The moment a form asks for a name, an email address or anything else about a person, the GDPR comes into play. That can sound heavy, especially for a small team that just wants to collect sign-ups or feedback. The good news is that for most forms, being GDPR-friendly comes down to a handful of clear habits.
This article walks through those habits, step by step. It's practical guidance, not legal advice. If your situation is complex, or you collect sensitive information, it's worth checking with a privacy adviser.
Start with one clear purpose
Before you add a single question, write down in one sentence what the form is for. "We use this form to register people for our open day." "We use this form to answer questions from potential clients."
That sentence does a lot of work. It tells you which questions belong in the form, it becomes the core of what you tell people, and it stops the form from slowly turning into a general data collection tool. Under the GDPR, you collect personal data for a specific purpose and don't quietly reuse it for something unrelated later.
If you notice the form has two jobs, for example registering for an event and building a mailing list, treat them as two separate purposes. That matters when we get to consent.
Ask only what you need
Data minimisation is one of the core principles of the GDPR: collect what you need for your purpose, and nothing more. For forms, that's a very practical rule. For every question, ask yourself: what will we actually do with this answer?
- Do you need a full address, or only a postcode or city?
- Do you need a date of birth, or only to know that someone is over 18?
- Do you need a phone number if you'll only reply by email?
Every question you remove is data you don't have to protect, store or delete later. It also makes the form shorter and kinder to fill in. We wrote more about this in How long should a form be?
Tell people what happens with their answers
People have a right to know what you do with their data. You don't need a wall of text inside the form for that. A short, plain line near the submit button, plus a link to your full privacy notice, usually does the job.
Your privacy notice covers the full picture: who you are and how to reach you, why you collect the data and on what basis, who receives it, how long you keep it, and what rights people have, such as access and deletion. The line in the form is the friendly summary. For example:
"We use your details only to register you for the open day and send you practical information about it. We delete them two months after the event. See our privacy notice."
Only say it if it's true. A short, honest promise you keep builds far more trust than a long one nobody can check.
Consent checkboxes: when you need one, and when you don't
Not every form needs a consent checkbox. If someone sends you a question, you can use their details to answer it: that's why they contacted you. If someone registers for an event, you can use their details to organise their place. You still have to inform them, but you don't have to ask permission for the very thing they asked you to do.
Consent becomes important for the extras, the things people didn't come for:
- adding them to a newsletter or marketing emails;
- sharing their details with a partner or sponsor;
- publishing their answer, name or photo, for example as a testimonial.
When you do ask for consent, a few rules make it valid and fair:
- Unticked by default. Silence or a pre-ticked box is not consent.
- One purpose per checkbox. "Send me the newsletter" and "share my details with sponsors" are two separate choices.
- Not a condition for something unrelated. Don't make the newsletter checkbox mandatory to register for an event.
- Plain language. Say what they're agreeing to in a sentence anyone can understand.
- Easy to withdraw. Stopping should be as easy as signing up, and you should say how.
- Keep a record. Note when someone gave consent and what the wording was at that moment.
A checkbox that says "I have read the privacy policy" is usually not needed. Informing people is your job, and a clear link does that. Keep checkboxes for real choices.
Be careful with sensitive questions
Some information is extra sensitive under the GDPR: for example data about health, religion or beliefs, ethnic origin, political opinions, sexual orientation or trade union membership. The rules for collecting these are much stricter.
Everyday forms can touch this without anyone intending to. A question about dietary requirements can reveal something about someone's health or religion. A question about accessibility needs can reveal something about a disability. That doesn't mean you can't ask, because these questions often help people feel welcome. It does mean you need a valid exception under article 9 of the GDPR, in practice usually the person's explicit consent, and that you should:
- only ask when you'll genuinely use the answer, for example to plan catering or seating;
- make the question optional where you can, and say why you're asking;
- limit who can see the answers;
- delete them as soon as they've done their job, for example after the event.
If you're thinking of asking for anything more sensitive than that, get advice first.
Decide who sees the answers, and for how long
Form answers have a way of spreading: an export here, a forwarded spreadsheet there, a copy in someone's downloads folder. Before you publish, agree on two things.
Who can see the answers. Only the people who need them for the purpose. The catering team needs dietary requirements, not everyone's phone number.
How long you keep them. The GDPR doesn't set a fixed term. You keep data as long as you need it for the purpose, then delete it. So pick a moment that fits: after the event, once a question is answered and followed up, or when a recruitment round is closed. Write it down and put a reminder in your calendar. A retention period only works if someone actually deletes the data.
Choose a form tool that's clear about data
When a form tool stores your respondents' answers for you, it processes personal data on your behalf. The GDPR expects you to have a data processing agreement with such a provider, and to know what happens with the data. Things worth checking:
- Where is the data stored, and is that clearly stated?
- Does the provider offer a data processing agreement?
- Which other services (sub-processors) are involved?
- Can you export and fully delete responses yourself?
- Can you control who in your team has access?
A provider that answers these questions in plain language makes your own privacy notice much easier to write.
A quick checklist before you publish
- The form has one clear purpose, written down in one sentence.
- Every question has a reason, and "just in case" questions are gone.
- There's a short line about what happens with the answers, plus a link to your privacy notice.
- Consent is only asked for extras, with unticked, separate checkboxes.
- Sensitive questions are optional, explained and truly needed, and you ask explicit consent for them.
- You know who can see the answers.
- You've decided when the answers will be deleted, and someone will actually do it.
- Your form tool has a data processing agreement and clear information about where data is stored.
How we're thinking about this at Cuppaform
Cuppaform is still being built, and privacy is something we want to get right from the start rather than bolt on later. Our live demo is rule-based and runs entirely in your browser, so nothing you type there is sent anywhere. As we build the real product, we're working on making it easy to ask only what you need and to be clear with the people filling in your forms. Our privacy policy already explains how we handle data on this website, such as the waitlist, the contact form and, only if you accept cookies, Google Analytics. Before the form builder goes live, we'll update it to explain exactly how your respondents' data is handled.
You can try the demo to see what a short, friendly form feels like.