I created a website for a friend's company that has no user account feature, it is only meant to be an online catalog for prices. The only user data we might receive are data that users fill in the contact form (name, surname, phone number and email) which we receive by email in the official website's mailbox. Is this website concerned by GDPR? Are data received through the contact form considered "personnal data" as GDPR mention?


GDPR only applies if you or your users are European or actually in Europe.

‘Personal data’ is data that can be used to identify an individual. Given that, do you think names, phone numbers and email addresses are personal data?

  • Since such info is not collected unless it is filled in by the user, and a 'send" button is clicked, would that not constitute sufficient consent under the GDPR? Assuming that the user is in Europe, of course, or the site is. – David Siegel Jan 2 at 2:15
  • 1
    @DavidSiegel the OP asked if they needed to comply - not how. Anyway, you have not dealt with deletion and security. – Dale M Jan 2 at 2:59
  • @ Dale M that makes sense. Thank you. But it raises an interesting question. If one invites people to send emails with identifying info, what obligations does one have under the GDPR (assuming that receiver or senders are in Europe). Perhaps i will ask this as a separate question. – David Siegel Jan 2 at 3:11
  • @DaleM Yes both website and users will be inside/from Europe. Because there will be no user account (not even mailing lists), deletion and security (about stored personal data) should not be considered. Tell me if I'm wrong. It's just an online pricing catalog. The only way we could receive personal data from anybody would be data sent to the official website's mailbox through the contact page. My concern is, because such emails will be kept in the official mailbox, is this website considered "storing" personal data? If no, should I add the GDPR consent notification on this website? – A. Gille Jan 2 at 13:26
  • 1
    Yes it is - you probably don’t need consent. Consent is only one of several methods that allow personal data to be kept - read the GDPR – Dale M Jan 2 at 20:38

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.