GDPR compliant forms checklist: 12 steps from lawful basis to deletion

No form builder can make your form compliant for you. The GDPR regulates what you collect, why, and what happens to the answers afterward, and those are decisions about your organization, not features of a tool.

This checklist is for anyone collecting personal data through a form: contact forms, quote requests, job applications, sign-ups and surveys. Each step says what the regulation expects, what it looks like on a real form, and where Upform helps.

Who is responsible: controller and processor

The controller decides why and how personal data is processed. The processor handles it on the controller's behalf and only on its instructions. When you publish a form in Upform, you are the controller for the answers it collects and Upform is your processor.

Upform's side is written down in its Data Processing Addendum (DPA), which applies to every account, free and Pro. For the data Upform handles for its own purposes, such as your sign-in details and your plan, Upform is the controller and its privacy policy applies.

1. Write down the purpose and the lawful basis

Before the first question, write one sentence per purpose: "We use this form to prepare a quote and reply to the person who asked for it." Then choose a lawful basis for each purpose from the six in Article 6: consent, contract, legal obligation, vital interests, public task and legitimate interests.

Most business forms rely on one of three. A quote request, an order or a job application runs on contract, because the person asked you to take a step and you need their details to take it. A support request or a general inquiry often runs on legitimate interests, which calls for a short balancing test you keep on file. Marketing to people who are not yet customers usually needs consent. The common mistake is using consent for everything: people can withdraw it at any time, so it is the wrong basis for data you need to do the job.

2. Collect only what the purpose needs

Article 5 asks for personal data that is adequate, relevant and limited to what is necessary. On a form, that becomes a practical test: for every question, name the person who reads the answer and what they do with it. A quote request does not need a date of birth. A webinar sign-up does not need a phone number. A feedback survey may not need a name at all.

Collecting less also shortens the form, and short forms get finished more often, as form design best practices explains. When only some people need a question, use conditional logic to show it only when it applies.

Watch the open text boxes too. On an HR or clinic form, "Anything else we should know?" invites health details you never meant to collect. Say what belongs in the box.

3. Tell people why, on the form itself

Article 13 lists what people must be told when you collect their data: who you are, the purposes and lawful basis, who receives the data, any transfers outside the EEA or UK, how long you keep it, and their rights, including withdrawing consent and complaining to a supervisory authority. That is too much for a form, so the usual pattern is layered: a short summary on the form and the full notice one step away.

In a one-question-per-screen form, that summary belongs on a Statement step at the start: a title, a line of text and a button, with no input. Name your organization, give the purpose in one sentence, state the retention period and write out the address of your full notice. Upform shows question descriptions as plain text, so type the address in full rather than expecting a clickable link.

Then use each question's help text for the reason behind anything sensitive. "Phone number, only used to confirm your appointment" tells people more than a paragraph of policy.

4. Make consent separate, specific and unticked

If you rely on consent for anything, it has to be freely given, specific, informed and unambiguous, and given by a clear affirmative act. Recital 32 rules out silence, inactivity and pre-ticked boxes, and the Court of Justice confirmed in its 2019 Planet49 judgment that a pre-ticked checkbox is not valid consent.

On a form, that turns into three rules. Ask for consent as its own question, not inside a sentence about something else. Leave the answer empty until the person chooses. Make no as easy to give as yes.

An Upform Yes/No question behaves this way by default: neither button is selected until the person taps one. Mark it required and the person has to choose, but either answer moves them forward. Required to answer is fine; required to agree is not.

5. Give each purpose its own choice

Specific means one consent per purpose. A newsletter, event invitations and a text message when the quote is ready are three purposes, so they are three choices. Article 7(4) adds that the service should not depend on consent it does not need: a quote should never hinge on agreeing to marketing.

For several optional channels, use a Multiple Choice question that is not required, so choosing nothing is a valid answer. Place it after the questions the person came to answer, so it reads as an offer rather than a toll.

6. Keep proof, and make withdrawal easy

Article 7(1) puts the burden of proof on you: if you rely on consent, you must be able to show the person gave it. A usable record is the answer, the date it arrived, and the exact wording the person saw at the time.

Upform stores each response with the date it arrived, and the consent answer has its own column in the Responses table and in the CSV export. Upform does not keep a history of your question wording, so when you change a consent question, note the date and the old text somewhere you keep. The Mailchimp integration supports double opt-in, so subscribers confirm by email as well and Mailchimp records it.

Article 7(3) also says withdrawing consent must be as easy as giving it. Put the method in the help text, right where the person gives consent: an unsubscribe link in every email, or a reply to any message you send.

7. Treat special category data as a separate decision

Article 9 sets apart data revealing racial or ethnic origin, political opinions, religious or philosophical beliefs or trade union membership, genetic data, biometric data used to identify someone, health data, and data about sex life or sexual orientation. Processing it is prohibited unless an Article 9 condition applies, such as explicit consent, and you still need an Article 6 basis on top. Criminal offense data has its own rules under Article 10.

