I created a website for a friend's company that has no user account feature, it is only meant to be an online catalog for prices. The only user data we might receive are data that users fill in the contact form (name, surname, phone number and email) which we receive by email in the official website's mailbox. Is this website concerned by GDPR? Are data received through the contact form considered "personnal data" as GDPR mention?

2 Answers 2


Names, phone numbers and email are indeed personal data. This has already been established in European jurisprudence prior to the introduction of the GDPR. Even IP addresses are (do you keep logs?).

Since the name and contact details are provided by the customer in order to initiate communications, you can keep them for a while. But please note that you can't be sure that the details are entered truthfully, so you should remove this data if the person does not respond via either phone or email.


GDPR only applies if you or your users are European or actually in Europe.

‘Personal data’ is data that can be used to identify an individual. Given that, do you think names, phone numbers and email addresses are personal data?

As such, if your users are (or might be) European then GDPR applies and the data is clearly personal - you need a reason to store it etc.

  • Comments are not for extended discussion; this conversation has been moved to chat.
    – Dale M
    Oct 1, 2019 at 3:11
  • Fair, but important for OP and any other readers to note that this answer is incorrect per the Article 29 Working Group opinion and Recitals 47, 48, 49, and 50 of the GDPR. More info can be found, among many other places, here: twobirds.com/~/media/pdfs/gdpr-pdfs/…
    – A.fm.
    Oct 1, 2019 at 3:24

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .