7

As of May 2018, the General Data Protection Regulation (GDPR) will come into affect and I am wondering how best to comply with this when implementing a simple contact form.

The form, lets say, requires the person's name, email, and has an optional telephone and message field. The form data is then sent to an email address, as well as being stored in a database.

I understand that we must:

  • Explain what personal information is being used for any why
  • Give the user a means to easily see the data that is being held
  • Give the user the option to remove this data.

Whilst these steps are ok, I have also read that we are obliged to confirm the user's identity - the suggested method is a double opt-in. Surely this can't apply to a contact form?

So in summary, what should be done to allow the user to fill out the form, but for us to comply with the new regulations?

Improve this question
4
  • 1
    Mind quoting the specific text that mentions that you are required to confirm the users identity? it is my understanding that you allow users to view the data that you may held about them and have them able to delete it from your system. This could be as easily entering in their email address and passcode sent to their email address then querying the database and echoing relevant data such as name, email, number and how you have their information, then an delete option... simple stuff. Useless compliance since only major companies will respect it, rest will ignore, same as EU cookies notice.
    – Simon Hayter
    Commented Nov 26, 2017 at 0:45
  • I was slightly incorrect in my reference, but the verification is required for the access of stored data. “You must verify the identity of the person making the request, using reasonable means” ico.org.uk/for-organisations/…
    – Alexander Holsgrove
    Commented Nov 26, 2017 at 23:14
  • Which I believe means that you must verify that the person requesting the data is whom they say they are, a simple example would be 'sending' a verification code to their email address before revealing the data.
    – Simon Hayter
    Commented Nov 27, 2017 at 10:09
  • Related: Does a contact form need to ask the user for explicit permission to be GDPR compliant?
    – Maximillian Laumeister ♦
    Commented Sep 22, 2021 at 4:22

1 Answer 1

Reset to default
1

Your question is two-fold:

  1. How to save information entered through a form on your website
  2. How to delete information entered through a form on your website

Say, someone enters a name, email and data into your form. Since that data is personally identifiable information, you must make sure that this data can be deleted by the person owning that data. To do that, you could double opt-in and the save the data permanently.

Not always is the entered information correct. I could be a jack and just enter my neighbours information...

So whenever someone asks for all stored information or deletion of data, you have a verified email-address you can tie that request to.

Improve this answer

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge you have read our privacy policy.

Not the answer you're looking for? Browse other questions tagged or ask your own question.