GDPR and contact forms for small businesses

What a contact form collects

Names, email addresses, phone numbers, addresses and message details can identify a person. Even a business enquiry can contain personal data. Review every field and remove questions you do not need to answer the request. A taxi quote may need pickup details; a basic callback request may not need a home address.

Free-text boxes can contain unexpected sensitive information. Train staff to handle it carefully and avoid asking for special-category information unless genuinely necessary and properly assessed.

Tell people what will happen

Place a short explanation beside the form and link to a full privacy notice. The notice should identify the business, purposes, lawful basis, recipients, retention approach and people’s rights. Say whether the information goes to an email provider, booking tool or other supplier.

The notice must describe what your actual site does, not a generic template. If you later add analytics, chat or new forms, review it again. The ICO’s small-business privacy guidance sets out the key information.

Choose a lawful basis deliberately

Do not treat a tick box as a universal answer. The lawful basis for responding to a requested quote may differ from the basis for sending promotional messages. Decide the basis before collecting data, record your reasoning and explain it in the notice. Seek specialist advice if the processing is unusual or sensitive.

Do not make marketing consent a condition of sending an ordinary enquiry. Keep optional marketing choices separate and clear, with a way to withdraw where consent is used.

Keep the data safe and useful

Use HTTPS, limit inbox and system access, apply updates where needed and agree who handles enquiries. Decide how long an unanswered enquiry is kept and how older records are removed. If a form emails details to a shared address, check who can read it and whether staff departures remove access.

Test error handling so a failed form does not silently lose a customer message. A privacy notice alone does not protect data; the everyday process matters.

Cookies and similar tools

Audit the site as it actually runs. Essential technologies and optional analytics or advertising tools may need different treatment. UK rules generally require consent for non-essential cookies and similar tracking. A banner is not a substitute for knowing what each tool does.

Do not install marketing tags first and ask for permission afterwards. Explain relevant technologies in the notice and test the choice on a fresh browser. Check the ICO’s cookies guidance because guidance can change.

Use outside suppliers carefully

Email, hosting, booking and payment providers may process information for you. Record which provider receives which data, review contracts and permissions, and decide what happens when you change supplier. Give each agency or employee only the access needed for their role.

For payments, use a reputable payment provider so card details are handled through the proper service rather than copied into a contact-form message. Keep booking records and payment records linked without exposing unnecessary details.

Handle requests and mistakes

People may ask to see, correct or delete their information, or object to certain uses. Your team needs to know who receives these requests and where data is stored. Some records may need to be kept for legal reasons; explain the limitation rather than promising automatic deletion.

If data goes to the wrong person or a device is lost, have an incident process. The exact reporting duties depend on the circumstances, so consult current ICO guidance promptly.

Review the whole customer journey

Check the form, confirmation email, staff inbox, CRM, reminder and archive. Ask whether each step uses only the necessary data and whether the customer was told about it. A small diagram of the flow is often more useful than a long policy nobody has read.

This is general information, not legal advice. Use the ICO’s small organisation guidance and seek professional advice for specific risks. Our domain and business email guide covers account ownership.

Check consent choices in practice

If you offer an optional marketing tick box, leave it unticked and explain the channel and type of messages. Store the choice with enough context to show what the person agreed to. Test that an enquiry still submits when the box is empty and that withdrawing consent stops future campaigns. Do not treat a failed or missing record as permission.

Review third-party embeds and analytics alongside the form. A page can collect data before a visitor types anything. Keep a list of tools, purposes and owners so the notice stays accurate when the site changes.

Questions you may have