GDPR-compliant contact form: checklist, notice text & example

A contact form is personal data processing in its purest form: someone hands you their name, email, and a free-text message. GDPR applies the moment an EU visitor hits send. The good news is that a compliant contact form is mostly a handful of decisions made once.

Practical guidance from developers who ship this daily - not legal advice. For specific situations, ask a professional.

1. Collect only what the purpose needs

Data minimisation is the easiest principle to honor and the most commonly violated. A contact form needs an email and a message. Phone number, company size, budget dropdowns - every extra field needs a reason. Fewer fields also convert better, so compliance and conversion point the same direction for once.

2. Know your lawful basis (it's probably not consent)

For a contact form, the lawful basis is usually legitimate interest or steps prior to entering a contract - someone wrote to you; answering them is the point. You generally don't need a consent checkbox just to receive and reply to a message. Where you do need separate, unticked-by-default consent is anything beyond replying: newsletters, marketing follow-ups. Never bundle those into the send button.

3. Know where the data physically lives

Your form processor stores the submission somewhere, and where determines a chunk of your paperwork. If the processor stores data in the US, the transfer needs a Chapter V mechanism - currently the EU–US Data Privacy Framework and/or SCCs - and your privacy policy must describe it. That's workable, but it's homework that renews whenever the legal landscape shifts (Safe Harbor and Privacy Shield were both struck down; the DPF is under challenge).

The structurally simple option is a processor that stores submissions in the EU and never transfers them - then there's no transfer to document. Formhook stores submissions in Germany, full stop. Either way, the checklist item is the same: find the storage location in your processor's documentation and make sure your privacy policy matches reality.

4. Have a DPA with your processor

Article 28: if a service processes personal data on your behalf, a data processing agreement must exist. Any serious form backend offers one - here's Formhook's. If a provider can't show you a DPA, that's disqualifying by itself.

5. Decide retention - and be able to act on it

Storage limitation means knowing how long you keep submissions and why. "For the life of the client relationship" is a perfectly good answer - but you need two capabilities from your tooling: deleting individual submissions (erasure requests) and exporting everything (access/portability requests). Check both exist before you need them; in Formhook, deletion is per-submission and export is a full JSON ZIP on every tier.

6. Write the privacy policy paragraph honestly

The form's paragraph needs: what's collected, why, the lawful basis, who processes it (name the provider), where it's stored, how long it's kept, and how to request deletion. If the data stays in the EU, that paragraph is two sentences. If it crosses the Atlantic, it's longer - but the cardinal sin is a policy that doesn't match the actual data flow.

Copy-paste: notice text, optional checkbox and an HTML example

Article 13 GDPR means you have to tell people, at the moment they send the form, who you are, why you use their data, on what legal basis, how long you keep it and what rights they have. The usual way to do that without cluttering the form is a short notice next to the button that links to the full privacy policy. The example below has that notice, the honeypot field from our spam protection guide, and an optional checkbox.

About the checkbox. As covered in point 2, answering a message does not need consent, so a mandatory "I consent" box is the wrong pattern: consent has to be freely given and withdrawable, and ticking a box you cannot refuse is neither. If you want a box at all, make it an acknowledgement ("I have read the privacy policy"), which documents that the notice was shown but is not consent. Use a real consent checkbox - unticked, specific, kept separate from the send button - only for extras like a newsletter.

<form action="https://formhook.app/f/fh_your-key" method="POST">
  <label for="name">Name *</label>
  <input id="name" name="name" type="text" autocomplete="name" required />

  <label for="email">Email *</label>
  <input id="email" name="email" type="email" autocomplete="email" required />

  <label for="message">Message *</label>
  <textarea id="message" name="message" rows="5" required></textarea>

  <!-- honeypot: bots fill this; humans don't see it -->
  <input type="text" name="_gotcha" tabindex="-1" autocomplete="off" hidden />

  <!-- Optional: acknowledgement that the notice was shown (not consent) -->
  <label>
    <input type="checkbox" name="privacy_notice_acknowledged" required />
    I have read the <a href="/privacy-policy">privacy policy</a>.
  </label>

  <p>
    We use your name, email address and message only to answer your enquiry.
    Details, including your rights, are in our
    <a href="/privacy-policy">privacy policy</a>.
  </p>

  <button type="submit">Send message</button>
</form>

Privacy policy paragraph to adapt

This is a starting point for the contact-form section of your privacy policy. Replace everything in square brackets, and add any extra recipient you switch on:

When you use our contact form we process the name, email address and message you enter in order to answer your enquiry (Art. 6(1)(f) GDPR, or Art. 6(1)(b) GDPR if the enquiry relates to a contract). The form is operated by Formhook (formhook.app), which processes the submission on our behalf under a data processing agreement (Art. 28 GDPR). Submissions are stored on servers in Germany. We delete enquiries [after X months / once the matter is closed], unless statutory retention duties apply. You have the right to access, rectification, erasure, restriction, objection and portability, and to lodge a complaint with a supervisory authority. Contact: [your email].

Check the paragraph against how you actually run the form. If you turn on push notifications with message previews, or an integration that forwards submissions to another service, that service is an additional recipient and belongs in the text. "Stored in Germany" describes where Formhook keeps submissions; it does not cover other tools you connect.

This is a template, not legal advice. Have your own lawyer or data protection officer look it over before it goes live, especially if you need to meet country-specific rules such as the German Impressum and Datenschutzerklärung requirements.

The checklist

• Form collects only necessary fields
• No pre-ticked consent; marketing consent (if any) separate from sending
• Short information notice next to the send button, linking to the privacy policy
• Processor's storage location known and documented
• Transfer mechanism identified (or made unnecessary by EU residency)
• DPA in place with the processor
• Retention decided; per-submission deletion and full export both possible
• Privacy policy paragraph matches the real data flow

Run this once per site and the contact form goes from compliance question mark to solved problem. More on how Formhook handles data in the FAQ and privacy policy.