Why you need a GDPR form compliance checklist
Online forms are the front door of data collection. Every contact form, registration form, survey, and intake form you publish is a data processing operation under GDPR. If any part of that operation falls short, you're exposed to regulatory action, fines, and reputational damage.
This checklist is designed to be practical. Print it, share it with your team, and use it to audit every form you currently operate and every new form you create.
Section 1: Lawful basis for processing
Before you collect any data through a form, you must establish a lawful basis under GDPR Article 6.
- Identify your lawful basis — Is it consent, legitimate interest, contractual necessity, or legal obligation? Document the basis for each form.
- If using consent: the consent checkbox is not pre-checked
- If using consent: the consent language is specific — it states exactly what data is collected and why
- If using consent: consent is freely given — the user can submit the form without consenting to non-essential processing (e.g., marketing)
- If using consent: consent is recorded with a timestamp and the exact wording the user agreed to
- If using consent: consent can be withdrawn as easily as it was given
- If using legitimate interest: you have completed a Legitimate Interest Assessment (LIA) and documented it
- For special category data (health, ethnicity, political opinions, biometrics): you have explicit consent under Article 9
Section 2: Data minimization
GDPR Article 5(1)(c) requires that personal data be "adequate, relevant, and limited to what is necessary."
- Every field serves a documented purpose — can you justify why each field exists?
- No "nice to have" fields — if you don't need date of birth, don't ask for it
- Optional fields are clearly marked — users should know what's required vs. optional
- Form length matches its purpose — a contact form doesn't need 20 fields
- You've reviewed the form with your DPO or privacy lead to confirm minimization
Section 3: Transparency and privacy notice
Data subjects must be informed about how their data will be processed at the point of collection (Articles 13 and 14).
- Privacy notice is linked from the form (not buried in a footer elsewhere on the site)
- The privacy notice specifies: who the data controller is (company name, address, contact)
- The privacy notice specifies: what data is collected via the form
- The privacy notice specifies: the purpose of processing
- The privacy notice specifies: the lawful basis for processing
- The privacy notice specifies: who the data will be shared with (processors, subprocessors)
- The privacy notice specifies: where the data will be stored (country, data center location)
- The privacy notice specifies: how long the data will be retained
- The privacy notice specifies: the data subject's rights (access, rectification, deletion, portability, complaint)
- The privacy notice is written in plain language — not legal jargon
Section 4: Data storage and security
Where and how you store form submissions is critical for compliance.
- Data is encrypted in transit (HTTPS/TLS) — the form page and submission endpoint use SSL
- Data is encrypted at rest — form submissions are encrypted in the database
- Data is stored in the EU — verify the physical location of the servers, not just the cloud region
- The hosting provider is EU-incorporated — not a US company with EU servers
- No US subprocessors have access to form data — check the entire processing chain
- Access controls are in place — only authorized personnel can view form submissions
- Individual user accounts — no shared login credentials for accessing form data
- Audit logging — you can track who accessed form submissions and when
Section 5: Data Processing Agreement (DPA)
If you use any third-party tool to collect or store form data, you need a DPA under Article 28.
- A signed DPA is in place with your form builder provider
- The DPA specifies the type of data processed, the purpose, and the duration
- The DPA lists all subprocessors — and you've reviewed each one
- The DPA includes data breach notification obligations (72-hour requirement)
- The DPA includes provisions for data deletion upon contract termination
- You're notified of subprocessor changes — and have the right to object
Section 6: Data subject rights
Your form data processing must support the exercise of data subject rights (Articles 15-22).
- Right to access — you can provide a copy of a person's form submission data within 30 days
- Right to rectification — you can correct inaccurate form data upon request
- Right to deletion (right to be forgotten) — you can permanently delete a specific person's form submissions
- Right to data portability — you can export form data in a machine-readable format (CSV, JSON)
- Right to restriction — you can stop processing a person's data while a dispute is resolved
- Process for handling requests — you have a documented procedure for responding to data subject requests
Section 7: Retention and deletion
GDPR requires that data not be kept longer than necessary (Article 5(1)(e)).
- Retention period is defined for each form — how long do you keep submissions?
- Retention period is documented in your privacy notice
- Automatic deletion or review — do you have a process to delete or review data when the retention period expires?
- Deletion is permanent — when you delete form data, it's actually gone (not just soft-deleted or moved to a recycle bin)
- Backups are included in your deletion process — data in backups should also be deleted within a reasonable timeframe
Section 8: Breach response
If form data is compromised, you have legal obligations under Article 33.
- Breach notification plan — you know who to notify and how within 72 hours
- Your form provider's breach obligations are documented in the DPA
- You know how to identify a breach involving form data
- Contact details for your supervisory authority are documented and accessible
Section 9: Regular review
Compliance is not a one-time activity.
- Annual review of all active forms and their compliance status
- Review after any change to form fields, storage, or processing
- DPA review when your form provider changes terms or subprocessors
- Staff training — people who manage forms understand GDPR requirements
How to use this checklist
- Audit existing forms first — go through every form on your website and check it against this list
- Prioritize high-risk forms — forms collecting health data, financial data, or children's data need immediate attention
- Document everything — GDPR is about accountability. Keep records of your compliance decisions
- Involve your DPO — if you have a Data Protection Officer, they should review this checklist with you
The easiest way to check most of these boxes
Many items on this checklist relate to where and how your form data is stored and processed. By choosing a form builder that's EU-hosted, EU-incorporated, and designed for GDPR compliance, you can check off the data storage, DPA, and subprocessor sections immediately.
FormGuard was built with this checklist in mind. EU-only data storage, transparent subprocessor chain, DPA included, data export and deletion built in, and no US jurisdiction exposure.