Legal basis
A legal basis answers the question “on what grounds are you processing this data?”. The GDPR lists six, and without one of them you may not process personal data at all — consent is only one of them, not the default.
With forms you mostly meet three. **Performance of a contract** covers orders, paid event sign-ups and returns — you cannot fulfil the contract without the customer's details, so consent is not needed. **Legitimate interests** covers things like replying to an enquiry. **Consent** is for processing that none of the others justify — typically marketing emails.
The difference is practical, not academic. Consent must be freely given, specific and withdrawable — and when someone withdraws it you must stop. A “I agree to the processing of my data” box on an order form therefore makes no sense: the order cannot be fulfilled without the data, so the consent would not be free.
A working rule: write down what you do with the data and assign a basis to each purpose. If you cannot find a basis for a purpose, that purpose does not belong in the form.
FAQ
Do I need consent on every form?
No. Orders and sign-ups usually rely on performance of a contract. Consent is typically for marketing.
What if one form serves several purposes?
Each purpose has its own basis. Separate a newsletter opt-in into its own checkbox.
Is a link to the privacy policy enough?
You must always inform people, but information is not a basis — you need the basis as well.
Related
Try Gatherino for free
Free plan: 3 forms and 100 responses a month. No credit card, EU-hosted data.
Get started free →