GDPR and Contact Forms: What You Must Consider
Design contact forms GDPR-compliant - technical requirements, legal obligations and practical implementation for Austrian websites.
GDPR and Contact Forms: What You Must Consider
A contact form is often the most important interface between you and your potential customers. But: Contact forms process personal data - and are therefore subject to GDPR. How to design your contact form legally secure, you'll learn here.
Important note: This article provides technical information, not legal advice. For legal questions, please consult a specialist lawyer for data protection law.
Why GDPR is Important for Contact Forms
The Risks of Violations
The Good News
With the right technical implementation, a GDPR-compliant contact form is not rocket science.
The 7 GDPR Principles for Contact Forms
1. Lawfulness of Processing
You need a legal basis:
Practical tip: Obtain explicit consent - that's the safest way.
2. Purpose Limitation
You may only use data for the stated purpose:
Allowed:
Not allowed (without separate consent):
3. Data Minimization
Only ask what you really need:
Usually sufficient:
Avoid:
4. Storage Limitation
Delete data when you no longer need it:
5. Integrity & Confidentiality
Technical measures:
6. Transparency
Inform about:
7. Accountability
Document:
Technical GDPR Requirements
1. SSL Encryption (Mandatory!)
What is this?
HTTPS instead of HTTP - recognizable by the lock symbol in the browser bar.
Why important?
Costs:
Usually free (Let's Encrypt)
2. CAPTCHA or Spam Protection
Purpose:
GDPR-compliant options:
3. Privacy Checkbox (Mandatory!)
Correct:
```
☐ I have read the privacy policy and accept the processing of my data to handle my inquiry.
```
Wrong:
Important: The checkbox may NOT be pre-checked!
4. Link to Privacy Policy
Link directly at the form:
5. No Disclosure to Third Parties
Caution with:
Solution:
The Perfect GDPR-Compliant Contact Form
Required Fields
1. Name (first name + last name)
2. Email address
3. Message/inquiry
4. Privacy checkbox (not pre-checked!)
Optional Fields
Form Texts
Checkbox label:
```
☐ I agree that my data will be stored to process my inquiry.
The data will be deleted after processing is complete.
Note: You can revoke your consent at any time for the future
by email. Detailed information can be found in our
[Privacy Policy](#).
```
Notice under the form:
```
Your data is transmitted encrypted via SSL and used exclusively
to process your inquiry.
```
Privacy Policy: What Must Be Included
"Contact Form" Section
Your privacy policy must contain:
1. Which data is collected
- Name, email, message, IP address, timestamp
2. Legal basis
- Consent according to Art. 6(1)(a) GDPR
3. Purpose of processing
- Processing and answering the inquiry
4. Storage period
- Until processing of inquiry, max. 3 years
5. Recipients
- Only internal, possibly hosting provider (with DPA)
6. Data subject rights
- Information, correction, deletion, objection
7. Right of withdrawal
- Possible at any time, by email
Technical Implementation
Backend Requirements
Secure data processing:
```
✓ Form validation (server-side!)
✓ SQL injection protection
✓ XSS protection (cross-site scripting)
✓ CSRF protection (cross-site request forgery)
✓ Rate limiting (against spam)
```
Data storage:
```
✓ Encrypted database
✓ Access restrictions
✓ Logging of access
✓ Regular backups (encrypted)
```
Email sending:
```
✓ TLS encryption
✓ SPF/DKIM records
✓ No plaintext password
```
Frontend Best Practices
User-friendliness:
Accessibility:
Avoid Common Mistakes
❌ Mistake 1: No SSL Encryption
Data is transmitted unencrypted - serious violation!
❌ Mistake 2: Pre-Checked Checkbox
Consent must be active, not passive.
❌ Mistake 3: No Privacy Policy Linked
Users must know what happens to their data.
❌ Mistake 4: Too Many Required Fields
Only ask what you really need (data minimization).
❌ Mistake 5: Data Stored Too Long
Delete data after purpose fulfillment.
❌ Mistake 6: Disclosure to Newsletter Tool Without Consent
Separate checkbox for newsletter required!
❌ Mistake 7: No Proof of Consent
Document when who consented (double opt-in).
Newsletter Signup vs. Contact Form
Important: Newsletter signups have stricter requirements!
Contact Form
Newsletter Signup
Solution: Use separate checkboxes!
```
☐ I would like to receive the newsletter and can revoke this consent
at any time.
```
Responsibilities & Documentation
Processing Register
You must document:
Data Processing Agreements (DPA)
Required with:
Tip: Many professional providers offer standard DPAs.
Checklist: GDPR-Compliant Contact Form
Technical
Legal
Content
Organizational
Hosting & Server Location
EU Hosting Recommended
US Hosting Possible, But...
Recommendation: Use hosting providers in Austria, Germany or the EU.
[More about managed hosting](/de/managed-hosting)
Conclusion
A GDPR-compliant contact form is feasible and not overly complicated if you observe the most important points:
1. SSL encryption is mandatory
2. Privacy checkbox may not be pre-checked
3. Privacy policy must be linked and complete
4. Only necessary data query
5. Secure technical implementation
We Help You
Unsure about technical implementation? We implement GDPR-compliant contact forms:
[Get advice now](/de#contact)
---
More helpful articles:
---
Legal notice: This article does not constitute legal advice. For binding legal information, please contact a specialist lawyer for data protection law.
---
*Need a GDPR-compliant contact form for your website? [Contact us](/de#contact) for a free consultation.*