A contact form looks harmless: a name, an email, a message, and it all lands in your inbox. Yet as soon as you collect a person's name and email address, you are processing personal data, and the European data protection regulation, the GDPR, applies, whatever the size of your business.
The good news is that for a contact form, the obligations remain reasonable and can be settled once and for all, when the site is designed. This article relies on the text of the regulation itself. It only repeats what it says, and flags when something is a choice on your part.
Why a contact form is “processing”
The GDPR covers any information relating to an identifiable person: a name, an email address, a phone number, but also the content of a message that talks about them. Collecting, recording, consulting, storing or passing on that information is “processing” it. Your form is therefore covered, along with everything that happens next: the email received, its copy in your mailbox, your tracking spreadsheet.
In this framework, you are the “controller”: the one who decides why the data is collected and how. The providers who work for you (website host, email-sending service, mailbox) are processors, a point we come back to below.
The principles to respect
Article 5 of the regulation sets out the principles that apply to any collection. The ones that directly concern a form:
- Purpose: data must be collected for specified, explicit and legitimate purposes and not further processed in a way incompatible with them. An email left to get a quote does not become, without another basis, a marketing address.
- Minimisation: data must be adequate, relevant and limited to what is necessary for the purpose.
- Storage limitation: it must not be kept in a form that identifies the person for longer than necessary.
- Security: it must be processed in a way that ensures appropriate security, including protection against unauthorised access and accidental loss.
- Accountability: the regulation adds that you must be able to demonstrate that you comply with these principles.
On what legal basis do you answer messages?
Processing is lawful only if it rests on one of the bases in Article 6. Two of them are the most natural for a contact form:
- Pre-contractual steps: the processing is necessary to take steps at the person's request before entering into a contract. A quote request is an example.
- Legitimate interests: the processing is necessary for the legitimate interests pursued by the controller, unless the person's rights and freedoms override them. This is a possible framework for answering a simple question.
It is up to you to choose the one that fits your situation, and to state it in the information you give. Consent (a tick box) is another basis in Article 6, but Article 13 does not require it: what it requires is that you inform the person.
The information to display beneath the form
Article 13 lists what you must tell the person at the time of collection, and Article 12 requires that this information be concise, transparent, intelligible and easily accessible, in clear and plain language. In practice, the following must appear, beneath the form or in a privacy policy that it clearly links to.
- Who you are: the identity and contact details of the controller (and, where applicable, of a data protection officer).
- Why: the purpose of the processing, and its legal basis. If it is legitimate interests, which ones.
- Who receives the data: the recipients or categories of recipients, if any.
- If the data leaves the European Union: the fact that you intend to transfer it to a third country, whether or not the Commission has adopted an adequacy decision, or the appropriate safeguards (Article 46) and how to obtain a copy.
- For how long: the retention period, or failing that the criteria used to determine it.
- The person's rights: access, rectification, erasure, restriction, objection, portability.
- The right to lodge a complaint with a supervisory authority (in France, the CNIL).
- Whether fields are mandatory: whether providing the data is required and what the consequences are if the person does not provide it.
The same article specifies that these obligations do not apply insofar as the person already has the information. In practice, you therefore display a short notice under the submit button, with a link to the full page (legal notice or privacy policy), rather than an unreadable block of text.
Which fields to ask for (and which to avoid)
Minimisation is the simplest principle to apply, and the one most often forgotten. To answer a request, you need a way to reply (an email address), a name to address the person, and the message itself. Every extra field must be justifiable by the purpose.
- Phone: ask only if you really call back, and mark it optional if it does not condition your reply.
- Postal address, date of birth, company, budget: ask yourself, field by field, what you would do with it. Our own form has had no “budget” field since September 2026.
- Pre-ticked boxes and fields mandatory out of habit: a field is mandatory only if it truly is for handling the request, and the person must be able to tell (hence the asterisk and its explanation).
- Sensitive data: do not invite people, in a free-text field, to detail a health situation, opinions or any similar information when it serves no purpose for your reply.
How long should you keep messages?
The regulation sets no numeric period. It lays down the principle (do not keep data longer than necessary) and requires you to state the period, or the criteria used to determine it. It is therefore up to you to decide, and to stick to it.
