Last updated: 23 October 2026 · By Maurice, freeehouse team · About 3 minutes to read
What does a contact form need?
- Encryption. The page must run on https. Art. 32 GDPR requires appropriate security.
- Data minimisation. Only required fields you really need, usually name, email and message. Phone optional.
- A notice with a link to the privacy policy right at the form.
- A description in the privacy policy: purpose, legal basis, storage period.
- Storage period. Delete enquiries once they are dealt with and no retention duty applies.
Do I need a consent checkbox?
For a normal enquiry, usually not. When someone writes to you to get a quote or information, you process their data to carry out pre-contractual steps under Art. 6 para. 1 lit. b GDPR, or on the basis of your legitimate interest under lit. f. You need consent if you want to use the data for something else, such as a newsletter, or if special data such as health details is requested.
What applies to health data?
Practices, therapists and alternative practitioners (Heilpraktiker) should not make details about complaints mandatory in the form. Health data is specially protected under Art. 9 GDPR. If patients are to write something voluntarily, you usually need explicit consent and a clear notice.
Where does the data go?
With many forms, enquiries are forwarded by email and also stored in the provider's system. Check whether that is necessary. A form that sends the enquiry straight to your mailbox and does not store it permanently on the website keeps the amount of data small. If a service provider processes the data, you need a data processing agreement with them under Art. 28 GDPR.
How do I protect the form from spam?
Many spam protection solutions load services from third-party servers that transfer data and may need consent. It also works without: invisible fields that only bots fill in, a time check and checks on the server. That is enough for most small websites.
What mistakes do we often see?
- The form arrives nowhere, because the target address is wrong or the email lands in spam. Test it yourself after every change. On one of our go-lives in October 2026, enquiries first went only to us instead of the customer, because a switch was not set. Since then we check every mail route before we report a site finished.
- Required fields for phone number or address that are not needed at all.
- No confirmation for the sender that the message arrived.
This article is for orientation only and is not legal advice.
At freeehouse, enquiries from the form go straight to your mailbox, spam protection runs without third-party services, and we test every mail route before go-live. We do not charge for the build. How freeehouse works
What belongs in the confirmation for the sender?
A short confirmation that the message arrived and when to expect a reply. It should not contain a full copy of all the details if they include sensitive data, and no advertising as long as there is no consent.
Frequently asked questions
Do I need consent for a contact form?
For normal enquiries usually not, because Art. 6 para. 1 lit. b or f GDPR applies. For newsletters or health data, yes.
Does the contact form have to be encrypted?
Yes. The page must run on https.
How long may I store enquiries?
As long as you need them to deal with the enquiry, and longer only if a retention duty applies.
May I make the phone number a required field?
Only if you really need it. Otherwise as an optional field.
Sources
- Art. 6 DSGVO Rechtmäßigkeit der Verarbeitung, accessed 23 October 2026
- Art. 9 DSGVO Besondere Kategorien personenbezogener Daten, accessed 23 October 2026
- Art. 28 DSGVO Auftragsverarbeiter, accessed 23 October 2026
- Art. 32 DSGVO Sicherheit der Verarbeitung, accessed 23 October 2026
Providers' prices and terms change often. What counts is what's in your customer account and your contract. Not legal advice.
Read more
Ready for a new website?
We're currently testing freeehouse with a first round of businesses. Claim your spot on the waiting list.