If your website has an enquiry form, takes bookings or lets people join a mailing list, it probably collects personal information. That includes familiar details such as names, email addresses and telephone numbers.
Data protection is about how you collect and use that information, how you look after it and what you tell the people it belongs to.
For a customer sending an enquiry, the expectation is quite reasonable. They’ll want you to use their details to help with what they’ve asked, keep them appropriately protected and explain any other uses.
The website is part of that relationship, even when the form itself looks simple.
What happens after someone presses send
An enquiry may arrive in your inbox and remain in the website’s records. It might also pass into a booking platform or a system your team uses to manage customer relationships.
Those copies can serve useful purposes. They also mean that handling the information involves more than the email you can see. Knowing where it goes helps establish who needs access, how long it’s kept and what happens if a customer asks about it.
The same applies to the questions on the form. A general enquiry may need only a name, reply address and message. A confirmed booking may require more detail. Asking for information at the stage it’s needed keeps the process relevant and avoids collecting things without a clear purpose.
Being clear about how you’ll use it
You need a lawful basis for using personal information. Consent is one option, but it isn’t required for every purpose. Information necessary for a contract with an individual, or steps they’ve requested before one, may use a different basis.
The right decision depends on the purpose and circumstances. Legitimate interests can apply after the appropriate assessment, but it doesn’t override electronic marketing rules where those require consent.
In practical terms, someone asking for a quote hasn’t automatically agreed to receive marketing emails. Keeping those purposes distinct helps the customer understand the arrangement and helps your business manage it properly.
Your privacy information should explain what you use, why, the lawful basis, relevant sharing and retention, people’s rights and how to contact you or complain. It needs to describe your actual setup, rather than a process copied from another company’s website.
Your tools and suppliers matter too
Hosting companies, form providers and booking services may handle information for your business. Their role and terms matter alongside the design of the form. Where a supplier processes data on your behalf, the required contract terms need to be in place. Processing overseas may also need an international transfer assessment.
Retention needs a reason too. There isn’t one GDPR deletion period that applies to every website enquiry. The purpose, relevant legal obligations and your documented need help determine what’s appropriate.
It’s easier to make those decisions when you’ve got a clear picture of the website and the services connected to it. A new booking tool or marketing feature can change that picture, which is why privacy information needs reviewing when the setup changes.
What has changed in the UK
The UK framework includes the UK GDPR and Data Protection Act 2018, as amended by the Data Use and Access Act 2025. Separate rules called PECR cover electronic marketing and storage or access on visitors’ devices, including cookies.
Since 19 June 2026, organisations handling personal data have a duty to facilitate data protection complaints. That includes acknowledging them within 30 days, investigating appropriately and communicating the outcome.
Your team also needs to recognise information rights requests and know who handles them. If a personal data breach occurs, the ICO must be notified without undue delay and within 72 hours of awareness unless it’s unlikely to risk people’s rights and freedoms. Affected people must be told without undue delay where a high risk is likely. The assessment and response need recording.
You don’t need to turn your contact page into a legal document. You do need a website setup that supports your decisions and gives customers accurate information.
Plastic Box Digital Marketing can help you look at the forms and tools involved. Your business remains responsible for its data protection decisions, with specialist advice where needed. If you’re unsure how your website fits into that, get in touch and we can talk it through.