The commonest collection point.
WHAT EVERY FORM SHOULD HAVE
Only necessary fields A clear statement of purpose A link to the privacy notice Separate consent for anything beyond the immediate purpose
WHAT SEPARATE CONSENT MEANS
Marketing consent distinct from submitting the form.
WHY
Bundling makes it invalid.
WHAT TO AVOID
Pre-ticked boxes Consent as a condition of submission, where the processing is not necessary Fields collected because the form template had them
WHAT TO REVIEW
Every form on your site.
WHAT TO ASK OF EACH FIELD
What is it used for, and by whom.
WHAT TO DO WITH FIELDS WITH NO ANSWER
Remove them.
WHAT TO CHECK ABOUT WHERE SUBMISSIONS GO
Which systems receive them Whether any are third parties Whether they are sent by email
WHY EMAIL MATTERS
Submissions in mailboxes are personal data outside your governance.
WHAT TO DO ABOUT IT
Store in a system with retention, and limit email copies.
WHAT TO SECURE
The transmission, with encryption.
WHAT TO CHECK
That the form is not reachable without encryption.
WHAT TO SET
Retention for submissions.
WHAT TO TEST
That a submission can be found and deleted on request.
