Skip to main content

PII Disclosures

mandatory disclosures for forms that collect PII​

This is an excellent and highly relevant question for a business like yours that handles warm leads, job applications, and client inquiries. The disclosures you need to make are mandated by a patchwork of privacy laws, most notably the GDPR (General Data Protection Regulation) in the EU and the CCPA (California Consumer Privacy Act) in the US.

The core principle across all these laws is transparency and purpose limitation. You must clearly tell people what information you're collecting, why you're collecting it, and what you're going to do with it.

Here are the mandatory disclosures for forms that collect PII, broken down by type:

General Disclosures for All Forms​

Every form on your website that asks for PII (e.g., name, email, phone number) must have these disclosures, often in a layered format with a link to a full privacy policy.

  • Notice of Collection: You must provide a clear and conspicuous notice at or before the point of data collection. This is often a short statement right next to the form.
  • Purpose of Collection: Explicitly state why you need the information. For a "Contact Us" form, this is "to respond to your inquiry." For a "Warm Lead Questionnaire," it's "to provide a personalized quote and assess your project needs."
  • Data Minimization: Only ask for the information you absolutely need to fulfill the stated purpose. Mark non-essential fields as "optional."
  • Link to Privacy Policy: Provide a clear and clickable link to your full privacy policy where users can get more detailed information.
  • Consent: Obtain clear and affirmative consent. This is usually done with a checkbox that the user must tick. The checkbox text should be specific, such as "I agree to the privacy policy and consent to my information being used to respond to my inquiry."

Specific Disclosures by Form Type​

1. "Contact Us" or General Inquiry Forms​

These forms typically collect basic PII. The disclosures are straightforward:

  • Purpose: To respond to the specific inquiry.
  • Retention Period: You should state how long you will retain the data, or at least how that retention period is determined (e.g., "We will retain this data for as long as necessary to address your request and for a reasonable period thereafter to manage records.").
  • User Rights: Inform users of their rights, such as the right to request access to their data, correct it, or request that it be deleted.

2. Warm Lead Questionnaire Forms​

These forms often collect more detailed information to qualify a lead. As your business focuses on web dev and digital marketing, this might include information about budget, project scope, business size, etc.

  • Purpose: The purpose is to assess their needs and provide a tailored proposal.
  • Data Sharing: This is a key disclosure for lead forms. If you use a third-party CRM, marketing automation tool, or share data with a sales team, you must disclose this. You must state the categories of third parties you share the information with and the purpose of that sharing (e.g., "to manage our customer relationships" or "for marketing analysis").
  • Consequence of Not Providing Data: Inform the user what happens if they don't provide the requested information. For example, "Not providing this information may prevent us from giving you an accurate quote."

3. Job Application Forms​

Job applications collect highly sensitive PII, and there are more stringent legal requirements.

  • Purpose: To evaluate the applicant's qualifications for a specific role.
  • Data Sharing: Disclose if the information will be shared with third parties, such as background check services, HR software providers, or external recruiters.
  • Background Checks: If your company plans to run a background check, you must provide a separate, clear, and conspicuous disclosure and obtain the applicant's written authorization before you conduct the check. This is a requirement under laws like the Fair Credit Reporting Act (FCRA) in the US.
  • Data Retention: State how long you will keep the application data on file, and for what purpose (e.g., "for up to one year for future hiring opportunities").
  • Sensitive Information: If you ask for sensitive PII (e.g., Social Security number, financial information), you must have robust security measures in place and disclose them. The principle of data minimization is especially critical here. Only collect this information when it is absolutely necessary.

That's an excellent question that gets into the practical application of privacy law, which is crucial for a software engineer and agency owner like yourself. You're thinking about the user experience (UX) and how to best implement these legal requirements.

Notice of Collection​

Let's break down the two main components you asked about:

A "Notice of Collection" is a short, easily understandable statement that informs users about the PII you are collecting and its purpose. It's a key requirement under laws like the CCPA.

  • Is a footer location OK? Yes, a link to the "Notice of Collection" in the website footer is a standard and widely accepted practice. Most users are accustomed to looking for legal and privacy-related links in the footer of a website. This method works for the general, non-form-specific notice.
  • Is that enough for a form? Not on its own. While the footer link is essential, the law requires that the notice be "conspicuous" and provided "at or before the point of collection." When a user is filling out a specific form, the most effective and legally compliant way to meet this requirement is to provide a brief, direct notice right next to the form itself.

Best Practice:

  • General Notice: A clear link in the website footer to your main Privacy Policy and/or a specific "Notice of Collection" page.
  • Form-Specific Notice: A short, sentence-level disclosure directly above or below the form's fields. This micro-copy is more effective and user-friendly because it's contextual. For example: "By submitting this form, you agree to our privacy policy and consent to your information being used to respond to your inquiry."

2. Checkbox Near End of Form by Submit Form Button?​

This is the standard and most legally sound way to obtain explicit consent for data collection, especially under the GDPR's strict requirements.

  • Is this location okay? Yes, placing the checkbox directly above or next to the submit button is the best practice. It ensures the user sees and interacts with the consent request right before they complete the action of submitting their information.
  • Why is this location ideal?
    • Clarity and Conspicuousness: It makes it impossible for the user to miss the consent request.
    • Unambiguous Consent: Ticking a checkbox is considered an "affirmative act" of consent. It's a clear signal from the user that they agree to the terms.
    • Proximity: It links the act of providing data directly with the act of giving consent, making the process logical for the user.
    • GDPR Compliance: The GDPR requires consent to be "freely given, specific, informed, and unambiguous." A pre-checked box is not compliant, so the user must actively tick it.

Best Practice for the Checkbox:

  • The checkbox should be required. The user should not be able to submit the form without checking the box.
  • The text should be specific. It should clearly state what the user is consenting to. For example: "I have read and agree to the Privacy Policy and consent to the processing of my personal data for the purpose of receiving updates and marketing communications."
  • Include a link. The text of the checkbox should include a hyperlink to the full privacy policy.

In short, a footer link is for general awareness, while a concise, in-form notice and a required checkbox near the submit button are for specific, legally compliant consent. This layered approach is the most effective way to meet legal obligations while providing a good user experience.