Law Stack Exchange is a question and answer site for legal professionals, students, and others with experience or interest in law. It only takes a minute to sign up.
Sign up to join this community
I have a contact form on my website which collects the follow four fields: Full name, email address, subject, message.
I'm not storing any of the data in a database or in cookies.
When the user submits the form I receive an email with the information so that I can respond to them via email.
Am I breaching GDPR? Do I need permission to send them an email etc?
You are probably not breaching GDPR1.
First, consent(art 6.1.a of GDPR) cannot be implied, but it does not require that the user formally ticks a box. If you leave a field for "E-mail to answer back to you" and the user fills it, he has already consented to you processing his e-mail for the specific purpose of answering. It would be a "clear affirmative action".
Asserting that you have consent could be a little more complicated if you were forcing the user to provide the e-mail in order to send the form, since consent must be "freely given". If the kind of communications that are send to you may not require a reply (for example, to inform you that your website has some mistake), then it could be better to leave the e-mail field optional2.
Besides, consent is just one of the motives that allow you to process user data, and you might have a legitimate interest(art 6.1.f). For example, to avoid being spammed you might want to have a system that sends a confirmation link to that address, to confirm that it is indeed a legitimate user and not some bot, or to filter out messages send from some particularly troublesome person.
The limits of legitimate interest are a bit fuzzy, but I would be surprised1 if this use would not be contemplated as legitimate.
Besides,
I'm not storing any of the data in a database or in cookies.
is irrelevant; GDPR does not bother with the technical details of how the information is stored. It does not matter if you have the e-mail in a cookie, a database, a contact in you e-mail client or written in a clay tablet, what matters is that you have that piece of personal information.
2Although in that case maybe you could say that contacting you to complain or inform about mistakes in the web is not a "service" by itself. Practical details of laws may be complicated, and the GDPR still has little case law.