A common-sense benchmark: a request that did not lead anywhere is not kept indefinitely, and a customer relationship follows other rules (accounting, contractual) than a simple first contact. Pick a period per category, write it down, and plan a real purge, for example a yearly clean-up of the inbox that receives the messages. A period displayed on the site but never applied is worse than no period at all.
When someone asks to see or erase their data
Every person can ask you for access to their data, its rectification or erasure, or object to the processing. Erasure (Article 17) applies in several cases listed by the regulation, and the right to object (Article 21) applies in particular when the processing rests on legitimate interests: you must then stop, unless you demonstrate compelling legitimate grounds. For direct marketing, objection is a right at any time.
The deadline is precise: you must respond without undue delay and in any event within one month of receiving the request. That period may be extended by two further months if the complexity or number of requests justifies it, provided you tell the person within the first month and give the reasons. A request made electronically calls, where possible, for an electronic reply.
In practice: give a dedicated contact address in your notice, know where messages live (inbox, backups, tracking spreadsheet, sending provider), and note the date each request is received so you can meet the deadline.
Your providers: processors and transfers outside the EU
As soon as a third-party tool receives your form's messages (email-sending service, mailbox, contact management tool, host), it acts as a processor. Article 28 requires you to use only processors providing sufficient guarantees, and that the processing be governed by a contract or other legal act that sets out in particular its subject-matter, duration, nature, purpose, the type of data and the categories of people concerned.
Two useful checks: does the provider offer that contractual framework, and where is the data processed? If it leaves the European Union, Article 13 obliges you to say so and to mention the safeguards covering the transfer, as well as how to obtain a copy. Naming your providers in your privacy policy is therefore not one more formality: it is a requirement of the regulation.
The record of processing activities
Article 30 requires a record of processing activities: who the controller is, the purposes, the categories of data and people, the recipients, the transfers, the planned erasure deadlines, and where possible the security measures. Businesses with fewer than 250 employees are exempt, but not if the processing is not occasional, or if it is likely to result in a risk to people's rights and freedoms.
An online contact form runs permanently: it is not occasional. The safest course is therefore to keep this record, even a tiny one: a page that describes the form, the purpose, the data, the recipients, the retention period and the providers. It is quick to do, and it is also the best way to be able to demonstrate compliance, as Article 5 requires.
Security, day to day
The security requirement is not limited to the website. The messages received live in an inbox: protect it with a strong password and two-factor authentication, limit who has access, and avoid forwarding messages to personal addresses or copying them into tools you do not control. On the site side, serve the form over HTTPS and validate fields on the server, not just in the browser.
Our experience: this site's form
We apply these principles to our own form, and it is the surest way to check they are workable for a small business.
- Few fields: name, email address, project type and message. The “budget” field was removed in September 2026.
- A clear notice beneath the submit button, with a link to our legal notices, which detail the purpose, recipients, retention period and rights.
- A named sending provider in our legal notices, with the fact that it is established outside the European Union and that the transfer is covered by the European Commission's standard contractual clauses.
- A written retention period: at most three years from the last contact. This is our choice, and ours to keep, with a real purge of the inbox.
- No copying of the message into the confirmation email sent to the visitor: we only repeat what is necessary, so that our domain cannot be used to relay text typed by anyone to a third party's address.
In short: your checklist
- Only ask for the fields you truly need to answer.
- Mark mandatory fields, and leave the others optional.
- Choose and write down your legal basis (pre-contractual steps, legitimate interests…).
- Display a short notice beneath the form, with a link to the full policy.
- State the controller's identity, the purpose, the recipients, the retention period, the rights and the right to complain.
- Name your providers and specify transfers outside the European Union and their safeguards.
- Set a retention period, and actually purge.
- Provide a contact address for rights requests, and meet the one-month deadline.
- Keep a small record of processing activities.
- Secure the inbox that receives the messages.
This information goes hand in hand with the legal notices of a business website, and with the question of trackers we cover in our article on cookie banners. A compliant form is decided when the site is designed: that is what we do for every showcase website: let's talk.
Sources
- Regulation (EU) 2016/679 of 27 April 2016 (GDPR), articles 5, 6, 12, 13, 17, 21, 28, 30 and 77 (EUR-Lex)
- RGPD: examples of information notices (CNIL, further reading: templates to adapt, in French)
- RGPD in practice: communicating online (CNIL, further reading, in French)
