booking. Your privacy notice should also say who you are, how long you keep things, and how people can ask to see or delete what you hold.
Ask separately for marketing
If you want to send newsletters or offers, ask for that separately, with a box that is not ticked in advance. Agreeing to be contacted about an enquiry is not agreeing to marketing emails.
Keep it only as long as you need it
Decide how long you keep form entries, and delete them after that. A year is plenty for most enquiries. The less you keep, the less there is to lose.
Be careful where entries go
Entries often end up in shared inboxes, spreadsheets and phones. Keep the number of places small, and be careful with exports that carry everyone's email address.
Know who to ask
In Ireland the regulator is the Data Protection Commission, whose website has guidance written for small businesses.
In Webseer
Each form can keep entries for as long as you choose, has a consent question that keeps the exact wording someone agreed to, and can hide email addresses in exports.