united-kingdom gdpr email
Do I need user consent to respond to their email sent through my website&#39;s contact form?
<p>I have a contact form on my website which collects the follow four fields: Full name, email address, subject, message.</p>

<p>I'm not storing any of the data in a database or in cookies.</p>

<p>When the user submits the form I receive an email with the information so that I can respond to them via email.</p>

<p>Am I breaching GDPR? Do I need permission to send them an email etc?</p>

<p>You are probably not breaching GDPR<sup>1</sup>.</p>

<p>First, <em>consent</em>(art 6.1.a of GDPR) cannot be implied, but it does not require that the user formally ticks a box. If you leave a field for "E-mail to answer back to you" and the user fills it, he has already consented to you processing his e-mail for the specific purpose of answering. It would be a <a href="https://ico.org.uk/for-organisations/guide-to-data-protection/guide-to-the-general-data-protection-regulation-gdpr/consent/what-is-valid-consent/" rel="nofollow noreferrer">"clear affirmative action"</a>.</p>

<p>Asserting that you have consent could be a little more complicated if you were forcing the user to provide the e-mail in order to send the form, since consent must be "freely given". If the kind of communications that are send to you may not require a reply (for example, to inform you that your website has some mistake), then it could be better to leave the e-mail field optional<sup>2</sup>.</p>

<p>Besides, consent is just one of the motives that allow you to process user data, and you might have a <a href="https://www.gdpreu.org/the-regulation/key-concepts/legitimate-interest/" rel="nofollow noreferrer"><em>legitimate interest</em></a>(art 6.1.f). For example, to avoid being spammed you might want to have a system that sends a confirmation link to that address, to confirm that it is indeed a legitimate user and not some bot, or to filter out messages send from some particularly troublesome person.</p>

<p>The limits of legitimate interest are a bit fuzzy, but I would be surprised<sup>1</sup> if this use would not be contemplated as legitimate.</p>

<p>Besides,</p>

<blockquote>
  <p>I'm not storing any of the data in a database or in cookies.</p>
</blockquote>

<p>is irrelevant; GDPR does not bother with the technical details of how the information is stored. It does not matter if you have the e-mail in a cookie, a database, a contact in you e-mail client or written in a clay tablet, what matters is that you have that piece of personal information.</p>

<p><hr/>
<sup>1</sup>I am not a lawyer, I am not your lawyer.</p>

<p><sup>2</sup>Although in that case maybe you could say that contacting you to complain or inform about mistakes in the web is not a "service" by itself. Practical details of laws may be complicated, and the GDPR still has little case law.</p>
