Name.<\/p>\n\n
Email.<\/p>\n\n
Phone number.<\/p>\n\n
A message.<\/p>\n\n
A typical contact form may contain as few as four fields, but the moment a visitor submits them, the company is processing personal data.<\/p>\n\n
So what exactly should be written on the form?<\/p>\n\n
And should the customer check the box:<\/p>\n\n
\u201cI accept the privacy policy\u201d?<\/strong><\/p>\n\n As a general rule: no.<\/p>\n\n It is a common misconception that a checkbox must be included, where the visitor agrees to the company’s privacy policy, before a contact form can be submitted.<\/p>\n\n The Danish Data Protection Agency states explicitly that the customer is not required to consent to the company’s privacy policy.<\/p>\n\n Instead, the privacy policy should explain to the individual how the company processes personal information.<\/p>\n\n That’s an important difference.<\/p>\n\n You must inform<\/strong> the visitor.<\/p>\n\n That does not mean that the visitor must \u201capprove\u201d the information.<\/p>\n\n Many websites already have a link to their privacy policy at the very bottom of the page.<\/p>\n\n It’s nice to have that there.<\/p>\n\n However, if a company collects personal data through a form, the Danish Data Protection Agency recommends that the information also be made actively available at the point where the data is submitted.<\/p>\n\n For example, this could be a short piece of text below the form with a direct link to the privacy policy.<\/p>\n\n It could be as simple as:<\/p>\n\n When you submit the form, we will process your information in order to respond to your inquiry. Read more in our privacy policy. <\/strong><\/p>\n\n This way, the user knows that the information is being processed, why it is being collected, and where to find more information.<\/p>\n\n Another good rule of thumb is to look at the form itself.<\/p>\n\n Do you really need a date of birth?<\/p>\n\n Address?<\/p>\n\n Company name?<\/p>\n\n Phone number?<\/p>\n\n The more information you collect, the more personal data you must have a legitimate purpose for processing.<\/p>\n\n The Danish Data Protection Agency’s guidelines are based on the principle that companies should not collect more personal data than they actually need.<\/p>\n\n A standard contact form can therefore often be very simple.<\/p>\n\n Here, it is important to distinguish between different purposes.<\/p>\n\n If someone gives you their email address because they want an answer to a question, that does not automatically mean that the address may also be used for newsletters or other marketing purposes.<\/p>\n\n This is a different purpose and may require separate consent.<\/p>\n\n So a checkbox may well be relevant on a form\u2014but not necessarily to \u201caccept the privacy policy.\u201d<\/p>\n\n For example, this may be relevant if the user actively chooses to subscribe to a newsletter as well.<\/p>\n\n The Danish Data Protection Agency emphasizes, among other things, that the data subject must be informed about who is processing the data, why it is being processed, what data is being processed, and how long it will be retained.<\/p>\n\n Exactly what should be included depends on how the company specifically processes personal data.<\/p>\n\n That is why you should not simply copy a privacy policy from another website.<\/p>\n\n For most standard business websites, GDPR requirements regarding contact forms do not have to make the form cumbersome or difficult to use.<\/p>\n\n The most important thing is that you know what information you are collecting, why you are collecting it, and that visitors can easily find information about how it is processed.<\/p>\n\n And before you add yet another mandatory checkbox, it\u2019s worth asking:<\/p>\n\n What exactly is the customer being asked to agree to?<\/strong><\/p>\n","protected":false},"excerpt":{"rendered":" Do you need a checkbox on your contact form? And where should the privacy policy be posted? Here\u2019s what you need to know. <\/p>\n","protected":false},"author":1,"featured_media":3196,"comment_status":"open","ping_status":"closed","sticky":false,"template":"","format":"standard","meta":{"_acf_changed":false,"footnotes":""},"categories":[50],"tags":[],"class_list":["post-3116","post","type-post","status-publish","format-standard","has-post-thumbnail","hentry","category-websites"],"acf":[],"_links":{"self":[{"href":"https:\/\/studiolp.dk\/en\/wp-json\/wp\/v2\/posts\/3116","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/studiolp.dk\/en\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/studiolp.dk\/en\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/studiolp.dk\/en\/wp-json\/wp\/v2\/users\/1"}],"replies":[{"embeddable":true,"href":"https:\/\/studiolp.dk\/en\/wp-json\/wp\/v2\/comments?post=3116"}],"version-history":[{"count":3,"href":"https:\/\/studiolp.dk\/en\/wp-json\/wp\/v2\/posts\/3116\/revisions"}],"predecessor-version":[{"id":3219,"href":"https:\/\/studiolp.dk\/en\/wp-json\/wp\/v2\/posts\/3116\/revisions\/3219"}],"wp:featuredmedia":[{"embeddable":true,"href":"https:\/\/studiolp.dk\/en\/wp-json\/wp\/v2\/media\/3196"}],"wp:attachment":[{"href":"https:\/\/studiolp.dk\/en\/wp-json\/wp\/v2\/media?parent=3116"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/studiolp.dk\/en\/wp-json\/wp\/v2\/categories?post=3116"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/studiolp.dk\/en\/wp-json\/wp\/v2\/tags?post=3116"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}A privacy policy is information\u2014not something the customer has to accept<\/h2>\n\n
A link in the footer isn’t always enough<\/h2>\n\n
Ask only for what you actually need<\/h2>\n\n
A contact form and a newsletter are not the same thing<\/h2>\n\n
So what should the privacy policy include?<\/h2>\n\n
Keep the form simple<\/h2>\n\n