A contact form makes you a data controller. Most small UK businesses collect personal data long before they think about how they hold it.
The moment your website has an enquiry form, you are processing personal data. That is not a reason for alarm, but it does mean a handful of obligations attach to you under UK GDPR and the Data Protection Act — and most of them are cheap to satisfy if you handle them at build time rather than after a complaint.
Know what you hold and why
Every field you collect should have a reason. Businesses routinely capture phone numbers they never call and addresses they never post to, then have to secure and eventually delete them. Collecting less is the single most effective compliance measure available to a small team.
- Write down what you collect, why, where it lives, and how long you keep it.
- Have a lawful basis for each use — consent is not the only one, and often not the right one.
- Publish a privacy notice in plain English that matches what your systems actually do.
- Keep marketing consent separate from an enquiry. A contact form is not a mailing list opt-in.
Registration and fees
Most UK organisations that process personal data need to pay a data protection fee to the ICO, with the amount tiered by size and turnover. There are exemptions, and the tiers are reviewed periodically. Check your position and the current fee directly with the ICO rather than relying on a figure quoted in a blog post — including this one.
The businesses that handle a data request well are the ones that already knew where the data was.
Build it into the system
Retention rules that live in a policy document get ignored. Retention rules that live in the software get followed. If your CRM can expire old enquiries automatically, that is worth more than a paragraph promising you will review them annually.
This is a starting point, not legal advice. The ICO publishes clear guidance for small organisations and it is worth an hour of your time.