Privacy by design for forms: collect less, keep it shorter
Every form field is data you must protect, explain and delete. What to ask of each field, where submissions go, and how long to keep them.
The short answer
Every field on every form is personal data you become responsible for the moment someone presses send: responsible for protecting it, explaining it, honouring requests about it and eventually deleting it. The cheapest and most effective protection is not collecting it. Ask of each field whether the business needs it to respond; remove the rest. Then make sure what you do collect travels a short, documented path to where it is used, is kept for a defined period, and is described honestly next to the form. Privacy by design is mostly restraint.
The questions to ask of each field
| Question | If the answer is no |
|---|---|
| Do we need this to respond to the person? | Remove it |
| Do we need it now, or later in the conversation? | Ask later |
| Would we be comfortable explaining why we ask? | Remove it |
| Is it sensitive: health, finances, identity documents? | Remove it, or handle it through a dedicated secure channel, not a contact form |
| Is it required, or would optional do? | Make it optional |
| Does completion drop when it is present? | Remove it |
Where submissions should go, and where they should not
- Receive in a function you control, in a chosen region, that validates and filters.
- Send onward through a transactional email service and, if used, into the CRM. Those two are the intended destinations.
- Log the event, not the content: time, outcome, delivery identifier. Not the message body.
- Keep error tracking blind to form contents: mask request bodies so a bug report never contains a customer’s message.
- Keep analytics away from form data: measure that a form was submitted, never what was in it.
- Avoid third-party form services that store every submission indefinitely, or configure their retention if you must use one.
- Remove the accidental hops: the automation tool history, the spreadsheet, the forwarding rule to a personal address.
Retention and honesty
Decide how long submissions are kept for each purpose, automate the deletion, and say so. Next to the form, one or two plain sentences: what you collect, why, how long you keep it, and a link to the full notice. Not a wall of legal text, not a pre-ticked box, not a claim that does not match reality. A form that says “we keep your message for six months to respond and follow up” and actually does is compliant in spirit and letter. A privacy notice describing systems the site does not have is neither.
What this means for you
Collect less: name, email, message, and anything else only when the business truly needs it to respond. Route submissions on a short path you can draw from memory, with logs and error tracking blind to the content. Keep for a defined period and delete automatically. Say what you do, next to the form, in plain words. Privacy by design for forms is not a project; it is a series of things you stop doing.
Frequently asked questions
We ask for phone, company, address and role on the contact form. Is that a problem?
If you use each of them to respond, no. If you ask because the template had the fields, yes: each is data to protect and explain, and each lowers completion rates. Name, email and message is enough for a contact form. Ask for the rest when the conversation actually needs it.
Where do our form submissions actually end up?
Often in more places than anyone intended: the inbox, a CRM, a form service's dashboard, an automation tool's history, an error tracker's breadcrumbs, a spreadsheet someone connected in 2022. Map the path once, remove the hops you did not choose, and write the result down.
How long should we keep submissions?
As long as the purpose requires and no longer: long enough to respond and follow up, plus whatever your legal obligations add. Months, not years, for ordinary enquiries. Set the period, automate the deletion, and mention it in the privacy notice. Check with a privacy specialist for your situation.
Sources
- European Commission: Data protection in the EU (accessed 2026-09-11)