{"id":1858,"date":"2026-04-25T14:51:40","date_gmt":"2026-04-25T13:51:40","guid":{"rendered":"https:\/\/www.duport.co.uk\/blog\/?p=1858"},"modified":"2026-04-25T15:11:38","modified_gmt":"2026-04-25T14:11:38","slug":"do-i-need-a-checkbox-on-my-contact-form-uk-gdpr","status":"publish","type":"post","link":"https:\/\/www.duport.co.uk\/blog\/do-i-need-a-checkbox-on-my-contact-form-uk-gdpr\/","title":{"rendered":"Do I Need a Checkbox on My Contact Form? UK GDPR"},"content":{"rendered":"

Do I Need a GDPR Contact Form Checkbox?<\/h1>\n

A lot of UK small business sites, especially ones built on Wix or Squarespace, add a GDPR contact form checkbox to every form just to be safe. Others leave it out entirely. Both can be off the mark, it really depends on how you plan to use the data.<\/p>\n

Here\u2019s how to tell when you need a checkbox, and what to put on your form if you don\u2019t. This is where a lot of people overcomplicate things.<\/p>\n

Do I need consent to process enquiries from a contact form?<\/h2>\n

For a standard enquiry form where you are only using the data to reply, you do not need consent, and a checkbox is not required.<\/strong><\/p>\n

Under UK GDPR, you need a lawful basis to process personal data. When someone contacts you with a question and you respond, ‘legitimate interests’ applies. If someone fills in your form asking for a quote or more information, replying to them is just part of running your business. You do not need to ask permission for that. What you do need is a short privacy notice near the form and a link to your full privacy policy.<\/p>\n

The broader picture, what GDPR requires across your whole website, is covered in How to Make Your Small Business Website GDPR Compliant.<\/a><\/p>\n

What wording should I use near my contact form?<\/h2>\n

In most cases, all you need is a simple line next to the button explaining what you\u2019ll do with their details, nothing complicated.<\/strong><\/p>\n

For example: \u2018We\u2019ll use your details to reply to your enquiry. See our privacy policy.\u2019 You\u2019ll see this type of wording on a lot of well-set-up small business sites. That\u2019s usually enough, it explains what happens to their data and points to the full policy if they want more detail, most people won\u2019t even click it, but it needs to be there. One sentence and a link is all you need for a basic enquiry form.<\/p>\n

Avoid writing ‘by submitting this form you agree to our terms and conditions.’ That is not a valid consent mechanism and does not meet the transparency requirement properly.<\/p>\n

When do I need a GDPR contact form checkbox?<\/h2>\n

You need a checkbox if you\u2019re planning to do more than reply, usually this means adding someone to a mailing list or sending marketing emails later.<\/strong><\/p>\n

If you\u2019re planning to follow up with newsletters, offers, or any kind of marketing after the initial enquiry, you\u2019ll need explicit consent. For example, sending a quote is fine, but adding that person to your monthly email list isn\u2019t unless they\u2019ve opted in. A checkbox saying ‘Tick here if you’d like to receive marketing emails from us\u2019, unticked by default and separate from the main submission, is the correct mechanism. Keep the checkbox focused on marketing only, separate from your terms. Make sure people actively choose it, it shouldn\u2019t be bundled in or pre-selected.<\/p>\n

If you are unsure about using contact form leads for your mailing list, Can I Add Contact Form Leads to My Mailing List? UK GDPR<\/a> covers that question in full.<\/p>\n

Does a pre-ticked box count as consent?<\/h2>\n

No, a pre-ticked box is not valid consent under UK GDPR.<\/strong><\/p>\n

The ICO has been pretty clear about this in its guidance. Consent requires a positive opt-in: the person must actively choose it. If a box is pre-ticked and someone just leaves it as-is, that doesn\u2019t count as a real choice. Marketing emails sent on the basis of a pre-ticked consent are sent without a valid lawful basis. This catches a lot of people out, especially on older website templates. If the ICO received a complaint about your mailing practices, a pre-ticked box would not protect you.<\/p>\n

The fix is simple: if you have a consent checkbox, make sure it starts unticked.<\/p>\n

What about booking forms and callback requests?<\/h2>\n

The same logic applies to booking forms and callback requests. Legitimate interests cover the actual booking or callback, but not follow-up marketing.<\/strong><\/p>\n

If someone books an appointment, you can process that data to manage the booking and send a confirmation. You cannot send them a promotional newsletter unless they specifically opted in. Adding a separate optional marketing checkbox to a booking form is the cleanest approach. It keeps the two uses visibly separate, which protects you if questions arise later.<\/p>\n

Need to check whether your contact forms and privacy policy are set up correctly right now? Run your website through our free compliance checker.<\/p>\n

Check your website now \u2192<\/a><\/p>\n

Contact forms set up correctly from day one<\/h2>\n

Duport builds professional websites for UK small businesses. Every site includes legal pages drafted for your business, privacy policy, cookie notice, and terms and conditions, and a contact form set up properly from the start.<\/p>\n

Duport’s website build<\/a> starts from \u00a3360. Mention this article when you get in touch and we’ll honour the \u00a3144 rate.<\/p>\n

\n

FAQs<\/h2>\n