Surveys
Introduction
Picture this. A small online store runs a newsletter signup form, a contact form, and a returns form. One day, a customer asks the team to delete all the personal information the business holds about her.
The team checks its form builder, then a shared spreadsheet, an old email thread, and a marketing platform. Eventually, they discover that a freelancer also has a copy of the information on a personal laptop. Nobody is completely sure where the data is stored or how long it should be kept.
This is a common problem for businesses that collect personal information through online forms. A form may look like a simple collection of fields, but every submission can create responsibilities around privacy, security, consent, and data retention.
The General Data Protection Regulation (GDPR) sets rules for how personal data must be collected and processed when the regulation applies. These rules affect more than large companies. Small businesses, online stores, agencies, healthcare providers, and website owners may all need to consider GDPR compliance for their online forms.
The good news is that the basic approach is manageable: collect only what you need, explain why you need it, use an appropriate legal basis, protect the information, and establish a process for handling requests.
This guide explains GDPR form requirements, consent checkbox rules, privacy notices, data retention, and practical steps for creating GDPR compliant forms.
What Are GDPR Compliant Forms?
GDPR compliant forms are online forms designed to collect, process, and store personal data in accordance with the General Data Protection Regulation.
Personal data is information relating to an identified or identifiable individual. It can include:
Full name
Email address
Phone number
Home or business address
Location information
IP address and online identifiers
Photographs and other identifying information
Even a basic contact form that asks for a name and email address involves personal data.
GDPR does not automatically apply to every website that can be accessed from Europe. Its territorial scope includes organisations established in the EU and certain organisations outside the EU that offer goods or services to people in the EU or monitor their behaviour there.
When GDPR applies, businesses need to consider how every form handles personal information, from the moment someone enters their details to the point when the information is deleted.
Two important roles are worth understanding:
Data controller: The organisation that determines why and how personal data is processed. For example, a business deciding to collect customer enquiries through its website is generally the controller for that activity.
Data processor: An organisation that processes personal data on behalf of the controller. A form platform, email provider, or cloud storage service may act as a processor depending on the arrangement.
The controller remains responsible for ensuring that the processing is lawful and that appropriate safeguards are in place.
Why GDPR Compliance Matters for Online Forms
Forms are often the first place where a business collects personal information. If they are poorly designed, they can create privacy problems that spread across the organisation.
Here is why GDPR compliance matters.
1. It helps reduce legal risk
Serious GDPR infringements can result in administrative fines of up to €20 million or 4% of an organisation's total worldwide annual turnover for the preceding financial year, whichever is higher. The applicable maximum depends on the type of infringement.
2. It builds customer trust
People are more comfortable sharing information when they understand why it is being collected and what will happen to it. A clear privacy notice and straightforward consent options show that a business takes personal information seriously.
3. It improves data management
Collecting fewer details makes information easier to organise, review, secure, and delete. It also reduces the number of unnecessary records that employees need to manage.
4. It makes customer requests easier to handle
When a person asks to access, correct, or delete their information, a business should know where the data is stored and who is responsible for responding.
5. It encourages better form design
Privacy-conscious forms avoid unnecessary questions and confusing consent requests. This can make the experience clearer and less intimidating for visitors.
The Seven GDPR Principles Every Online Form Should Follow
Article 5 of the GDPR establishes seven principles that guide personal data processing. Each has a practical application when creating GDPR forms.
1. Lawfulness, Fairness and Transparency
You need a valid legal basis for processing personal data and must explain your practices clearly.
For example, a contact form should tell visitors that their details will be used to respond to their enquiry. Do not hide important information in complicated legal language.
2. Purpose Limitation
Collect personal information for specific, explicit, and legitimate purposes.
If someone submits a support enquiry, that does not automatically mean their details can be added to a promotional mailing list. A separate lawful basis is needed for the additional marketing activity.
3. Data Minimization
Ask only for information that is necessary for the purpose.
A newsletter signup generally does not need a home address, date of birth, or phone number. An email address may be sufficient.
4. Accuracy
Keep personal information accurate and up to date where necessary.
