Updated 18 September 2026. This replaces our pre-GDPR introduction from 2017 with a practical look at website data handling.
A website enquiry rarely stays in one place. It might reach an inbox, be stored in WordPress, pass into a CRM and trigger a notification to your team. Before updating a privacy notice, find out what actually happens to that information.
Follow one enquiry from start to finish
Use a clearly labelled test enquiry and trace its route. Which systems receive it? Does an integration create another copy? Who can open it? Include form entries, email, CRM records, exported spreadsheets and backups in your review.
For each step, record the information involved, why it is needed, who is responsible for it and how it is removed when no longer required. Check whether an enquiry automatically subscribes someone to marketing; the two activities need separate consideration.
Match your privacy information to the real process
Your notice should explain who you are, the purposes and lawful bases for using personal information, relevant recipients, retention periods or criteria, and people’s applicable rights and complaint routes. Other information may be needed depending on your processing. Use the ICO’s privacy information checklist to review the detail.
Do not promise that information is never shared if a hosting, email or CRM provider processes it for you. A notice that describes the real setup is more useful than a copied template.
A checkbox is not the answer to every question
Consent is one lawful basis, not a universal requirement for every website interaction. Choose the basis that fits the purpose and circumstances; do not add a mandatory marketing checkbox to a simple enquiry. The ICO explains when consent is appropriate.
Make the process manageable
- Collect only the fields needed for the task.
- Limit staff access to the systems they use.
- Agree how requests to access or correct information reach the right person.
- Review integrations when tools, suppliers or services change.
For the next step, read our five website privacy checks. We can help inspect forms, integrations and technical settings as part of your website project.
This is a technical starting point, not a certification of compliance. Use current ICO guidance and specialist advice for decisions about your organisation’s legal obligations.
