The contact form is also personal data.
A name field and a phone number field are enough for your website to process personal data, with obligations under the law.
The website collects your name, phone number, and email through a form, processing personal data in accordance with the Personal Data Protection Law No. 91/2025/QH15 and Decree 356/2025/ND-CP. At a minimum, the form should: only ask for necessary information, clearly state its purpose, obtain your consent before submission, have an easily accessible policy page, limit data retention time, and provide a way for you to request access, correction, or deletion of your data. For specific cases, consult a lawyer.
- websites with contact forms, appointment scheduling, and news subscriptions.
- service companies collect customer information through the web.
- the website has no forms.
The contact form is the simplest place on the website, and it is also where businesses often forget they are taking on a responsibility. When you enter your name and phone number and click send, the business has collected personal data, which is now subject to the Personal Data Protection Law No. 91/2025/QH15 and Decree 356/2025/ND-CP.
Ask precisely, do not ask unnecessary questions.
Each additional field in the form makes customers hesitant to fill it out and adds another type of data that needs protection. The contact form typically only requires your name, a contact method, and a message. Date of birth, address, and ID number should only be asked when the service truly requires it, and the reason for needing it should be clearly stated.
What the form needs.
- Clear purpose: a short sentence next to the submit button, stating what the information will be used for (to follow up, send a quote, confirm an appointment).
- Active consent: a checkbox that is not pre-checked, linked to the stated purpose. If you want to use the data for other purposes, such as sending promotional messages, separate consent is required.
- Easy-to-find policy page: a link right at the form, stating what is collected, for what purpose, how long it is retained, who can view it, and where to send it.
- Retention period: data is not kept indefinitely. Once the purpose is fulfilled, it should be deleted or made unrecognizable.
- Customer rights: how customers can request to view, edit, withdraw consent, or delete their data, and the recipient of such requests.
The location of the data also carries responsibility: data sent by customers to employees' personal mailboxes, publicly shared spreadsheets, or third-party tools stored abroad all pose risks. Transferring personal data abroad also entails specific obligations under Law 91/2025 and Decree 356/2025. You should know where the data goes after you click send, and which party processes it on behalf of the business.
Common errors
- Copy the sample policy page from abroad, stating what the website does not do and omitting what the website does.
- Collect phone numbers from the contact form into a marketing list without separate consent.
- Retaining customer data from many years ago that is no longer used.
Decision checklist
Topic: How the website form for collecting customer information complies with personal data laws. Sinh Vũ guide, sinhvu.com
Select each item you find appropriate, then print or save as PDF to take with you.
If you have marked most of the signs above, this is the time to discuss in more detail. Sinh Vũ can help you review and propose a direction.
This article provides general information according to the documents in effect as of October 7, 2026. This is not legal advice and does not replace the opinion of a lawyer for your specific case. Rights and obligations between Sinh Vũ and the client only arise according to the signed contract.
How Sinh Vũ handles your data: see Privacy policy.
References
The Personal Data Protection Law No. 91/2025/QH15. Decree 356/2025/ND-CP details the Personal Data Protection Law. Practical experience in form design.
Frequently asked questions
Which document has replaced Decree 13/2023?
The content of personal data protection is now regulated by the Personal Data Protection Law No. 91/2025/QH15 and Decree 356/2025/ND-CP, both effective from 01/01/2026; Decree 13/2023 will cease to be effective from that date. The website was previously compliant with Decree 13, so it should review its policies and consent procedures according to the new regulations.
Should the consent checkbox be pre-checked?
Pre-checking should not be done. Consent needs to be an active action from the customer, linked to a specific purpose. A pre-checked box or a small note at the bottom of the page is unlikely to be considered clear consent.
Does a small introductory website need a separate policy page?
It should be included. The law requires notifying customers about data processing before collection; for websites, the policy page is the most concise and easily demonstrable way. The page doesn't need to be long, but it must accurately state: what is collected, for what purpose, how long it is retained, who can access it, and how customers can contact to request access or deletion.
This article is for reference. The scope, pricing, and specific commitments of Sinh Vũ are detailed in the proposal and signed contract.