This isn't legal advice — for that, talk to someone qualified in your jurisdiction. But most of what a small business contact form actually needs to get right is more practical than legal, and it's usually the same handful of things.
Ask for only what you need
If the form asks for a phone number, a company name and a budget range before someone can just ask a question, most people leave. Collect what the next step actually requires, and ask for the rest later if the conversation continues.
Consent has to be a real choice
A checkbox for marketing emails that's already ticked when the page loads isn't consent — it's the visitor having to notice it and un-tick it. We found exactly this on our own contact form during a review and fixed it: the box now starts unchecked, every time.
Say where the data goes and for how long
A short, plain sentence — who receives the enquiry, what it's used for, and that it's not sold or shared beyond that — covers most of what a visitor actually wants reassurance about, without turning the form into a legal document.
- Ask for only what the next step needs
- Never pre-check a consent box
- Say plainly what happens to the data
- Give people an easy way to ask you to delete it
Source: GDPR.eu — General Data Protection Regulation compliance guidelines