Almost every WordPress site has a form on it, and almost every one collects a name and an email address. That’s personal data \u2014 so the moment you publish a contact form you’re processing it, and if the people filling it in are in the EU or UK, data protection law applies to you. The good news: for an ordinary contact form, compliance is far less dramatic than the cookie-banner era made it feel. It’s mostly a few sensible decisions about what you collect, why, how long you keep it, and who else can see it. Here’s what that means in practice, with a checklist at the end.<\/p>\n
This is practical guidance from people who build form software \u2014 not legal advice. Data protection law is fact-specific and varies by jurisdiction. If you handle sensitive data, operate at scale, or face a specific complaint or regulator question, get advice from a qualified professional where you operate.<\/p><\/blockquote>\n
What GDPR actually requires of a simple contact form<\/h2>\n
Under the GDPR you need a lawful basis<\/strong> for every processing activity. There are six; two usually fit a plain contact form. Legitimate interests<\/strong> covers reading and answering enquiries \u2014 you have a genuine interest, the processing is necessary for it, and it doesn’t override the sender’s rights, and someone who deliberately typed you a message plainly expects a reply. Steps prior to a contract<\/strong> fits quote or order enquiries made at the person’s request.<\/p>\n
The frequently-missed point: a contact form usually doesn’t need a consent checkbox at all<\/strong>. Plenty of sites bolt an “I consent to my data being processed” box onto every form because it looks compliant, but consent has to be freely given \u2014 if someone can’t send a message without ticking it, it isn’t. A clear purpose plus a privacy notice link does more for you than a tickbox. What you must not do is quietly reuse the data for something the sender didn’t expect: answering the enquiry is one purpose, adding them to your mailing list is another.<\/p>\n
Contact form vs marketing opt-in \u2014 the line that matters<\/h3>\n
Marketing email is where consent genuinely bites, governed in the EU and UK by ePrivacy rules (PECR in the UK) on top of GDPR. If your form feeds a newsletter, the opt-in needs to be:<\/p>\n
\n
- Unticked by default.<\/strong> Pre-ticked boxes, silence and inactivity are not consent.<\/li>\n
- Separate.<\/strong> Not bundled into “I accept the terms”, nor a condition of sending the enquiry.<\/li>\n
- Granular.<\/strong> Product newsletter and partner offers are different purposes \u2014 ask separately.<\/li>\n
- Specific and informed.<\/strong> Who’s sending, what they’ll get, roughly how often.<\/li>\n
- Recorded and withdrawable.<\/strong> Show when and how consent was given \u2014 a timestamped entry is the easiest evidence \u2014 and make opting out as easy as opting in.<\/li>\n<\/ul>\n
Narrow exceptions exist (the UK’s “soft opt-in” for existing customers is the best-known), but they’re tighter than most marketers assume and never cover a cold contact form submission.<\/p>\n
Data minimisation: stop collecting what you don’t need<\/h2>\n
The highest-value change most site owners can make is deleting form fields. GDPR expects collection to be adequate, relevant and limited to what’s necessary for the stated purpose, and every extra field is more to secure, disclose, delete on request and explain if something goes wrong. Worth auditing:<\/p>\n
\n
- Phone number<\/strong> \u2014 do you actually call people? If it’s optional, mark it optional.<\/li>\n
- Postal address<\/strong> on an enquiry form that leads to an email reply; date of birth, company size, job title<\/strong> collected “for segmentation” you never do.<\/li>\n
- Hidden fields and IP logging.<\/strong> Many plugins record IPs and user agents by default \u2014 justifiable for spam prevention, but it should be a decision you made, disclosed, and not kept forever.<\/li>\n<\/ul>\n
If you’re rethinking the form anyway, our notes on WordPress contact page best practices<\/a> cover the conversion side: shorter forms usually perform better, making this the rare compliance step that also earns money.<\/p>\n
Transparency: say what you’re doing, where you’re doing it<\/h2>\n
People must know who is collecting their data, why, on what basis, how long it’s kept, who it’s shared with, and what rights they have. That means a real privacy notice<\/strong> reflecting your actual setup \u2014 not a template naming services you don’t use \u2014 plus a link to it at the point of collection<\/strong>. A short line under the submit button (“We’ll only use your details to reply to this enquiry. See our privacy policy.”) does the job; footer-only is weaker. Keep it honest: if you add people to a CRM, say so.<\/p>\n
Storage and retention: decide how long, then enforce it<\/h2>\n
GDPR doesn’t hand you a number of months. It says don’t keep personal data in identifiable form longer than necessary for the purpose \u2014 so you set the period, document it, and be able to justify it. For form entries that usually looks like:<\/p>\n