What data protection text to put on a web form

The first layer: what goes in the form

• Controller: who processes the data. Your name or company name and, ideally, your tax ID.
• Purpose: what you will use it for, in one concrete sentence. “Answering your enquiry” beats “managing your data”.
• Legal basis: in a form it is usually consent, or performing a contract the person asks for.
• Recipients: whether the data will be shared with anyone. If not, “Your data will not be shared with third parties unless required by law”.
• Rights: that they can access, correct and delete their data, among others, and how.
• Additional information: a link to your full privacy policy.

An example to adapt

Controller: Example Accountants Ltd (tax ID B00000000). Purpose: registering you as a client and providing the services you hire. Legal basis: performance of the services contract. Recipients: your data will not be shared with third parties unless required by law. Rights: you can access, correct and delete your data, and exercise the other rights explained in the additional information. Additional information: in our privacy policy.

Replace each part with yours. Copying another website’s text without adapting it is the most common mistake: the purpose and the controller have to be those of your form.

The acceptance box

• Never ticked in advance: consent has to be a clear action by the respondent.
• If you also want to send marketing, ask for that permission in a separate, optional box.
• If the form is for children under 14, in Spain consent is given by their parent or guardian.

After it is sent

Informing people is only one part. Ask only for the data you will use and decide how long you will keep it. In Peachform each form has a retention period and deletes its responses automatically when it is reached.

Templates to start with

• 📦Client onboarding for accountantsFor accounting and tax firms: tax details, the services needed and the first documents.
• 👋Contact formReceive customer enquiries with name, email, reason and message.
• 💼Job applicationFor small businesses that are hiring: the applicant's details, role, CV and availability.

Frequently asked questions

Is linking to the privacy policy enough?

It is better to show a summary in the form itself, next to the box, and link to the policy for the rest. A bare link makes people hunt for the basic information.

Can I use the same text on all my forms?

Only if the purpose is the same. A contact form and a job application process data for different purposes, and each must state its own.

Does this replace an adviser?

No. It is a practical guide; if you process sensitive data or are unsure about the legal basis, consult a professional.