GDPR compliant contact form: a checklist

A contact form processes personal data, so the GDPR applies. The list below covers the points that come up for almost every form on a German or European website.

As of 2 November 2026. This is not legal advice. For your specific case, ask your data protection officer or a lawyer.

The checklist

1. Pick the legal basis. A normal enquiry needs no consent. If it is about a quote or a contract, Art. 6(1)(b) GDPR applies; for general questions usually point (f), the legitimate interest in answering. You only need consent under point (a) if you want to use the data for more, such as a newsletter.
2. Make only the necessary fields required. Art. 5(1)(c) requires data minimisation. An email address and a message are usually enough to reply. You can offer name, phone or company fields, but don't make them mandatory.
3. Point to your privacy notice at the form. Art. 13 requires you to inform people when you collect data: who is responsible, the purpose, the legal basis, recipients and how long you keep it. A short sentence linking to your privacy policy right above the button does the job.
4. Send over HTTPS only. Art. 32 requires appropriate security, so both the page and the form's target URL use HTTPS.
5. Sign a DPA with your form service. A service that processes submissions on your behalf is a processor. Art. 28 requires a data processing agreement with it.
6. Check transfers outside the EU. If the service is based outside the EU or uses servers there, Art. 44 et seq. apply. You then need a basis such as an adequacy decision or standard contractual clauses, and you have to name the transfer in your privacy policy.
7. Set a retention period. Under Art. 5(1)(e) you keep data no longer than needed. Decide when enquiries are deleted, both in the form service and in your inbox.
8. Pick a captcha without tracking. If a captcha reads information from the device or loads third-party scripts, Germany's § 25 TDDDG often requires consent for it. A honeypot field, or a captcha that works without a third party, avoids that.
9. Never pre-tick a consent box. If you do need consent, the person has to tick the box themselves. A pre-ticked box is not valid consent (CJEU, judgment of 1 October 2019, C-673/17, Planet49).

Sample notice for the form

Put this sentence right above the send button and change the link to your privacy policy:

<p>When you send this form, we process your details to answer your enquiry (Art. 6(1)(b) or (f) GDPR). More in our <a href="/privacy">privacy policy</a>.</p>

What Mailiy takes care of

• Servers at Hetzner in Germany, no transfer to third countries.
• The DPA applies from sign-up, no signature needed.
• Submissions are stored encrypted. You set the retention per form, down to “Don't store”.
• A honeypot is always included. For a captcha there is ALTCHA, which runs in the browser and needs no third party.
• Mailiy sets no trackers and no cookies on your form.

The notice at the form, the legal basis and your privacy policy are yours to decide. No service can do that for you.

Frequently asked questions

Does a contact form need a consent checkbox?

Usually not. If you only answer the enquiry, you rely on Art. 6(1)(b) or (f) GDPR. A notice linking to your privacy policy is enough.

Is Google reCAPTCHA allowed in a contact form?

reCAPTCHA loads scripts from Google and evaluates information about the device. That usually requires consent and involves a transfer to the US. A honeypot or a captcha without a third party is simpler.

How long may I keep contact enquiries?

As long as you need them for the enquiry. If it turns into a deal, the retention rules for business correspondence apply. The GDPR names no fixed number.

Setup steps for WordPress, Webflow, React and more are in the guides.

Start for free