Every contact form, quote request and newsletter signup collects personal data. In the EU, that means the General Data Protection Regulation applies the moment someone types their name and email address into a field and clicks submit. Building GDPR compliant forms is less about legal theory and more about a few decisions: what you ask for, why, where the answers end up and how long you keep them.
We at Deftform build and host our form builder in Germany, and these questions reach our support team all the time, often from agencies setting up forms for clients. This guide collects the practical answers. It's written for marketers and business owners rather than lawyers, and it isn't legal advice. If you process sensitive data such as health information, check with your data protection officer first.
There is no official stamp that certifies a form as GDPR compliant. Compliance comes from how you collect and handle the data. For a typical web form, it comes down to six things:
A lawful basis for the data you collect (Article 6 GDPR).
Clear information for respondents at the moment of collection (Article 13).
Collecting only what you need, known as data minimization (Article 5).
A secure provider with a data processing agreement (Articles 28 and 32).
A plan for how long you keep submissions (storage limitation, Article 5).
A way to export and delete someone's data on request (Articles 15 to 17).
Many people assume every form needs a consent checkbox. It doesn't. Consent is only one of six legal bases in Article 6, and often not the right one.
Take a contact form. Someone writes to you because they want an answer, and you need their email address to reply. That processing is covered by steps taken at the person's request (Article 6(1)(b)) or by your legitimate interest in answering enquiries (Article 6(1)(f)). A mandatory "I agree to the privacy policy" checkbox adds friction without adding a legal basis. A short notice with a link to your privacy policy usually does the job better.
Consent becomes necessary when you want to do something the person wouldn't expect from the form's main purpose. The classic example is adding everyone who fills out your contact form to your newsletter. Three common forms and the basis they usually rely on:
Contact or quote request form: pre-contractual steps or legitimate interest. You don't need a consent box to reply.
Newsletter signup: consent. The person must actively opt in, and you should be able to prove they did.
Job application form: steps before an employment contract. Ask for separate consent to keep applications for future openings.
When you do need consent, the bar is high. It has to be freely given, specific, informed and unambiguous (Article 4(11)), and you need to be able to demonstrate it (Article 7). In practice, that means:
Never pre-tick the box. The Court of Justice of the EU confirmed in its 2019 Planet49 ruling that a pre-checked box isn't valid consent.
Use one checkbox per purpose. "Send me the newsletter" and "Share my details with partners" are two separate decisions.
Don't tie consent to something unrelated. A free checklist download shouldn't require agreeing to sales calls.
Explain how to withdraw. Withdrawing consent must be as easy as giving it, so mention the unsubscribe link right next to the checkbox.
Good consent text is short and specific: "Yes, send me the monthly studio newsletter. I can unsubscribe at any time." Compare that with "I agree to receive marketing communications", which tells the reader almost nothing.
For newsletters, many businesses in Germany also use double opt-in. The subscriber confirms their address through a link in a confirmation email, which gives you a record that the owner of the address really signed up. The form handles the checkbox (Deftform has a dedicated opt-in checkbox field for this), and your email marketing tool usually sends the confirmation.
The easiest data to protect is data you never collected. Go through your form field by field and ask whether anyone would miss that answer. Typical candidates for removal:
A phone number on a newsletter signup.
Date of birth, when all you need to know is that someone is over 18. A single checkbox does that.
A full postal address on a webinar registration.
Company size and revenue on a first contact form, when sales could simply ask on the call.
Shorter forms also tend to convert better. We've covered that side in our guide to high-converting forms.
Conditional logic helps too. Show the billing fields only to people who select "Request a quote", or ask about dietary requirements only if someone attends in person.
Article 13 requires you to inform people at the point of collection. On a form, that means a short notice near the submit button and a link to your full privacy policy. A workable notice covers:
who is collecting the data (your company, not the form tool),
what you'll use it for,
how long you'll keep it,
where people can read the details and exercise their rights.
