GDPR compliant forms ask only for what they need, say why, get clear consent where it is required, and keep personal data no longer than necessary. The rules sound heavy, but for most small sites they come down to a handful of habits. This guide is for teams and site owners with visitors in Europe or the UK. We turn the rules into a checklist, and show which Echo Forms settings help. It is guidance, not legal advice, so check anything unusual with a lawyer.
The short version
- Ask only for what you will use, and say what you use it for.
- Use a consent checkbox for marketing, never a pre-ticked one.
- Link your privacy policy next to the button.
- Keep entries only as long as you need them, and clear the rest.
- Know which parts of your form set cookies.
What makes a form GDPR compliant?
Five things, taken from the principles in the regulation itself. The GDPR text lists them in Article 5: process data lawfully and openly, for a clear purpose, collect as little as you need, keep it accurate, keep it no longer than necessary and keep it secure. On a form, that means:
| Principle | On your form |
|---|---|
| A clear purpose | Say why you ask, near the fields |
| As little as needed | Remove fields you do not use |
| Consent where needed | A consent box for marketing, unticked |
| Not kept too long | Delete old entries on a schedule |
| Secure | HTTPS on every page, and entries on your own site |
Do you need a consent checkbox on every form?
No. You need consent for things the person did not ask for, such as adding them to a newsletter. You do not need a checkbox to answer the question they just sent you, because replying is the reason they wrote. A contact form can rely on that, and a quote form can too.
That is what a GDPR consent checkbox is for. When you do ask, the box must start unticked, and saying no must not stop them sending the form. In Echo Forms, a Consent checkbox such as Email me your offers works that way, and a mailing list only adds people who tick it.
What is the difference between a consent box and a GDPR agreement?
A consent box is optional and covers one extra use, such as marketing emails. A GDPR agreement field is a required agreement to your privacy policy and terms, with both added as real links. Use the agreement when you must be sure someone read the terms, such as a membership or a booking with conditions, and a consent box for anything optional. Both fields are free in Echo Forms, and the choices and ratings guide shows how to set them up.
How long should you keep form entries?
Only as long as you need them, which you decide and write down. A quote request may be useful for 12 months. A job application might be kept for 6 months after the role is filled. A support question is often done in 30 days. Pick a period for each form, say it in your privacy policy and stick to it. Data retention for forms is the part most sites forget, so put a reminder in your diary every 30 days.
Echo Forms helps with one part of this. Its Delete entries after 90 days setting clears the saved copy of exactly what was typed after 90 days, while the entry itself stays. Delete whole entries yourself on your own schedule, from the entries list.
Do forms set cookies?
Some parts do. Echo sets none of its own, but a CAPTCHA, an address lookup and a map do, because they load from outside services. Switch on Cookie-free forms under the site-wide settings, and those three turn off: forms skip the CAPTCHA, and people type addresses by hand. That keeps your forms out of your cookie banner entirely.
How to make your forms GDPR compliant, step by step
- List every form and what each one is for.
- Remove any field you never use.
- Add a short line about why you ask, near the first field.
- Add a consent box for marketing, unticked, and nothing else optional.
- Link your privacy policy beside the send button, so the form privacy policy is one click away.
- Decide how long you keep each form’s entries, in days or months, and add it to your policy.
- Turn on Cookie-free forms if you do not need a CAPTCHA or address lookup.
A first pass takes about 1 hour for a small site. We suggest doing it once a year, every January, so new forms get checked too.
Where are entries stored?
With a WordPress form plugin, entries live in your own site’s database, which keeps you in control of where personal data goes. Echo Forms keeps them in its own table, which you can search and export from your entries, and sends nothing to an outside service until you connect one, such as Mailchimp or Google Sheets. When you do connect one, mention it in your privacy policy, because that is where the data goes next.
GDPR compliant forms are mostly good manners written down: ask for little, explain why and clean up after yourself. Our site-wide settings guide covers the privacy options in one place.
Forms with privacy built in
Echo Forms has a GDPR agreement field, consent checkboxes, cookie-free forms and a 90-day clean-up, all free.