Use appropriate field validation, such as checking email address formats, and provide a way for people to correct their details when needed.
5. Storage Limitation
Do not retain personal information longer than necessary for the purpose for which it was collected, subject to applicable legal requirements.
Create a retention schedule for different types of form submissions rather than keeping everything indefinitely.
6. Integrity and Confidentiality
Protect personal information against unauthorised access, accidental loss, and improper disclosure.
Use HTTPS, restrict access to responses, review permissions, and choose service providers with suitable security measures.
7. Accountability
Your organisation must be able to demonstrate that it follows the GDPR principles.
Keep records of what information you collect, why you collect it, the legal basis, who can access it, and how long it is retained.
How to Handle GDPR Form Consent Correctly
One of the most common misunderstandings about GDPR consent forms is the belief that every online form needs a consent checkbox.
That is not correct.
Consent is one of six lawful bases under Article 6 of the GDPR. The appropriate basis depends on the purpose and circumstances of the processing.
The six lawful bases are:
Consent
Performance of a contract
Compliance with a legal obligation
Protection of vital interests
Performance of a public task
Legitimate interests, where the relevant balancing requirements are met
For example, an online store may need a customer's name and delivery address to fulfil an order. Processing those details may be necessary for performing the contract, so a separate consent checkbox is not automatically required for that purpose.
A newsletter signup, on the other hand, commonly relies on consent for sending marketing emails.
What Makes Consent Valid?
When consent is the chosen legal basis, it must meet specific requirements.
Freely given: People must have a genuine choice. Refusing optional marketing should not normally prevent them from using an unrelated service.
Specific: Consent should relate to clearly identified purposes. Do not combine unrelated activities into one vague checkbox.
Informed: Explain who is collecting the information and how it will be used before asking for consent.
Unambiguous: Consent requires a clear affirmative action. An empty checkbox that the user actively selects is a common approach.
Easy to withdraw: People must be able to withdraw consent as easily as they gave it.
Pre-ticked boxes, silence, and inactivity do not count as valid consent.
You should also retain evidence of consent where you rely on it. Records may include the date and time, the wording shown, the purpose, the form or source, and the action taken by the individual.
For more information, see the European Commission's guidance on consent and data protection.
What Should a GDPR Privacy Notice Include?
A GDPR privacy notice for forms explains what happens to personal information after someone submits it.
It should be available when the information is collected, usually through a short explanation near the form and a link to the full privacy policy.
A useful privacy notice should explain:
Who collects the information: Include the organisation's name and relevant contact details.
Why the information is collected: Explain the purpose, such as responding to an enquiry or processing an order.
The legal basis: Identify the applicable lawful basis for processing.
Who receives the information: Explain relevant recipients, such as service providers or processors.
International transfers: Explain relevant transfers outside the EU and the safeguards used where applicable.
Retention period: State how long the information will be kept or the criteria used to determine that period.
Individual rights: Explain relevant rights, including access, correction, erasure, restriction, objection, and portability.
Complaints: Explain the right to lodge a complaint with a supervisory authority.
Keep the explanation readable. A short summary near the submit button can make important information easier to understand, while the full privacy notice provides additional details.
Avoid copying a privacy notice from another website. Your notice must reflect your own data collection and processing activities.
A Practical Example of a GDPR-Compliant Newsletter Form
Consider an online store that wants visitors to subscribe to its weekly newsletter.
A simple form could look like this:
Newsletter signup
First name (optional)
Email address (required)
I agree to receive promotional emails and product updates from [Business Name]. I understand that I can unsubscribe at any time.
Your information will be used to send the updates you request. Read our [Privacy Policy] to learn how we handle personal data.
Subscribe
This example demonstrates several useful practices.
The form asks for only the information needed to send the newsletter.
The marketing consent checkbox is empty by default.
The purpose of the consent request is clear.
The privacy policy is accessible before submission.
The visitor can choose whether to subscribe.
The business can provide an unsubscribe process.
The business should also keep appropriate evidence of consent and make sure its email platform respects withdrawals.
This is an example, not a universal legal template. The wording and processing arrangements should reflect the organisation's actual practices.
Special Category Data and Children's Personal Information
Some personal information requires additional protection under GDPR.
Special category data includes information about:
Health
Racial or ethnic origin
Religious or philosophical beliefs
Political opinions
Trade union membership
Genetic data
Biometric data used for uniquely identifying someone
Processing this information is generally prohibited unless an applicable Article 9 condition allows it. In addition, the organisation needs an appropriate Article 6 lawful basis.
For example, a clinic collecting health information through a patient intake form must identify the relevant legal conditions, explain the purpose, and apply suitable security and access controls.
Do not collect sensitive information simply because a form builder makes it possible. First establish whether it is genuinely necessary.
Children's personal data also needs particular care. Under Article 8, when an online service is offered directly to a child and consent is the legal basis, parental authorisation may be required if the child is below the applicable age threshold. EU Member States can set this threshold between 13 and 16 years.
This rule does not mean that every form used by a school or youth programme automatically needs the same parental consent process. The context, service, and legal basis matter.
If your organisation collects information directly from children, use age-appropriate explanations and check the relevant national requirements.
Best Practices for Creating GDPR Compliant Forms
A privacy-conscious form should be easy to understand and should not collect information without a clear reason.
Here are practical GDPR form best practices.
Collect only necessary details. Review every field and remove information that is not required for the stated purpose.
Separate optional consent. Use distinct, unticked choices for different optional purposes, such as newsletters and promotional updates.
Make the privacy policy accessible. Place a clear link near the form submission area.
Limit access to responses. Only employees who need the information should be able to view it. Review permissions when team members leave or change roles.
Choose form tools carefully. Check security features, processor arrangements, data storage locations, and the availability of a suitable data processing agreement.
Create a retention policy. Define how long each type of submission is kept and what happens when that period ends.
Prepare for individual requests. Make sure someone is responsible for receiving and coordinating access, correction, and deletion requests.
Keep forms straightforward. Unnecessary questions create additional privacy risks and make the experience harder for visitors. These form design tips can help you create clearer questionnaires.
GDPR Compliance Checklist Before Publishing a Form
Before publishing any personal data collection form, review the following points.
The purpose of collecting information is clearly defined.
The appropriate lawful basis has been identified.
Every field has a clear business or service-related purpose.
Optional fields are clearly marked.
Marketing consent is separate where required.
Consent checkboxes are not pre-selected.
The privacy notice is accessible before submission.
Relevant recipients and service providers are understood.
Data storage and access permissions have been reviewed.
A retention period or retention rule is established.
There is a process for handling individual rights requests.
The form has been tested before going live.
This checklist is a practical starting point, not a certification that a form or business is legally compliant.
How to Audit Existing Online Forms for GDPR Compliance
Businesses often have more forms than they realise. A website may contain contact forms, job applications, event registrations, newsletter signups, feedback forms, and customer support forms.
Instead of reviewing them randomly, create a simple form inventory.
Step 1: List Every Active Form
Check your website, landing pages, email campaigns, registration pages, and embedded forms.
Include forms used by different departments, not just those visible on the homepage.
Step 2: Record the Information Collected
For each form, list every field and identify whether it collects personal or sensitive information.
Ask whether each field is genuinely necessary.
Step 3: Review the Purpose and Legal Basis
Write down why the business needs each piece of information and which lawful basis applies.
Do not automatically select consent for every form.
Step 4: Check the Privacy Notice and Consent
Confirm that visitors receive the required information and that optional consent requests are clear, specific, and separate.
Step 5: Review Where Responses Are Stored
Find out whether submissions are sent to email accounts, spreadsheets, CRMs, or other connected services.
Check who can access those systems and whether processor arrangements are appropriate.
Step 6: Check Retention and Deletion
Establish how long responses should remain available and how they are deleted when no longer needed.
Also check whether copies exist in connected systems, exports, and backups.
Step 7: Assign Responsibility
Decide who will review the forms periodically and who will coordinate privacy requests.
A documented process is much easier to maintain than relying on individual employees to remember what to do.
Real-World GDPR Form Examples by Business Type
Different forms create different privacy considerations. Here are three common examples.
