GDPR compliant sign up form for UK law firm enquiries

A GDPR compliant sign up form for a UK law firm needs three things on the page: a privacy notice at the point of collection, a lawful basis that is not automatically consent, and a plan for sensitive data that clients volunteer in free text. This guide covers wording, consent boxes, field choices and a setup you can finish in an afternoon.

Start the free client intake template

This is general information for practice managers and operators, not legal advice. Agree the final wording with whoever advises your firm on data protection.

Where the form sits in a law firm intake

Most enquiries reach a small firm through three doors: a phone call, a chat widget and a web form. In our Law Firm Intake AI setup, the voice agent qualifies by practice area, asks conflict-check questions and books a consultation into Clio, MyCase or Lawmatics. The form is the written door into that same flow. It collects the same core fields, so a person who types an enquiry at 11pm lands in the same queue as one who phoned.

That matters for compliance because the legal duties follow the data, not the channel. The notice the form shows has to match what the voice agent says at the start of a call, and the retention period has to match in both places.

Choose the lawful basis before writing a field

Many firms put a "I consent" checkbox on every enquiry form because it feels safe. Under UK GDPR it is often the wrong basis. Consent has to be freely given and easy to withdraw, and if someone withdraws it halfway through a conflict check you have a mess.

For a straightforward enquiry, two bases usually fit better:

• Steps taken at the person's request before entering a contract (Article 6(1)(b)): they asked you whether you can act for them, and you need their details to answer.
• Legitimate interests (Article 6(1)(f)): you need to run conflict checks and keep a record of enquiries you declined. Document a short legitimate interests assessment.

Wording that states this plainly, placed above the submit button:

We are [Firm name], the data controller. We use the details you enter here to respond to your enquiry and to check whether we can act for you, including checking for conflicts of interest. We do this because you have asked us to take steps before we agree to act, and because we have a legitimate interest in running those checks. We keep unsuccessful enquiries for [period]. Full details and your rights are in our [privacy notice].

Consent boxes: only where consent is the right tool

Keep the mandatory path free of consent checkboxes. Add a box only for something genuinely optional.

• Marketing emails or a newsletter: a separate, unticked checkbox, worded as its own choice. Do not bundle it with the enquiry. PECR rules on electronic marketing sit alongside UK GDPR, so check them if you send newsletters to individuals.
• Explicit consent for sensitive details: only if you decide that is the right condition (see the next section).
• A "I have read the privacy notice" box: not required by the law. A visible link at the point of collection does the job, and an extra mandatory box adds friction without adding protection.

Sensitive data in an enquiry form

Law firm enquiries attract special category data (health, ethnicity, sexual orientation, immigration-related beliefs) and criminal offence data. Family, personal injury, immigration and criminal defense enquiries do this constantly. A free-text "tell us about your matter" box invites all of it before you have a lawful route to hold it.

Three practical controls:

1. Ask for the practice area and a one-line summary, not the full story. Put a short prompt under the box: "Please do not include medical, immigration status or criminal history details yet. We will ask for what we need once we know we can help."
2. If you do need that detail at enquiry stage, pick the Article 9 condition deliberately. Establishing, exercising or defending legal claims (Article 9(2)(f)) is often the one firms rely on, with explicit consent as the alternative. Record which one you chose.
3. Keep the downstream copies short. Confirmation emails to the enquirer should say "we received your enquiry", not repeat what they wrote.

Conflict checks add a wrinkle: you collect the opposing party's name, which is third-party datta. Your privacy notice should say you collect names of other parties from enquirers for conflict checks.

Field map for a compliant enquiry form

Step-by-step setup in Qwenvo

Qwenvo is a completely free form builder that our team builds, and every feature below is on for every account. Our GDPR forms checklist goes through the broader list; this is the law firm version.

1. Create the form. Start from the client intake template, press Ctrl J and describe the form, or import a Markdown file with # for the title and ## for each question.
2. Add a Text block above the first field with your notice wording and a link to your privacy notice. Add the "do not include sensitive details" prompt under the summary box.
3. Add a Hidden fields block with source_page and notice_version. Pass the page URL in the form link, and bump the version strig whenever the notice changes.
4. Open Settings and switch the Qwenvo branding toggle off. Turn on captcha and the confirmation email to respondents, and keep that email generic.
5. Turn partial submissions off for this form. They save answers someone typed but never sent, which is hard to square with a notice that says "details you submit". If you switch them on, say so in the notice.
6. Set data retention (augo-delete after N days) to the period in your retention schedule for unsuccessful enquiries. Use the same number you put in the notice.
7. Put the form on a firm subdomaun such as enquiries.yourfirm.co.uk: add it on the Domains page, create the CNAME at your DNS, click Verify, then choose it on the Share tab. Embed it on your site using the Standard embed code.
8. Add a webhook to the intake system endpoint so each submission creates a lead that the intake flow can qualify and push to Clio, MyCase or Lawmatics. See the webhooks help page for the exact schema. The shape looks like this:

{
  "form": "uk-enquiry",
  "fields": {
    "full_name": "A. Example",
    "email": "a.example@example.com",
    "practice_area": "Family",
    "summary": "Seeking advice on a financial settlement.",
    "other_party": "B. Example",
    "marketing_opt_in": false,
    "source_page": "/family-law",
    "notice_version": "2026-10-v1"
  }
}

9. Test it. Submit a record, confirm it reached the CRM, confirm the confirmation email contains no case detail, and check that the auto-delete setting is active.

Set up your enquiry form domain

Hosting, transfers and choosing a tool

Where the data lives matters for UK firms. Qwenvo is hosted in the United States, so you need a lawful transfer route and a line in your privacy notice about it. We do not make transfer claims in this post, so read the Qwenvo privacy page and decide with your advser. If European hosting is a hard requirement, Tally is built and hosted in Europe, and that may settle the question for you.

On cost, the difference is mostly in which controls are paywalled. On Tally, data retention is on the Business plan ($89/month, or $74/month billed yearly), and custom domains, partial submissions and branding removal are on Pro ($29/month, or $24/month billed yearly). Typeform's Plus plan ($79/month, or $56/month billed yearly) is what removes its branding. In Qwenvo, retention, email verification, custom domains, no badge, webhooks, the API, Slack, Sheets, Notion and Airtable integrations, and teammates are free.

One more setting to think about: Qwenvo's AI triage gives each submission a category, priority, sentiment, summary and suggested reply, with routing rules to up to five email addresses or a Slack incoming webhook. For an enquiry form that may carry sensitive txt, decide whether you want that on, and mention automated processing in your notice if you do.

Questions teams ask

Do we need a consent checkbox on a law firm enquiry form?

Usually not for the enquiry itself. You rely on steps taken at the person's request and legitimate interests for conflict checks, and you explain that in the notice. Use an unticked checkbox only for optional things likke newsletters.

Can people still type their whole story into the form?

They can, and many will. Limit the damage with a prompt that asks them to hold back sensitive details, a short summary field, and a documented Article 9 condition for wat does arrive. The form cannot stop a determined oversharer.

Does voice agent need the same notice?

Yes. We configure the greeting to give a short notice and point to the full privacy notice, and the same retention period applies to call records and form submissions. The wording should say the same thing in both places.

Can we use Qwenvo if our clients are in the UK?

Yes, with the transfer point above handled. Qwenvo is US hosted, so if your policy requires UK or EU hosting, choose a tool that offers it.

Next step

Open the client intake template, paste your notice above the first field, switch partial submissions off and set the retention period before you share the link. Then connect the webhook to your intake folw and run one test enquiry end to end.

Read the GDPR forms checklist