Go through every form on the site and ask five questions: what it collects, whether each field is needed, where submissions are stored, who receives them, and how long they are kept.

A day for looking at forms

Yesterday was Data Privacy Day, marked each January 28 to encourage people and organisations to think about how personal information is handled. It fell on a Sunday this year, so most businesses missed it.

It is still a good excuse for a job that rarely gets done: opening every form on your website and following what happens to the information people type into it.

Most sites have more forms than their owners remember, and every one of them collects personal information.

Every form, including the forgotten ones

The fifth is the one most often forgotten. A page built for a spring promotion three years ago can still be live and still collecting, sending entries to an address nobody checks.

Five questions for each form

For every form, write down the answers to five questions.

What it collects, field by field. Whether each field is actually needed. Where the submissions are stored. Who receives them. And how long they are kept.

It takes about ten minutes a form, and the answers are usually more surprising than the questions.

Send a test entry through each one while you do it, and watch where it lands. That is quicker than reading settings, and it finds the copies nobody set up on purpose.

Whether every field is needed

Under Canadian privacy law, a business should gather no more personal information than an identified purpose requires. The simplest test is to ask what anybody does with each answer.

A date of birth on a newsletter sign-up, a full street address on a general enquiry form, a required phone number from someone who chose to write: if nobody uses the answer, remove the field.

Be especially wary of fields that invite sensitive information. A careers form has no reason to ask for a social insurance number, which belongs after somebody is hired, not before.

Where submissions are stored

Most owners assume a form sends an email and that is the end of it. Often it is not.

Some form plugins also keep every entry in the website's database, indefinitely unless told otherwise. Forms built with outside services keep entries on that company's servers, often in the United States.

Uploaded files, such as resumes or photographs, usually sit in a folder on the web server, and on some sites anybody with the link can open them.

Entries may also flow into a mailing list, a spreadsheet or a customer system, and they sit in every backup of the site. Each copy is personal information the business is responsible for.

Who receives them

Look at every address each form sends to, including any copies. This is where the surprises usually are.

The address of an employee who left two years ago. A personal email account somebody added while covering a holiday. The web designer's own address, added for testing and never removed.

Every name on that list can read every enquiry. Reduce it to the people who need them, ideally through one shared business address.

A worked example

A martial arts school with classes for children and adults had three forms: a contact form, a free trial class booking, and a job application for instructors.

The trial booking asked a parent for the child's date of birth, school and any medical conditions, along with the parent's phone and email.

The instructors needed the age and the medical notes. Nobody used the name of the school for anything.

Bookings were emailed to three instructors, including one who had left and whose address now forwarded to his personal account. The form plugin had kept every booking since 2014.

The page was also on plain HTTP, so Chrome told parents it was not secure as soon as they started typing.

The owners moved the site to HTTPS, removed the school field, and sent bookings to one shared address read by the head instructor and the office.

Old entries are now deleted after ninety days, and the medical notes of students who join are kept with their registration forms.

How long they are kept

Canadian privacy law also expects personal information to be destroyed, or made anonymous, once it is no longer needed for the reason it was collected.

For most enquiries, that purpose ends within weeks. The person was answered, booked, or went elsewhere. Enquiries that became work belong in the customer's file, and the rest can go.

Choose a period, write it down, and apply it to every copy: the plugin's entries, the inbox folder the notifications land in, and any spreadsheet the form feeds.

What the form tells people

A form should say, briefly, what the information is for. One line near the button is enough, saying the details are used to reply to the enquiry, with a link to the privacy policy.

A newsletter box on a contact form should be a separate, unticked choice, so that asking a question does not quietly become a subscription.

And every page with a form should be on HTTPS.

Since October, Chrome marks a plain HTTP page as not secure the moment a visitor starts typing into it, which is not the message a business wants beside its own form.

The counter-case

For some sites this is a short job.

A site with one simple contact form, sending to one shared inbox, storing nothing and already on HTTPS, can be checked in a quarter of an hour.

At the other end, forms that collect health details, financial information or anything about children deserve more than a self-check, and a review by somebody who does this regularly is worth the cost.

For everyone in between: what each form collects, whether each field is needed, where it is stored, who receives it, and how long it is kept.

This week

  1. Open every page with a form on it.
  2. List each field and what it is used for.
  3. Remove fields nobody uses.
  4. Check every address the form sends to.
  5. Find where entries are stored on the site.
  6. Choose how long submissions are kept.
  7. Move every form page onto HTTPS.

Step four is the one that most often turns up something urgent, because an address belonging to a former employee or supplier means somebody outside the business is still reading every enquiry.

How the same forms fit the European rules arriving in May is covered in four months until GDPR.

Frequently asked questions

Which forms should I check?

Every one: contact, quote and booking forms, newsletter sign-ups, careers forms, landing pages from old campaigns, and blog comments, which store names, emails and IP addresses.

How do I know if a field is needed?

Ask what anybody does with the answer. If nobody uses it, remove it. Under Canadian privacy law, collection should stop at what an identified purpose needs.

Where are form submissions stored?

In the notification inbox, often in the website's database too, on outside form services, in connected lists or spreadsheets, and in every backup of the site.

Who should receive form submissions?

Only the people who need them, ideally through one shared business address. Check for former employees, personal accounts and test addresses left by whoever built the site.

How long should we keep submissions?

Only as long as the purpose needs. Move enquiries that became work into the customer's file, choose a period for the rest, and apply it to every copy.

Why does HTTPS matter for forms?

Since October, Chrome marks a plain HTTP page as not secure once a visitor starts typing into a form, which is the wrong message beside your enquiry form.

West Coast Media Solutions Inc. provides web design, web development, hosting, digital marketing, and business consulting to organisations across Canada, drawing on more than twenty-five years in the field.

Forms sending to people who left?

Give us the site's address, and we will find every form on it and every inbox its submissions reach.

Start a Conversation