The short answer
A contact form collects personal data. The obligations are not onerous for a simple enquiry form, but they do need meeting: be clear about use, collect only what you need, and delete it when it is no longer needed.
The common failure is treating an enquiry as permission to market.
Say what happens plainly
- Who receives the enquiry
- What you will use it for
- Whether anyone else sees it
- How long you keep it
- How to ask for it to be deleted
A short paragraph in plain language next to the form does this better than a link to a long policy nobody opens.
Keep marketing separate
| Purpose | Basis |
|---|---|
| Responding to the enquiry | Implicit in sending it |
| Adding to a mailing list | Needs separate, active consent |
| Sharing with a partner | Needs to be stated and agreed |
| Analytics on form use | Covered by your wider approach |
| Keeping it indefinitely | Needs a reason, otherwise delete |
The second row is where most sites go wrong. An enquiry is not a subscription, and a pre-ticked box is not consent.
Collect less
- Ask only what you need to respond.
- Make everything else optional and say so.
- Avoid anything sensitive unless it is genuinely necessary.
- Do not store more than the form asked for.
- Review the fields occasionally and remove unused ones.
Collecting less improves completion and reduces obligation simultaneously, which makes it an unusually easy decision.
Retention you actually apply
Set a period, write it down, and have something that enforces it. A stated retention period that nothing implements is worse than none, because it is a commitment you are visibly not keeping.
Deleting old enquiries automatically is straightforward and removes the question entirely.