Before launching an enquiry form, decide why each field is collected, whether it is necessary, how long it is kept, who receives it, and how the person can request access or deletion. A checkbox beside “I agree” does not repair an undefined data flow.
This is an operational checklist, not individualized legal advice. Requirements vary by jurisdiction, audience, sector, and data type; obtain qualified review where the risk is material.
Start with a field map
| Field | Purpose | Required? | Retention trigger | Main risk |
|---|---|---|---|---|
| Name | Address and identify the conversation | Often avoidable or optional | Enquiry resolved plus defined retention | Excess identification |
| Email or phone | Reply through the selected channel | One contact method may be enough | Enquiry resolved plus defined retention | Unrelated marketing use |
| Company | Route a business request | Usually optional | Same as enquiry | Profiling or unnecessary collection |
| Message | Understand the request | Required but free text is risky | Same as enquiry | Visitors enter sensitive data |
| Attachment | Review necessary material | Collect only when justified | Short, explicit period | Secrets, IDs, malware, special-category data |
Delete fields that have no clear purpose. Make optional fields visibly optional. Do not ask for both phone and email by default when one reply channel is sufficient.
Put the essential notice next to the action
The person should be able to understand, before submitting:
- who is collecting the information;
- the purpose of collection and use;
- the specific fields collected;
- which fields are required or optional;
- the retention or deletion rule;
- relevant processors or overseas transfers;
- how to refuse and what happens if required data is not provided;
- how to exercise access, correction, deletion, or complaint rights.
Link to the full privacy policy for detail, but do not hide the form-specific decision inside a long general policy. The Korean Personal Information Protection Commission’s current guidance explains how to document data processing clearly and transparently with concrete examples.
Separate enquiries from marketing
Answering a requested enquiry and sending future promotions are different purposes. Use a separate, optional marketing choice when required, leave it unticked by default, and record which notice and choice the person saw. Withdrawing marketing permission should not delete an active support request unless the applicable retention rule also requires deletion.
Minimize the operational footprint
- send notifications without copying the full message into unnecessary inboxes;
- restrict the CRM or mailbox to staff who handle enquiries;
- define attachment type and size limits;
- keep an audit record of notice version and consent state without storing excessive device data;
- test deletion across the form database, CRM, mailbox, backup policy, and processors;
- place secrets and customer records outside ordinary analytics events.
Review after launch
Every quarter or material workflow change, compare the live fields, notice, processors, recipients, and actual retention job. A policy that describes last year’s form is not an effective notice.
The best privacy copy begins with less data. Collect only what the team can justify, protect, retrieve, and delete.
Need a clearer first step for your website?
Start with the situation and outcome. We will help define the scope and next step.