The working advice for forms: do not ask unless you must. When you must, ask on a separate step, give the reason in the help text, and offer a way to decline. Processing sensitive data at scale may also call for a data protection impact assessment before you launch.

Upform itself has no HIPAA business associate agreement and no SOC 2 report, and its DPA asks you to judge whether its measures are adequate before you collect special category data. That is why the patient intake form template covers only the non-clinical side of intake.

8. Set a retention period, then actually delete

Storage limitation means keeping personal data no longer than the purpose needs. The GDPR does not give you a number: you set one per form and put it in your notice. As examples, not rules: quote requests for 12 months after the last contact, job applications for six months after the role is filled, event sign-ups until a month after the event.

Then delete on schedule. In Upform, filter the Responses table by form and date, export a CSV if you need a copy, and delete old responses one at a time or many at once. To have a specific uploaded file removed, email hello@upform.com. And remember the copies: a response that already went to Google Sheets or HubSpot lives there as well, so your schedule has to cover every destination.

A retention period nobody enforces is a sentence in a notice, not a practice.

9. Know every processor, and sign a DPA with each

Article 28 requires a written contract with every processor that handles personal data for you. For your form tool, that contract is the DPA. Upform's applies automatically and names its sub-processors: Supabase for the database, authentication and file storage, Google for reCAPTCHA and Google sign-in, and the provider that hosts the app. Account owners are emailed before a new one starts.

Integrations are a separate question. When you connect Google Sheets, Slack, HubSpot, Mailchimp or Notion, you sign in with your own account for that service, and the provider acts under your own agreement with it, not as Upform's sub-processor. A custom webhook or n8n workflow receives answers at the URL you enter. So each connected tool needs its own DPA on your side and its own line in your notice.

Connect integrations

Send your form responses to your favorite tools.

MailchimpAdds subscribers to “Studio notes” with double opt-inConnected

Google SheetsAppends every response to “Quote requests 2026”Connected

HubSpotCreates or updates the contactConnect

Name reCAPTCHA in your notice too. Google processes technical data from each submission to score it for spam, which is why every published Upform form carries a short reCAPTCHA line linking to Google's privacy policy and terms.

10. Check where the data travels

Personal data leaving the EEA or UK needs a transfer mechanism unless the destination country has an adequacy decision. The usual tools are the European Commission's Standard Contractual Clauses, the UK International Data Transfer Addendum and, for certified US companies, the EU-US Data Privacy Framework.

Upform covers its own transfers with those clauses (Module Two, controller to processor) or the UK Addendum, as its DPA sets out. You cannot choose the region where Upform stores your data today, so if your organization needs data kept in a particular country, email hello@upform.com before you build. Your integrations add their own transfers: check where each tool stores data and which mechanism it relies on.

11. Be ready for rights requests

People can ask to access their data (Article 15), correct it (16), erase it (17), restrict it (18), receive it in a portable format (20) and object to processing (21). You generally have one month to respond, which can be extended by two further months for complex or numerous requests.

The hard part is finding everything about one person. In Upform, search the Responses table by name or email across all your forms, or open the person in the Contacts directory to see their submission history. Export the rows as CSV for an access request, and delete them for an erasure request. Then repeat the search in each connected tool, because deleting in Upform does not delete the copy in your spreadsheet or CRM.

If a respondent contacts Upform about your form, Upform refers them to you. Decide now who on your team answers.

12. Limit access and plan for a breach

Article 32 asks for security appropriate to the risk. On Upform's side that means row-level security on every table, uploads scoped to the form, HTTPS, and forms that stay private until you publish them. The security measures page lists them in full, and GDPR compliant form security explains them in plain language.

On your side, limit who sees the answers. On Pro, invite up to five teammates with team permissions instead of sharing one login. Keep answers out of places they do not belong, such as a busy public Slack channel, and narrow each File Upload question to the file types and size you need.

If a breach does happen, Upform notifies the account owner without undue delay. You then decide whether it has to be reported to your supervisory authority, which Article 33 expects within 72 hours of becoming aware of it unless the breach is unlikely to put people at risk.

Consent wording you can copy

Most consent problems are wording problems. Each line swaps a vague sentence for a question someone can answer, and each promise has to match what you then do.

Before you publish: the short version

• Every purpose has a lawful basis written down.
• Every question has an owner and a use. The rest are gone.
• A Statement step says who you are, why you ask and how long you keep answers.
• Consent questions are separate, one per purpose, start empty and let No through.
• Special category questions are removed, or justified, explicit and on their own step.
• A retention period is set, and the first deletion date has an owner.
• Every integration is named in your notice and covered by its own DPA.
• Someone can find, export and delete one person's answers in minutes.

Everything here except inviting teammates works on Upform's free plan: unlimited forms and responses, all 21 question types, logic and every integration. When the form is ready, read how to embed a form and form accessibility next.