When someone submits a contact form on your website, their information does not necessarily go to one inbox and disappear. Depending on the form’s configuration, the submission may be processed by your website, saved as an entry, delivered through an email service or forwarded to another application. Some of those systems may retain their own copies.
None of this is automatically a problem. The important question is whether you know which systems receive the information, who can access it and what happens after the enquiry has been handled. A form can look simple to visitors while creating a data flow that nobody has reviewed in full.
The form you see is not the whole process
Consider a quotation form that asks for a name, email address and description of the work. The visitor clicks Submit and sees a confirmation. Your team receives an email and replies. From the outside, the form seems to have done exactly what it was designed to do.
Now imagine that someone opens the form’s administration panel and discovers that every submission has also been saved there. Another employee can view those entries without opening the email inbox. An integration may send some submissions to a customer relationship management (CRM) system, while a form service may process them before they reach your website.
These are possible configurations, not universal features. Some forms store entries, some only send notifications and others rely on external services. A broader review of third-party data processing helps identify supplier relationships; our article Which External Services Process Your Organisation’s Data? explains that wider exercise. Here, the task is narrower: follow one specific form submission and find out what this form actually does.
Follow the data after someone clicks Submit
The journey begins when a visitor enters information in a browser and sends the form. Depending on the setup, the browser may submit the information to your website or directly to a form service. HTTPS helps protect the connection while information is in transit, but it does not tell you what the receiving system will do with the data afterward.
The next stage is processing. A website might check required fields, filter spam and trigger an email notification. Some configurations also send information to an automation tool, a CRM or a helpdesk. Anti-spam or other connected services may process additional details about the submission, depending on how they have been implemented.
Finally, find out where the data remains. Is there a submission record in the website dashboard? Does an email provider retain a delivered message? Can the request be found in a shared inbox or a connected application? These systems may have different permissions and settings. The visible form alone cannot answer those questions; its configuration and the receiving systems have to be checked.
Ask for less information, not more
Every field on a contact form asks a visitor to share something. A general enquiry may only need a way to reply and enough detail to understand the request. A quotation may justify further information, but a telephone number, postal address or document upload should not become mandatory simply because the form builder makes it easy to add one.
Free-text fields deserve special attention. A visitor may include personal details that were never requested, particularly when describing a health, financial or employment concern. Clear labels and a short instruction about what not to submit can reduce unnecessary collection, although they cannot prevent every unexpected disclosure.
This reflects the GDPR principle of data minimisation: personal data should be relevant and limited to what is necessary for a specified purpose. The European Data Protection Board’s guidance for small businesses also explains the related principles of purpose limitation, transparency and storage limitation. The best place to apply minimisation is before the visitor sends anything.
Make the privacy explanation match the form
A privacy notice should describe what actually happens to submitted information, not merely state that the organisation takes privacy seriously. When personal data is collected directly from a visitor, the relevant information should be available at the time of collection. That includes the purposes of processing, the legal basis, relevant recipients and retention information, alongside other applicable details and individual rights.
This does not require placing a wall of legal text beneath the Submit button. A clear, concise explanation next to the form, supported by an accessible privacy notice, can help visitors find the information they need. The EDPB’s guidance on the right to be informed describes how layered information can support understandable and complete communication.
Does a contact form always need a consent checkbox?
No. A consent checkbox is not automatically required for an ordinary contact form, and consent is not always the appropriate GDPR legal basis. The correct basis depends on why the data is processed and the circumstances of the enquiry.
For example, someone requesting a quotation may be asking a business to take steps before entering into a contract. In that situation, processing necessary for those steps may rely on the contractual legal basis. A different kind of enquiry may require a different assessment. The EDPB’s guidance on lawful processing explains the available legal bases and their conditions.
Using the same submission to add a person to a marketing list is a separate purpose and needs its own lawful-basis assessment, as well as compliance with any applicable marketing rules. A generic I agree box does not make every later use lawful. First identify each purpose, then establish the appropriate basis and explain it accurately. This is general information, not legal advice about a particular form or organisation.
Check who can read a submitted message
The person answering an enquiry may not be the only person with access to it. Form administrators, colleagues using a shared mailbox and staff with permissions in a CRM may all be able to read submissions. That access might be appropriate, but it should be intentional rather than inherited from old accounts or unnecessarily broad permissions.
External providers may also handle form information. Under the GDPR, a controller determines the purposes and essential means of processing, while a processor handles personal data on the controller’s behalf under its instructions. Their roles depend on what they actually do, and processor relationships require appropriate safeguards. The EDPB explains the distinction between controllers and processors.
For your own form, identify who can open the entries, mailbox and connected records. Include agencies and former staff if their accounts may still exist. If you discover unclear permissions, our guide How to Conduct a User Access Audit Across Your Organisation offers a broader method for reviewing access beyond the contact form.
Check whether form entries are still being kept
One easily overlooked setting is submission storage inside the form tool itself. Some tools keep saved entries until they are manually removed or a retention rule is configured. Others do not save submissions locally at all. Do not assume that messages disappear when someone replies to them or deletes the notification email.
For this review, establish whether your form stores entries, whether automatic deletion is available and who is responsible for checking it. The wider decisions about retention periods, legal obligations, deletion across systems and the backup lifecycle are covered in What Happens to Business Data When You No Longer Need It?. For the form itself, your immediate task is to locate the stored records and verify the settings rather than assume that no copies remain.
A five-step check you can do on your own website
You do not need to understand the code behind your website to start. Choose one contact form and ask your website administrator or service provider to help with settings you cannot inspect yourself.
- Send a harmless test submission. Use your own contact details and a unique reference, such as
FORM-REVIEW-27OCT, so you can recognise the message. Do not enter real customer information or sensitive data. - Trace every destination you can see. Look in the expected inbox, the form’s dashboard and any connected CRM, helpdesk or automation tool. Check whether the form saves entries by default and whether those entries remain until someone removes them.
- Review access and settings. Find out who can read each location, which providers handle the information and whether an automatic retention or deletion rule is configured. Ask your technical contact about relevant logs and backups without assuming either is present.
- Compare the actual process with the form’s wording. Are all fields necessary? Is the privacy explanation accurate? Have the purposes and legal bases been assessed? Can a visitor find the relevant information before submitting?
- Record what needs changing. Note confirmed destinations, unanswered questions, responsible people and agreed improvements. After a configuration change, repeat the controlled test and check the result.
A single test submission will not reveal every background service or every historical copy. It is a practical starting point, not a complete GDPR compliance audit. Its value is that it gives your organisation evidence to work with instead of assuming that the Submit button tells the whole story.
A simple form deserves a clear data flow
A contact form is often treated as a small website component, yet it can connect the public website to mailboxes, staff accounts and external applications. The right design is not necessarily the one with the fewest tools. It is the one whose data flow can be explained and whose collection, access and storage choices are deliberate.
Start with one form, trace one submission and verify what is stored. That modest exercise can reveal whether the way your organisation actually handles enquiries matches the promises it makes to visitors.
