GDPR Compliance is Extremely Broad
Anywhere you are collecting user information, then storing said information, and there is the possibility of using that information for future correspondence, will fall under GDPR compliance.
This means you need to get permission to save a contact form your database, or use the information provided by a user through your contact form to respond to their message or inquiry.
Edit after further reading of the text:
However, it also says:
Consent is just one of the legal bases you can use to justify your collection, handling, and/or storage of people’s personal data. Article 6 states five other justifications.
It provides the following alternative legal bases:
Processing is necessary to satisfy a contract to which the data subject is a party.
You need to process the data to comply with a legal obligation.
You need to process the data to save somebody’s life.
Processing is necessary to perform a task in the public interest or to carry out some official function.
You have a legitimate interest to process someone’s personal data. This is the most flexible lawful basis, though the “fundamental rights and freedoms of the data subject” always override your interests, especially if it’s a child’s data.
It basically says you must do this but you also don't have to do this. In your case, it seems to me your developer is not wrong, but they're also not right.**
I'd use the form shown in the second screenshot in your question. To avoid any issues and speak to a lawyer if you're really against having it.
Although in your example it's just a contact form, if you can foresee ever using the info of users that submit it for any other forms of communication like a news, events, or offers I'd keep it and include a second checkbox that says "Yes, keep me updated with Example Company news, events, and offers."
I'd recommend reviewing this general checklist.
It Doesn't Just Apply to EU based Companies/Sites
While GDPR is an EU law, any business or organization that makes their website or products and services available to EU based users must comply with it or risk hefty fines. Even entities based in the United States have to comply with GDPR.
View the GDPR compliance checklist for US companies.
The inclusion of or website means it extends to more than just commerce. By that language, if you have internationalized your website with something like
hreflang or use ccTLD of an EU country, you'd have to comply.
Defining Personal Data
GDPR Article 4 gives the following definition for
‘Personal data’ means any information relating to an identified or
identifiable natural person (‘data subject’); an identifiable natural
person is one who can be identified, directly or indirectly, in
particular by reference to an identifier such as a name, an
identification number, location data, an online identifier or to one
or more factors specific to the physical, physiological, genetic,
mental, economic, cultural or social identity of that natural person.
Further reading on personal data
- The identity and contact details of the organization, its representative, and its Data Protection Officer
- The purpose for the organization to process an individual’s personal data and its legal basis
- The legitimate interests of the organization (or third party, where applicable)
- Any recipient or categories of recipients of an individual’s data
- The details regarding any transfer of personal data to a third country and the safeguards taken
- The retention period or criteria used to determine the retention period of the data
- The existence of each data subject’s rights
- The right to withdraw consent at any time (where relevant)
- The right to lodge a complaint with a supervisory authority
- Whether the provision of personal data is part of a statutory or contractual requirement or obligation and the possible consequences of failing to provide the personal data
- The existence of an automated decision-making system, including profiling, and information about how this system has been set up, the significance, and the consequences