For example: "We use your details only to answer your request and delete them after 12 months. More in our privacy policy." Two sentences, placed where people actually read them.
Your privacy policy should also name the form builder you use and where it stores data.
Once someone hits submit, the data lives with your form provider, which acts as your processor under the GDPR. Check these points before you commit:
Where are submissions and uploaded files stored? EU hosting doesn't make you compliant on its own, but it takes international transfers off the table.
Is there a data processing agreement? Article 28 requires one. Some providers include it in their terms, others make you request it.
Which subprocessors are involved, and where are they based?
What security measures are in place, such as backups and certified data centers?
Can you delete submissions, ideally automatically after a set period?
Tools hosted in the US can still be used lawfully, for example under the EU-US Data Privacy Framework or standard contractual clauses. But that means more documentation for you and your clients, and the framework's two predecessors were both struck down by the Court of Justice of the EU. Many European businesses simply prefer to keep form data in the EU.
For reference, this is how we handle it at Deftform. Most data is stored on servers in Falkenstein, Germany, files uploaded through forms are hosted within the EU, and all our server providers are ISO 27001 certified. Our data processing agreement is an integral part of our terms and conditions, so it applies from the day you sign up.
Google reCAPTCHA sends information about the visitor to Google, which you'll have to cover in your privacy policy and, depending on your setup, may need consent for.
There are privacy-friendly alternatives. ALTCHA, for example, uses a proof-of-work challenge that runs in the visitor's browser and works without cookies or tracking. Deftform supports ALTCHA as well as reCAPTCHA and other options, so you can pick the one that fits your privacy policy.
Storage limitation is the principle most teams forget. A contact form with four years of submissions sitting in it is a liability rather than an asset. Decide on a retention period for each type of form:
Contact requests: until the conversation is finished, plus a buffer.
Event registrations: until the event and any follow-up are done.
Job applications: in Germany, typically around six months after the position is filled.
Order and payment forms: as long as tax and commercial law requires.
Then make deletion automatic, so it doesn't depend on someone remembering to clean up. In Deftform, you can set a data retention period for a workspace, anywhere from one month to ten years, and older submissions are deleted automatically. Retention control is part of the Business add-on and included in the Complete plan.
Anyone who filled out your form can ask what data you hold about them, ask for a copy, or ask you to delete it. You generally have one month to respond. A bit of preparation makes this routine:
Know which tools hold personal data, including spreadsheets, CRMs and newsletter tools that receive copies through integrations or webhooks. They need the same retention and deletion rules as the form.
Export the responses as CSV or PDF when someone requests a copy.
Delete the data in the form tool and in every connected system.
Agencies sit in an awkward spot. The client is usually the controller, the agency a processor, and the form builder a subprocessor. A few habits help:
Keep each client's forms, team members and settings separate.
Publish forms on the client's own domain, so respondents can see who they're dealing with.
Write the privacy notice in the client's name and link to the client's privacy policy.
Document which tools touch the data, so the client can include them in their records of processing activities.
Deftform includes three workspaces per account, each with its own forms, team members, custom domain and settings, and you can add more with a one-time payment. We don't charge per user, so client contacts can join at no extra cost. Our post on client onboarding with forms shows how agencies put this to work early in a project.
Write down the purpose of the form and its legal basis.
Remove every field you don't need.
Add a short privacy notice with a link to your privacy policy.
Use separate, unticked checkboxes for any consent.
Check where your form builder stores data and confirm you have a data processing agreement.
Choose a spam protection method you can explain in your privacy policy.
Set a retention period and automate deletion.
List every integration that receives a copy of the submissions.
If you're looking for a form builder that's made and hosted in Germany, Deftform covers the technical side of this list: EU hosting, a data processing agreement as part of our terms, opt-in checkboxes, privacy-friendly captcha options and automatic data retention. Every plan includes unlimited responses, unlimited team members and a custom domain. You can create an account and have your first form ready in a few minutes.