ChatBuildWhat customer data can you actually collect?
The legal rule and the commercial rule point the same way: ask for less.
The instinct when building a contact form is to ask for everything you might one day want. Company name, phone, budget, how they found you, a newsletter box ticked by default.
Every one of those fields costs you submissions, and several of them are not yours to ask for. The good news is that the legal rule and the commercial rule point the same way: ask for less.
The rule in one sentence
The GDPR requires that personal data be adequate, relevant and limited to what is necessary for the purpose you collect it for. That is data minimisation, Article 5(1)(c), and it is the principle that decides most small-business questions on its own.
Applied to a contact form, the test is simple: can you answer this enquiry without the field? If yes, the field should not be there. You can always ask in your reply, when there is a conversation and a reason.
You also need a reason to hold it
Collecting personal data requires a lawful basis — the GDPR lists six in Article 6. For a small business, three of them cover nearly everything:
- Contract — you need the address to deliver the thing they bought.
- Legal obligation — you keep the invoice because tax law says so.
- Consent — they ticked a box, unticked, to receive your newsletter.
Consent is the weakest of the three and the one most often used wrongly. It has to be freely given, specific and as easy to withdraw as it was to give. A pre-ticked box is not consent. Making a newsletter subscription a condition of a quote is not consent either.
What this looks like on an actual form
Ask for: a name, one way to reply, and the message.
Do not ask for, by default: phone number as a required field, company details, budget bands, how they heard about you, date of birth, address.
Never put on the same form without separation: a newsletter signup that is ticked already, or wording that bundles "send my enquiry" with "sign me up".
Two lines of text near the button do most of the remaining work: what you will use the data for, how long you keep it, and a link to your privacy statement.
The four questions you must be able to answer
If someone emails and asks what you hold about them, you need to be able to reply. That is a right of access, and it applies to a one-person business exactly as it does to a bank.
- What do you hold? Form submissions, the mailbox, the newsletter list, your accounting software, your phone's contacts.
- Why do you hold it? One of the bases above, per category.
- How long do you keep it? Pick a period per category and write it down. "Enquiries that go nowhere: deleted after 12 months" is a policy.
- Who else can see it? Every service you use is on this list — your email provider, your newsletter tool, your accountant.
Most small businesses cannot answer question four, and it is the one that takes an afternoon to fix and then stays fixed.
Where your data sits matters too. ChatBuild keeps personal data in the EU (Frankfurt) with a short chain of subprocessors, so the answer to question four stays short enough to write down. How we handle data.
Do this first
Open your own contact form and count the fields. Delete every one you could ask for in a reply instead. Then write four short answers to the questions above and keep them in the same folder as your privacy statement.
That is most of the work, it takes under an hour, and it makes your form convert better as a side effect. Genuinely complicated cases — special categories of data, children, profiling, anything medical — are worth an hour of proper advice rather than an article.
Related: the other rule set that gets quoted at small businesses is accessibility, and most of them are exempt from it. If you tag your links to see where visitors come from, do it with consent.
Sources
- Regulation (EU) 2016/679 (General Data Protection Regulation) · EUR-Lex
- AVG algemeen · Autoriteit Persoonsgegevens
Frequently asked
- Can I add someone to my newsletter after they fill in a contact form?
- Not on the basis of the enquiry alone. A newsletter is a separate purpose and needs its own consent, given actively and separately from sending the enquiry. Bundling the two is the most common mistake on small business forms.
- How long may I keep an enquiry that never became a customer?
- The regulation sets no fixed number; you choose a period that matches the purpose and write it down. Deleting unconverted enquiries after twelve months is a defensible policy, and having any written policy puts you ahead of most.
Sjors Hooijen Builds ChatBuild and writes about getting a business online without turning it into a project. Questions about this article? Email hi@chatbuild.com.