1. Online Store With a Newsletter Signup
An online store asks for an email address and optional first name. It provides a separate, unticked marketing consent checkbox and links to its privacy notice.
Customers who do not subscribe can still browse and purchase products. Subscribers can unsubscribe through a clear process.
2. Agency Using Contact and Lead Forms
A marketing agency collects a visitor's name, work email, and enquiry message.
The form explains that the information will be used to respond to the enquiry. If the agency also wants to send promotional emails, it considers a separate lawful basis for that purpose rather than automatically adding every enquiry to its mailing list.
3. Clinic Using Patient Intake Forms
A clinic collects information needed to prepare for an appointment, including relevant health details.
Because health information is special category data, the clinic must identify the applicable Article 6 lawful basis and Article 9 condition. It should restrict access to appropriate staff and use suitable safeguards for storing and sharing submissions.
For organisations managing several types of forms, Ovoform's form templates can provide a starting point for organising fields and questions. The legal wording and data-handling process still need to be reviewed for the organisation's own circumstances.
Common GDPR Form Mistakes to Avoid
Even businesses that understand the basic GDPR principles can make mistakes when implementing them.
Using consent for everything: Consent is not the only lawful basis. Identify the correct basis for each processing purpose.
Combining unrelated permissions: A single checkbox for service terms, marketing emails, and third-party sharing can prevent people from making meaningful choices.
Using pre-ticked boxes: Consent must involve a clear affirmative action.
Collecting unnecessary personal data: Avoid requesting details that have no clear connection to the form's purpose.
Copying another company's privacy policy: A policy must accurately describe your own processing activities.
Keeping responses indefinitely: Create a retention schedule and follow it.
Ignoring third-party tools: Form responses may be copied into email platforms, spreadsheets, CRMs, and other services. Include these systems in your privacy review.
Forgetting about data subject requests: Assign responsibility for requests and create a process to locate information across relevant systems.
Assuming a secure form builder guarantees compliance: A tool can provide useful security and data-management features, but it cannot decide your legal basis, write an accurate privacy notice, or make your organisation compliant by itself.
How to Build GDPR Compliant Forms Without Technical Help
You do not necessarily need a developer to create a privacy-conscious online form. Many form builders offer visual editors that let you add fields, consent checkboxes, explanatory text, and confirmation messages.
A practical process looks like this:
Choose the type of form you need, such as a contact, newsletter, registration, or feedback form.
Add only the fields required for its purpose.
Configure required and optional fields appropriately.
Add separate consent choices where consent is the relevant legal basis.
Include a short privacy explanation and a link to your privacy policy.
Check where responses will be stored and who can access them.
Test the form on desktop and mobile before publishing.
Document the retention and request-handling process.
Conditional logic can also help keep forms relevant. For example, a form might display additional questions only when someone selects a particular service. However, conditional questions should still follow data minimization principles.
You can explore conditional logic in forms to understand how branching questions work.
When reviewing a form platform, consider whether it provides appropriate access controls, secure data handling, processor documentation, and the integrations your team needs. Ovoform's features offer a visual way to create and manage forms, while its integrations can help connect form workflows with other tools.
For teams that need to review collected submissions, form analytics can help with response analysis. Remember that the platform is only one part of the compliance process. Your organisation remains responsible for how personal data is collected and used.
Final Thoughts
GDPR compliant forms are not simply forms with a privacy policy link or a consent checkbox. They are part of a wider process for collecting, using, protecting, and managing personal information responsibly.
Start by understanding why each form collects data. Remove unnecessary fields, identify the correct lawful basis, explain your practices clearly, and make sure information is stored securely.
Then establish a retention schedule and a process for handling requests from individuals. Review connected tools and make sure personal information is not quietly copied into systems that nobody monitors.
You do not have to redesign every form at once. Start with the forms that collect the most personal information, identify the gaps, and improve them step by step.
The result should be a better experience for visitors and a more organised approach to privacy across your business.
This article provides general educational information and is not legal advice. GDPR requirements depend on the organisation, the type of processing, and the circumstances involved. Seek qualified legal or data protection advice for specific compliance decisions.
