How Should a Website Handle Contact Form Data?
Handle website enquiries with minimal form fields, secure delivery, restricted access and a clear retention process from submission to deletion.
Part of our guide: UK Website Compliance and Security: A Practical Guide for Small Businesses
Contact-form information should be collected for a clear purpose, sent through a secure process and kept only for an appropriate period. The responsibility extends beyond the form itself to email accounts, notifications, logs and any connected customer-management system.
A successful submission message proves only that the interface reached a particular state. It does not prove that the right person received the enquiry or that every copy is handled safely.
Ask only what the next step needs
For an initial enquiry, a name, suitable reply method and brief description may be enough. Do not request identity documents or sensitive personal circumstances simply because a form builder makes extra fields easy to add.
Tell visitors not to include sensitive information if the form is not designed to receive it. Provide an appropriate alternative when the service genuinely requires more.
See which questions a contact form should ask for the usability side of minimisation.
Thinking about your own rebuild?
Tell us about your business, your current website and what you would like to improve. We will help you work out the next step.
Explain what happens to the enquiry
Place a concise explanation beside the form and link to an accurate privacy notice. Distinguish handling the request from any optional marketing activity.
Do not make a marketing subscription a hidden condition of asking a question. Assess the appropriate lawful basis for each use rather than assuming one checkbox solves every purpose.
The ICO’s small-organisation data-protection guide is an official starting point for this assessment.
Secure the route and receiving accounts
Use HTTPS and a maintained server-side form handler. Apply appropriate validation and spam controls without creating unnecessary accessibility barriers.
Limit access to the inbox or system receiving submissions. Use named accounts, suitable permissions and multi-factor authentication where available.
Avoid placing secrets in browser code. API credentials used to send messages belong in an appropriately protected server-side environment.
Avoid unnecessary copies
Some form tools retain submissions, email the full contents to several people and write payloads into diagnostic logs. Map those copies explicitly.
Where practical, notifications can point authorised staff to a controlled record rather than reproducing all personal information in every message. Check that access to the record works without exposing it publicly.
Be especially careful with file uploads. Restrict types and size, scan where appropriate and keep files out of public website folders.
Define retention and deletion
Set retention according to the purpose, legal obligations and business needs. An enquiry that does not become a customer may need a different approach from contract documentation.
Make deletion cover the relevant systems, subject to justified backup and recordkeeping arrangements. Do not promise immediate deletion everywhere if your actual process cannot deliver it.
Record who makes retention decisions and who carries them out.
Review integrations before adding them
Forwarding enquiries into an AI tool or CRM is a new data flow, not just a convenient button. Review supplier terms, security, roles and any international-transfer requirements.
The AI chatbot privacy guide explains similar questions for conversation data. Keep these decisions in the compliance inventory.
Do not use real customer messages as test data when fictional or sanitised examples will do.
Test both success and failure
Submit a labelled test enquiry, confirm delivery and check who can see it. Test invalid fields, duplicate clicks, unavailable mail delivery and the message shown when submission fails.
Use the pre-launch checklist to make this part of routine release testing. An apparently successful form that silently loses messages harms both service and trust.
For help reviewing the technical enquiry journey, contact AfterWorks. Seek specialist advice if the form handles sensitive information or complex legal obligations.
