Contact form GDPR notice and consent text

Most contact forms do not need a consent checkbox. They need a short, honest notice: who you are, what you do with the message, how long you keep it and where to ask about it. This writes that notice, the HTML to sit above your submit button and the matching section for your privacy policy, with an unticked checkbox only for optional extras such as a newsletter. It runs in your browser. It is a careful starting point, not legal advice.

Your organisation

Organisation name

Email for privacy questions

Postal address (optional)

Data protection officer email (if you have one)

Link to your full privacy policy (optional)

Without one, the full text goes in a collapsible section beside the form, because it has to be on the page where the details are collected.

What the form is for

Optional extras, each with its own unticked box

Add people to an email newsletter if they askKeep applications on file for future vacancies if the applicant agrees (job applications only)

Who processes the form

Plan, which sets when stored submissions are deleted

AI spam classifier on for this form (the default). It can send submission content to a classification service outside the EEA, so the text says so while it is on.

Other places submissions reach you (optional)

Retention and law

How long you keep the copies that reach you

WebForms deletes its own copy automatically after 30 days on Free. Emails in your inbox and messages in other tools are yours to delete.

Your supervisory authority (optional)

Add your organisation name and privacy contact email above. Until then the text below shows a bracketed placeholder.

1. The notice beside the submit button

Notice

[Organisation name] uses the details you send only to reply to your enquiry, and keeps them for 12 months after our last reply. To see, correct or delete your details, email [privacy contact email]. Full details are below.

2. The HTML, pasted just above your submit button

form.html

<p class="form-privacy">[Organisation name] uses the details you send only to reply to your enquiry, and keeps them for 12 months after our last reply. To see, correct or delete your details, email [privacy contact email]. Full details are below.</p>
<details class="form-privacy-details">
  <summary>How we use your details</summary>
  <p>[Organisation name] is responsible for the information you send through this form. For anything about your data, email [privacy contact email].</p>
  <p>We use the details you enter, such as your name, email address and message, to reply to you and deal with what you asked about. We rely on our legitimate interest in answering the messages people send us (Article 6(1)(f) GDPR). Where your message is about using our services, replying is also a step you have asked us to take before a possible contract (Article 6(1)(b) GDPR). You do not have to contact us, but we need a way to reach you in order to reply.</p>
  <p>Along with what you type, our form service records a few technical details: your IP address, your browser type, the page the form was sent from and how long it took to fill in. These are used to protect the form against spam and misuse, which is in our legitimate interest in keeping it working (Article 6(1)(f) GDPR).</p>
  <p>This form is processed for us by WebForms, a form service that stores submissions on servers in Germany and forwards them to us. WebForms acts only on our instructions under a data processing agreement and publishes the providers it uses at <a href="https://webforms.to/dpa#subprocessors">https://webforms.to/dpa#subprocessors</a>. To filter spam, the content of a submission may be checked by a spam classification service in the United States or Singapore. Where a provider is outside the EEA, WebForms relies on an adequacy decision or Standard Contractual Clauses, as its data processing agreement sets out.</p>
  <p>Every submission is checked automatically for spam. A message that looks like spam is held for review instead of being forwarded to us, so if you do not hear back, please email [privacy contact email].</p>
  <p>WebForms deletes its copy of each submission automatically 30 days after it arrives. We keep the copies that reach us for 12 months after our last reply, then delete them.</p>
  <p>You can ask us for a copy of your information, and ask us to correct it, delete it or limit how we use it. Where we rely on consent or on steps before a contract, you can also ask for it in a portable format. To do any of this, email [privacy contact email].</p>
  <p>Your right to object: where we rely on legitimate interests, you can object at any time, on grounds relating to your situation, by emailing [privacy contact email].</p>
  <p>You can also complain to a data protection supervisory authority, in particular in the country where you live or work or where you think the problem happened.</p>
</details>

No checkbox, because nothing here needs consent: replying to the person who wrote to you is the reason the form exists.

3. The section for your privacy policy

Our contact form [Organisation name] is responsible for the information you send through this form. For anything about your data, email [privacy contact email]. We use the details you enter, such as your name, email address and message, to reply to you and deal with what you asked about. We rely on our legitimate interest in answering the messages people send us (Article 6(1)(f) GDPR). Where your message is about using our services, replying is also a step you have asked us to take before a possible contract (Article 6(1)(b) GDPR). You do not have to contact us, but we need a way to reach you in order to reply. Along with what you type, our form service records a few technical details: your IP address, your browser type, the page the form was sent from and how long it took to fill in. These are used to protect the form against spam and misuse, which is in our legitimate interest in keeping it working (Article 6(1)(f) GDPR). This form is processed for us by WebForms, a form service that stores submissions on servers in Germany and forwards them to us. WebForms acts only on our instructions under a data processing agreement and publishes the providers it uses at https://webforms.to/dpa#subprocessors. To filter spam, the content of a submission may be checked by a spam classification service in the United States or Singapore. Where a provider is outside the EEA, WebForms relies on an adequacy decision or Standard Contractual Clauses, as its data processing agreement sets out. Every submission is checked automatically for spam. A message that looks like spam is held for review instead of being forwarded to us, so if you do not hear back, please email [privacy contact email]. WebForms deletes its copy of each submission automatically 30 days after it arrives. We keep the copies that reach us for 12 months after our last reply, then delete them. You can ask us for a copy of your information, and ask us to correct it, delete it or limit how we use it. Where we rely on consent or on steps before a contract, you can also ask for it in a portable format. To do any of this, email [privacy contact email]. Your right to object: where we rely on legitimate interests, you can object at any time, on grounds relating to your situation, by emailing [privacy contact email]. You can also complain to a data protection supervisory authority, in particular in the country where you live or work or where you think the problem happened.

