Support »

Making GDPR Compliant Forms

Note: We are not lawyers and this is not legal advice. This is our best interpretation of the new GDPR guidelines put in place by the EU and is only meant as a starting place. Please consult a qualified attorney to ensure your compliance.

What is GDPR and who is effected by it?

In short, GDPR or the General Data Protection Regulation is a new policy for EU citizens helping them have control of their personal data.

The main points of GDPR is giving web users based in the EU control of the data that is collected on them. They must consent to the data being stored, they must have the ability to request what data is being stored on them, and the ability to have that data deleted.

That is just a basic summary on how we interpret it will relate to web forms. You can read the full details of the act over at the General Data Protection Regulation website.

But I'm not based in the EU.. does this apply to me?

Technically if you are based anywhere and collect data from EU citizens, then yes it effects you.

What are the key points to work toward compliance regarding forms?

• On all forms have a required checkbox that confirms consent to collect and store data.
• Have a clear privacy policy that is easy to find that states how the collected data will be stored and for how long.
• Have a way for users to contact you and request to see the data you have collected on them.
• Have a way for users to contact you and request to have their data deleted.

1. Adding confirmation of consent

<div class="fte-ckrad">
  This form collects the data you enter into it. By checking the I AGREE box you consent to us collecting and storing your data, as well as contacting you. For more info on how we manage your data please review our Privacy Policy. <br>
  <input type="checkbox" name="consent[]" id="consent1" value="Yes"><label for="consent1">I Agree</label><br>
</div><!--/end of checkbox group-->

2. Require the consent field

3. Decide how long you are going to store your user's submitted data.

If you login to your user panel and click on Submissions for the form you are working on you will see a new Auto delete form submissions dropdown. Here you can choose from a variety of options. The option you select should be reflected in your privacy policy as stated below.

4. Update your privacy policy.

Next you should update your privacy policy to inform your users how you will use their data and how it will be stored etc. Here is a starting point for the language. (Again, we are not lawyers, this is just a starting point.)

Be sure you update the last line to reflect the Auto delete form submissions option you choose in the previous step. Forever, 6 months, etc

<p>We use <a href="https://formtoemail.com/" rel="nofollow">FormToEmail</a> as our form processing provider. By submitting data on our forms and agreeing to the consent field you agree that the data you submit will be transferred to them and your data will be stored on their servers located in the United States. For more information on how they manage your data please review the <a href="https://formtoemail.com/privacy" rel="nofollow">FromToEmail Privacy Policy</a>.</p>
<p>We collect the data you submit via the forms on our website for the purpose of obtaining your info which allows us to reply to your requests.  In compliance with GDPR you have the right to be forgotten. If at anytime you would like your data removed from our system please contact us. By default we retain your info for a period of: Forever.</p>

Other suggestions

• Be sure you have an easy way for your users to contact you and request their data be deleted. Then follow through with those requests by removing their submissions on the submissions section in your FormToEmail user panel.
• Be sure your site is running an SSL certificate and your pages load with https.
• Be sure your FormToEmail action url is secure in your opening <form> tag like this: action="https://formtoemail.com/user_forms.php"

Join the 50,000 websites that already
trust FormToEmail

TRY IT FOR FREE