Who is responsible for the data a form collects

A contact form, a booking request or a symptom checker on a practice website collects personal data the moment someone fills it in, and the practice is the party responsible for what happens to that data next. In data protection law this makes the practice the data controller: the organisation that decides why the data is collected and what it is used for.

The law behind the requirement

The relevant law is the UK General Data Protection Regulation (UK GDPR), read alongside the Data Protection Act 2018. The Information Commissioner's Office (ICO) is the regulator that oversees how both apply to a website form, and its own published guidance is the authority on what a controller is expected to do.

Why a symptom is treated differently from a name

A name or a phone number is ordinary personal data. A symptom, a diagnosis or anything else about a person's health is special category data, and the UK GDPR sets a higher bar for collecting it: the practice needs a specific lawful condition for processing that part of the form, separate from whatever basis covers the contact details sitting next to it.

Registering with the ICO

Most organisations that process personal data, which includes a practice running a website enquiry form, are required to pay the data protection fee and appear on the ICO's public register. That registration belongs to the practice, and does not change because the site is rebuilt or moved to a new provider.

Checking that a form still asks only for what it needs, and that the practice's ICO registration is current, is the kind of item that fits an annual website review.

This describes what the law and the ICO's guidance require of a website form. It is not legal or regulatory advice, and a practice with a specific question about its own forms should put it to the ICO or a data protection adviser.

A contact form on a practice website usually asks for a name, a phone number and a reason for getting in touch. Some ask for more: a symptom, a date of birth, an existing patient number. The moment that information is typed in and submitted, the practice has collected personal data, and the Information Commissioner's Office (ICO) expects the person filling in the form to know what happens to it before they press submit.

What the notice next to the form has to say

This is sometimes called a privacy notice or a fair processing notice. Whatever it is labelled, the ICO expects it to cover, in terms the reader can actually follow:

• What is being collected (name, contact details, and anything else the form asks for)
• Why it is being collected (to arrange an appointment, to respond to an enquiry, to pass to a specific team)
• How long the practice intends to keep it
• Who else might see it, if anyone: a booking system, a reception team, an out-of-hours provider

Why a footer link to a general policy usually falls short

Many practice websites carry a privacy policy somewhere in the footer, written to cover the whole site at once. That document has a place, but it does not meet the ICO's expectation that this information sits at the point of collection, meaning next to the form the reader is actually filling in.

What this looks like in practice

On most forms this is a short paragraph placed directly under the fields or just above the submit button, in language a patient or client would use themselves. Where the form collects anything beyond a name and a contact detail, such as a symptom or a reason for the enquiry, that notice needs to say so specifically.

The ICO's own current guidance on privacy notices is the authority on what a notice must contain, and it is worth checking against directly for the wording it expects.

A contact form or booking request does not end when the reader presses submit. The details they typed sit somewhere, are read by someone, and get kept or deleted according to a decision the practice has to be able to state. That decision is what an inspector or a patient asking about their own data will actually want to see.

How long the details are kept

The Information Commissioner's Office (ICO) does not set a single retention period for every practice and every field on a form. What it expects is that the practice has decided a period, can say what it is, and applies it. A general enquiry asking about opening hours does not need the same retention as a form where someone has described a symptom or a legal problem, because the second holds more sensitive information and a shorter, more deliberate retention period is easier to justify.

Where the submission actually goes

On most practice websites a form submission is emailed to a member of staff, stored in the website's own database, or forwarded to a booking or practice management system. Each of these is a different place the data sits, and each needs its own answer to who can see it, whether it is backed up, and when it is removed. A form that quietly emails every submission to a shared inbox, with no note of when those emails get deleted, is a common gap.

What the practice must be able to show

If asked, a practice should be able to say where a form submission is stored, who can access it, how long it is kept before deletion, and what happens if someone asks for their details to be removed. This does not need to be a long document. It needs to match what the website actually does, which means checking the form's settings.

A site built as part of the Living Site at webdesign.uk sits within a maintained record of what each form does with the data it collects, for as long as the site is hosted there. webdesign.uk builds and maintains sites on this basis; it does not currently take on sites built elsewhere. Nothing here is legal or regulatory advice, and the practice's data protection obligations should be checked against the ICO's own current guidance or a qualified adviser, since guidance and the practice's own arrangements can both change. Details on how to reach the practice about its own data handling can sit on the contact page.