Who reads what people type into your website forms?
Every form on your site collects details from real people. Where they end up, who sees them and what you can tidy up this week without being a lawyer.
November 11, 2026Last updated November 11, 2026
Somewhere in a Google Drive there’s a spreadsheet called “Copy of Contacts FINAL (2)”. It holds 3,000 names, emails and phone numbers of people who once filled out a website form. An intern created it in 2022. The intern left. The spreadsheet is still there, shared with “anyone with the link.”
That spreadsheet is made up, but it probably has cousins in a lot of organizations. Nobody did anything wrong. Nobody thought about what happened after someone pressed “Send.”
A form is a small promise
When someone types their name, phone number and “I’d like a quote” into your site, they trust that someone on your team will read it and reply. They don’t expect it to end up on a mailing list they never asked for, or on the phone of someone who no longer works with you.
It’s very easy to keep that promise halfway without meaning to. The form sends an email to an address one person checks. That person copies it into a spreadsheet “so it doesn’t get lost.” The spreadsheet gets shared so someone else can follow up. And in three innocent steps, your customers’ details are out for a stroll.
Ask for less
The easiest way to protect a piece of data is not to collect it. Go through every field in your forms and ask whether you really use it. Do you need a date of birth to send a quote? A full address to sign someone up for a newsletter? Every field you remove is one less thing to protect, and a shorter form people actually finish.
If you work with something sensitive, like health or donations, pay even closer attention. That’s where it’s worth asking whoever handles your legal matters what to collect and how.
Follow one message
One afternoon, fill out every form on your site yourself with a test name. Then follow the trail. Which inbox did it reach? Who else gets it? Is it stored in a system or a spreadsheet? Who has access to that spreadsheet today, not in 2022?
You’ll find things. An email going to an account nobody checks. A spreadsheet shared with someone who left. A testing tool someone connected and never removed. None is serious on its own. Together they’re the kind of thing nobody wants to explain to a customer.
Read your privacy notice like a customer would
Your site probably links to a privacy notice in the footer. Open it and read it as if you were a customer. One quick tell for sites in Mexico: a new personal data law was published in 2025 and INAI, the old data protection authority, ceased to exist. If your notice still mentions INAI, nobody has reviewed it since.
We won’t tell you what your notice has to say; that’s for whoever handles your legal matters. What you can check yourself: that it’s readable, that it says who you are and what you use the data for, that it lists a real email where someone answers, and that it sits next to the form instead of hiding at the bottom of the page.
If you’d like us to walk through how your site’s forms work behind the scenes, book a free 30-minute call.
