Guide
Making a contact form GDPR compliant
A contact form collects personal data, so UK GDPR and the Data Protection Act 2018 apply from the first submission. Most forms fail on retention and subject access rather than on the consent checkbox everyone worries about.
You need a lawful basis, and consent is often the wrong one
For someone enquiring about your services, legitimate interests or steps toward a contract usually fit better than consent. Consent has to be freely given and withdrawable, which is awkward for data you need in order to reply at all.
Where consent genuinely applies is marketing. If you intend to add an enquirer to a mailing list, that is a separate, unticked, clearly-worded opt-in — and you must record it.
Check: A pre-ticked marketing box is not valid consent under UK GDPR.
Recording the consent, not just showing the checkbox
A consent checkbox that is not stored proves nothing. If you cannot show what someone agreed to and when, you cannot demonstrate the consent you are relying on.
We found a live site whose privacy-consent checkbox rendered with no name attribute. Every visitor ticked it and the browser discarded the answer. The site had been demonstrating consent it had no record of, for months.
Check: Submit your own form and confirm the consent value is actually stored against the submission.
Retention: you must delete it eventually
Storage limitation means personal data is kept no longer than necessary. An inbox holding every enquiry since 2015 is the most common breach nobody thinks about, and "we might need it" is not a retention policy.
Decide a period, write it down, and make deletion automatic. A policy that depends on somebody remembering is not a control.
Check: FormHam prunes submissions on a retention schedule you set, including any files attached to them.
Subject access and erasure have deadlines
People can ask for a copy of their data, or its deletion, and you generally have one month. If enquiries live across an inbox, a spreadsheet and a plugin database, meeting that reliably is difficult.
Erasure also has to be complete. Deleting the row and leaving the attachment behind means the personal data outlived the erasure meant to remove it.
Check: FormHam produces a subject access export and performs erasure across submission data together.
None of this is legal advice — it is the engineering that makes compliance possible. Retention, provable consent and complete erasure are build decisions, and they are much cheaper made early.
Frequently asked
Do I need a consent checkbox to receive an enquiry?
How long can I keep enquiries?
Is a privacy policy link enough?
Want us to check it for you?
We will test every form on your site and tell you exactly what we find. If nothing is wrong, we will say so.
Talk to us