Does a contact form need a GDPR consent checkbox?

Not for the message itself. Consent is one of six lawful bases in Article 6(1), and replying to someone who wrote to you usually rests on one of the others. Answering a question about your services is a step taken at the person's request before a possible contract, Article 6(1)(b); the European Data Protection Board's guidelines on that article say replying to an enquiry about a controller's service offerings can be based on it. Other messages fall under legitimate interests, Article 6(1)(f): you have an obvious interest in answering the people who write to you, and they expect a reply.

Asking for consent anyway adds no protection. The ICO puts it plainly: if you would still process the data when consent is refused, asking for it is “misleading and inherently unfair”. A required “I agree to the privacy policy” box makes it worse, because consent made a condition of sending the message is presumed not to be freely given (Article 7(4) and Recital 43). A box that only says “I have read the privacy policy” is not needed either. Germany's data protection authorities, in a 2018 decision about medical practices, said the information duty is met by giving people the chance to read the information; they do not have to confirm it.

When you do need consent

Consent is for extras the person can refuse and still send the form: joining a newsletter, or keeping a job application on file for future vacancies. Each extra gets its own box, which the EDPB's guidelines on consent call granularity. The box starts unticked, and leaving it unticked changes nothing about how the enquiry is handled. Pre-ticked boxes are not consent: Recital 32 says so, and the Court of Justice confirmed it in Planet49 (C-673/17, 2019), a cookie case in which it applied the GDPR's definition of consent.

An email newsletter is also covered by the ePrivacy rules, which require prior consent for email marketing apart from a narrow soft opt-in for existing customers (Article 13 of Directive 2002/58/EC, and PECR in the UK). You must be able to show who agreed, when and to what wording (Article 7(1)), so the generator puts the wording in the checkbox's value and it arrives with the submission. In Germany, sign-ups are often confirmed by double opt-in, a confirmation email the person clicks before the first issue, and the Federal Court of Justice has accepted it as a way to show consent to email advertising. Your mailing list tool sends that email, not the form.

On WordPress, Contact Form 7's acceptance tag is required by default and keeps the submit button disabled until it is ticked. For a newsletter box, add the optional option, as in [acceptance newsletter optional], and never use default:on.

The Article 13 checklist for a contact form

Article 13 applies whenever you collect personal data from the person directly, which a contact form always does, and it applies at the moment of collection. For a contact form that means telling people:

who you are and how to reach you, and your data protection officer if you have one
what you use the details for, and the lawful basis for each purpose
the legitimate interest, where you rely on one
who receives the data, including the form service and the tools submissions reach
any transfer outside the EEA or UK, and the safeguard used
how long you keep it
their rights, including withdrawing consent and complaining to a supervisory authority
whether they have to give the details, and what happens if they do not

The transparency guidelines endorsed by the EDPB accept a layered approach: a short first layer at the form covering the purpose, who you are and people's rights, with a link to the full text. That is the shape of the output. Without a privacy page, the full text goes in a collapsible section beside the form. The right to object gets its own paragraph, because Article 21(4) asks for it to be presented clearly and separately.

Retention, processors and where the data is stored

Storage limitation, Article 5(1)(e), means choosing how long you keep enquiries and then deleting them. Pick a period you will actually keep to, such as 12 months after your last reply, and make it shorter where you can.

A form backend is a processor, so you need an Article 28 agreement with it and should name it in your notice. WebForms stores submissions on servers in Germany, and its data processing agreement applies to every account without anything to sign. Stored submissions are deleted automatically once they pass the plan's retention window: 30 days on Free, 180 on Pro and 365 on Agency, with uploaded files removed 30 days after upload. The subprocessors, including the spam classifiers that can see submission content while the AI check is on, are listed in the privacy policy. Copies that reach your inbox, Slack or a webhook are outside that schedule and yours to delete. The guide for nonprofits covers this for charities handling supporter data.

What this generator does not do

It does not handle the unusual cases. Public authorities cannot rely on legitimate interests for their tasks (the last paragraph of Article 6(1)), forms that collect health or other special category data need an Article 9 condition as well, and job applications can be subject to national employment rules under Article 88.

It does not cover cookies, analytics or captchas on the page. A captcha that loads a third-party script sends data to that provider, which your privacy policy needs to cover; the guide to reCAPTCHA alternatives under GDPR goes into that. It does not translate, and it cannot know what your organisation really does with the messages, so read the output against your own process before you publish it.