Website forms and personal data

What you'll achieve

• ask only for the data you need;
• put the right notice next to the form and, where needed, a consent checkbox;
• know where messages go, how long you keep them and how you delete them.

The steps

A. Ask only for what you need

1. For each field, ask yourself: do I need it to reply? For a contact form, the name, email or phone and the message are usually enough.
2. Remove the “just in case” fields: date of birth, full address, national ID number. A national ID number (such as the Romanian CNP) has no place in a contact form.
3. Clearly mark which fields are required.

B. Inform people next to the form

4. Below the submit button, add a short sentence, for example: “We only use your data to reply to you. Details in our Privacy Policy”, with a link to the policy (see GDPR for a small website: cookies and privacy).
5. For an ordinary contact form, the legal basis is usually the person's own request (they want a reply or a quote), not separate consent. A mandatory “I agree to the processing of my data” checkbox on every form doesn't add much; decide with your lawyer whether you need one.

C. Ask for separate consent for the newsletter

6. If you also want to send newsletters, add a separate, unchecked checkbox: “I want to receive the newsletter (once a month). I can unsubscribe at any time.”
7. The form must also work without this checkbox: someone who only wants a reply is not required to subscribe.
8. Keep proof of consent: the date, time and address. Newsletter platforms do this on their own, especially with email confirmation of the subscription (see Newsletters that land in the inbox, not in spam).

D. Check where messages go

9. The email they arrive at: an address on your domain that only the people who need to reply can access (see How to create an email account in Enhance).
10. The copy in the database: many form plugins also keep every message in WordPress, in addition to the email. Check the plugin's settings: if you don't need it, turn off saving; if you do, decide after how long the messages are deleted.
11. External services: a form from an outside company (online forms, bookings, CRM) sends the data to that company. Mention it in your privacy policy and check where it stores the data.
12. The email sender: the form must send from an address on your domain, with the visitor's address as Reply-To; otherwise messages end up in spam (see Why my emails go to spam: SPF, DKIM, DMARC).

E. Decide how long you keep data, and delete it

13. Set a time limit, for example: contact messages that didn't lead to working together are deleted after 12 months. Write it in your privacy policy.
14. Once a year, delete whatever is past the limit: from the mailbox, from the plugin's database, from external services.
15. If someone asks you to delete their data, look for it in all three places.

F. Protect the form

16. Add spam protection (a hidden field or a check). A check from an external service may set cookies; mention it in your cookie policy.
17. The website on https://, with a valid certificate (see The free SSL certificate (Let's Encrypt)): data sent through the form travels encrypted.
18. Don't ask for passwords or card details through the form.

If something doesn't work

• Form messages don't arrive. Check the destination address and the Spam folder. If they aren't sent at all, see Email isn't sent or doesn't arrive: common errors.
• You get a lot of spam through the form. Add or change the spam protection (step 16).
• You don't know where the plugin stores messages. Look in the WordPress menu for a section with the plugin's name (usually Entries). If you can't find it, send us the plugin's name.