Contact forms and data protection: What should I bear in mind?

Many websites offer a contact form to make it easier for visitors to communicate or to receive messages in a more structured and targeted manner. How much information is mandatory? Should the user be asked to confirm the data protection information? These and other questions are answered in this article to ensure legal certainty when using contact forms.

Introduction

Contact forms regularly provide conversation topics because data protection issues arise from them. In reality, it's quite simple to offer a contact form, or even several, if a few basic rules are followed.

As with any kind of data processing, there are also small risks associated with contact forms, which can be minimized. Ultimately, the risk is manageable and not higher than in communication via an email address offered on the website.

Contact forms offer better opportunities to avoid spam than pure e-mail communication. However, anyone using Google reCAPTCHA here is in a bad legal position.

The following recommendations help quickly create secure contact forms and know the legal questions. By the way, this is not about newsletter forms, for which your own rules apply. Most of the mentioned hints are also transferable to forms with which interested parties can subscribe to your information in your newsletter.

Recommendations for contact forms

Each individual recommendation provides more legal security when taken into account. At the end you have a website with as many forms as needed. The data protection rules prescribed by the GDPR are complied with.

As always in legal matters, there is no absolutely correct procedure, but only an increase in legal certainty. Even if you do everything right (whoever decides that), someone can send you a warning or sue you. The only problem is that your opponent will be left holding the bag and will be left with the costs.

The general contact form

One form for everything is possible and permitted. However, you should only use this central point of contact as a first point of contact. This form should not mutate into a one-size-fits-all tool in which all the data in the world is requested. Here is my recommendation for the information that should be requested in a collective form:

• Message: That's what the contact form is for.
• Mail address: This is the only way you can reply.
• Name or pseudonym: Often you do not need the real name of a person. But often the name is also important to know. Use common sense to decide whether you need the real name or not. On my website, for example, I don't need the real names of people who send me feedback on my posts by e-mail and don't use the comment function. Of course, I can also write a reply to Hasemaus47 if I feel like it (whether I reply is up to me if there is no obligation; I always reply if the letter is serious and deserves a reply).
• Telephone number: Only if useful and often needed. Mark as optional if necessary.

I would not ask for more data in a general form. It depends on the focus of your website or activity whether you need other general information. However, most companies will be able to live very well with the above. Medical practices, daycare centers or car repair shops may also need a person's telephone number.

Required fields and optional fields

For every statement you ask in the form, you should think whether the statement is necessary or not. Necessary statements are obviously always the message text and the email address of the writer, so that someone can be reached for a response.

The name of the person writing is often not important. Even for general newsletters that are not sent to your customers, the name of the subscriber does not need to be known. See my Newsletter. For the newsletter subscription I only ask for the email address. Everything else interests me not. If someone wants to tell me something, then I will be written by mail. In this mail is often the name of the person mentioned who wants to tell me something. And that's because this person voluntarily mentions their name.

The more specific a contact form is, the more information can be marked as obligatory. In each individual case, it should be checked which information you would like to have and which you consider absolutely necessary. In some cases, certain information may be very desirable for you. For example, the operator of a kindergarten told me that you need the phone number because almost every inquiry is aimed at asking about a kindergarten place and therefore follow-up questions are necessary. In such cases, it should be checked how often you need the relevant information and make it a mandatory field if necessary.

The purpose of your form

Ask yourself the following question: Why do you need a form? Define the purpose or purposes. If you have only identified one purpose, then you obviously only need one form (or none).

Purposes for forms can be, for example:

• General contact: So you don't know ad hoc why you want to write to someone. After all, you offer goods or services or provide information. The contact will therefore probably ask you a question about your product or have a question about your explanations. Or the person writing would like to make a criticism, whatever.
• Making appointments: This is often the case with doctors or car dealerships.
• Callback request: Would you prefer to call and not send emails back and forth? Then offer this option and ask the interested party for their telephone number and a suitable time slot for a callback.
• Praise and criticism.
• Making contact in the customer area: Someone is a customer of yours and has logged into their customer account. With insurance companies, customers can place orders, request forms or give notice of termination, for example.
• Comment on an article. See below this article or on journalistic sites where readers can give their feedback.

If you have identified several purposes for which you would like to offer a form, then check which information is required in the form for each purpose. Purposes that have a lot of similarities in the required data and are also thematically close can be bundled together in one form.

Everything else belongs in different forms, unless you decide to offer a general contact form.

Provide information on data protection

Please specify briefly, what you will use the requested information for. Then link to your website's privacy policy. It can look something like this and be located below the form fields and above the submit button: