Contact forms and personal data

Most corporate websites have a contact form. Forms that ask for a name, an email address and a short message also collect personal data. Form design is therefore not only a user experience topic but also a question of how that data is protected.

This article summarises general points worth keeping in mind when designing a form.

Only what is needed

In most cases, a name and an email address are enough to answer a contact request. Fields such as phone number, address or company size can be left out if they will not really be used. Every extra field makes the form longer and increases the data that has to be protected. Fewer fields often also means more completed forms.

Informing users

It builds trust when users can easily see who uses their data, for what purpose and whom they can contact with questions. A short, clear notice that is easy to reach next to the form serves this purpose. It matters that the notice matches what actually happens.

Third-party tools

Many forms use a third-party form tool to forward submissions by email, or a verification tool to block automated submissions. These tools may have servers in other countries and may process technical information such as the IP address during the connection. Knowing which tools are used and naming them in the notice gives users transparency.

Secure transmission and storage

• Sending the form over an encrypted connection (HTTPS) is a basic security step.
• Not copying submissions to more places than necessary, for example both an inbox and several spreadsheets, makes them easier to track.
• It helps to think in advance about how long data is kept after a request has been answered.
• Limiting access to the inbox that receives submissions to the people who answer them reduces risk.

Checkbox

A checkbox showing that the notice has been read is a practical way to record that the user was informed. If there are other purposes, such as marketing communication, offering a separate and optional choice for them gives users a real say.

Checklist

• Is every field in the form actually used?
• Is the notice current and consistent with the tools in use?
• Are submissions sent over an encrypted connection?
• Is it clear how long data is kept and who can access it?

Designing a small form with care is a visible part of respect for users and of the organisation’s data practices.

Regulations change often; this article is not legal advice, so please consult a legal adviser about your own situation.