# Contact forms and GDPR compliance | Illia BizTech > Required fields, legal basis, the notice beside the button, retention of enquiries and spam protection without third party services. Source: https://illia-biztech.de/en/blog/kontaktformular-dsgvo 1. [Home](/en) 2. [Resources](/en/blog) 3. Building a contact form that meets the GDPR ![A contact form open on a laptop screen on a desk with a plant](/_ipx/f_webp,q_75/https://cms.illia-biztech.de/uploads/medium_kontaktformular_dsgvo_ed5ebef426.png) ![Portrait of Illia Belichenko, technical specialist at Illia BizTech](/_ipx/f_webp,q_75/https://cms.illia-biztech.de/uploads/small_Illia_Belichenko_author_81f88864f0.png) By: Illia Belichenko August 3, 2026 # Building a contact form that meets the GDPR A contact form on a company website works cleanly when it asks for name, email address and a message, and anything beyond that minimum needs its own justification for why exactly that field is necessary to answer the enquiry. The legal basis for processing form data usually comes from [Article 6(1) of the GDPR](https://eur-lex.europa.eu/legal-content/DE/ALL/?uri=celex:32016R0679), because answering the enquiry is simply not possible without a name and an email address, and that basis needs no consent checkbox next to the submit button. Next to the submit button there should be a short link to the privacy policy describing what happens to the data after submission, who receives it and how long it is kept. That link is enough, a separate consent checkbox here is redundant as long as the form relies on necessity to answer the request. A consent checkbox only becomes required once the form data is meant to be used for more than a single reply, for instance adding the address to a newsletter list. In that case a separate line with its own consent is needed, not one combined statement covering everything at once. The message from the form usually lands in the company's ordinary inbox, and that too counts as processing personal data, so the email service the message passes through also has to meet GDPR requirements, including extra safeguards if it sits outside the European Union. Enquiries from the form are kept only as long as handling them requires, not indefinitely. Once an enquiry is closed and there is no reason to keep the correspondence, such as tax retention rules or a legal dispute, the data is deleted. Google reCAPTCHA remains the most common spam protection for forms and at the same time the most problematic, because it transmits data to Google servers in the US the same way externally loaded fonts do. A simpler defence, a trap field invisible to people but filled in by bots, or a plain question like the sum of two numbers, solves the same problem without sending data outside. Testing the form yourself is worth doing from an outsider's perspective. Send a test message, check whether a notification arrives, what the confirmation email says, and whether a technical copy of the submitted data sits somewhere that the privacy policy never mentions. **Share** [ ![Close up of a contract being signed with a pen on a desk](/_ipx/f_webp,q_75/https://cms.illia-biztech.de/uploads/medium_avv_mit_dienstleistern_cecf61d64e.png) Previous Post Data processing agreements with your providers](/en/blog/avv-mit-dienstleistern) [ ![Hand hovering over a laptop trackpad with a website and its banner open on screen](/_ipx/f_webp,q_75/https://cms.illia-biztech.de/uploads/medium_cookie_banner_tdddg_99dac077fa.png) Next Post A consent banner that actually works](/en/blog/cookie-banner-tdddg) ![Portrait of Illia Belichenko, technical specialist at Illia BizTech](/_ipx/f_webp,q_75/https://cms.illia-biztech.de/uploads/small_Illia_Belichenko_author_81f88864f0.png) ##### Illia Belichenko Illia is responsible for the technical side of Illia BizTech: website development, website updates, forms, integrations, automation and technical support. He works on connecting websites, content, advertising and internal workflows so they work together without creating unnecessary manual work. ##### Recent Posts [![An editor working in video editing software with AI features on screen](/_ipx/f_webp,q_75/https://cms.illia-biztech.de/uploads/medium_ki_tools_videoschnitt_vor_und_nachteile_f3a71162be.png)](/en/blog/ki-tools-videoschnitt-vor-und-nachteile) #### [What AI Editing Tools Actually Do, and What They Don't](/en/blog/ki-tools-videoschnitt-vor-und-nachteile) October 16, 2026 [](/en/blog/ki-tools-videoschnitt-vor-und-nachteile) [![A video editor reviewing a flawed shot on a monitor before deciding on a reshoot](/_ipx/f_webp,q_75/https://cms.illia-biztech.de/uploads/medium_content_nachdrehen_oder_um_fehler_schneiden_f8735cb368.png)](/en/blog/content-nachdrehen-oder-um-fehler-schneiden) #### [When a Reshoot Pays Off and When Editing Can Save the Footage](/en/blog/content-nachdrehen-oder-um-fehler-schneiden) October 15, 2026 [](/en/blog/content-nachdrehen-oder-um-fehler-schneiden) [![A video editor selecting a cover frame for a video on a laptop screen](/_ipx/f_webp,q_75/https://cms.illia-biztech.de/uploads/medium_thumbnail_vorschaubild_video_wirkung_a1fe6c0cd9.png)](/en/blog/thumbnail-vorschaubild-video-wirkung) #### [Why the Video Thumbnail Decides Whether Anyone Clicks](/en/blog/thumbnail-vorschaubild-video-wirkung) October 14, 2026 [](/en/blog/thumbnail-vorschaubild-video-wirkung) A contact form is often the only place on a site where a company actually collects personal data, which is exactly why it is worth checking separately from the rest of the site. Illia BizTech sets up form fields to ask for only what is genuinely needed, and puts the consent line and a link to the privacy page right next to the submit button, instead of losing them somewhere in the footer. Illia BizTech builds and maintains websites for companies in Germany in German, English, Russian and Ukrainian, from the first version through ongoing maintenance and search visibility work. One monthly plan covers the website, advertising and content, the scope is agreed in advance and can be moved between them when priorities change. The domain, hosting and ad accounts stay registered to the company, so the work can continue on the existing setup without a full rebuild. That fits businesses moving to Germany or expanding into the German-speaking market who want to explain their task once.