What the Data Privacy Act means for your website contact form
Most company websites in the Philippines carry one form: name, mobile number, message. When someone fills it in, an email lands in info@, a copy goes to the owner’s phone, and whoever is free replies. For many companies that is the whole system, and it works.
Under the Data Privacy Act of 2012, that form also did something nobody planned. The moment it collected a name and a mobile number, your company became a personal information controller. Data Privacy Act compliance for websites starts with that form, not with the privacy policy page nobody reads. What follows is practical guidance, not legal advice. Where registration or sensitive data is involved, ask a lawyer.
Consent is a sentence next to the button, not a policy page
The law gives the person filling in your form the right to know what you collect, why, who will see it, how long you keep it, and how to ask for it back. A link to a privacy policy in the footer does not meet that on its own. What meets it is a short notice beside the submit button, in plain language: we use your name and number to reply to this enquiry, we keep it for a stated period, we do not share it.
Two rules follow. First, if you intend to do anything beyond replying, such as adding the number to a Viber broadcast list or an SMS promo, that is a separate purpose and needs a separate, unticked box. The Act defines consent as a freely given, specific and informed indication of will. A box that was ticked before the visitor arrived is not an indication of anything. Second, watch what the message field invites. Imagine a physiotherapy centre whose form asks patients to describe their concern. It is collecting health information, and health information is sensitive personal information under the Act. If you do not need the answer to route the enquiry, do not ask for it.
Who can open the inbox, and for how long
Ask who can read the messages your form sends. The honest list is usually longer than expected: the shared info@ password known to four people, the Gmail app on two staff phones, the forwarding rule set up by someone who left last year, the Messenger page inbox with six admins. Every one of those is a door to personal data you are accountable for.
Mobile numbers deserve particular care. Since SIM registration became mandatory, a Philippine mobile number is tied to a real identity. It is often the same number behind a GCash or Maya account, and it is exactly what scam texters want. A spreadsheet of names and numbers exported from a form plugin is not harmless clutter. Treat it like cash in a drawer.
Name the people who need access and remove everyone else. Turn on two-factor authentication on the mailbox. Delete forwarding rules you cannot explain. Take leavers off the Facebook page the day they leave.
Then decide how long you keep submissions. The Act says personal information may be kept only as long as the purpose needs it. A contact enquiry has a short life: you reply, the conversation moves to a quote or a call, and the entry is done. Pick a retention period you can defend, write it in the notice, and delete on schedule. Many WordPress form plugins store every submission in the site database by default, and it stays there through every redesign until someone deletes it. Exported spreadsheets and the owner’s phone count as copies too.
Someone has to be the data protection officer
The Act expects every personal information controller to designate someone accountable for data protection. The National Privacy Commission calls this person the data protection officer. In a company of twelve people it would usually be the operations head or the owner, named in writing, with three jobs: know where the personal data is, answer people who want to see, correct or delete their data, and lead the response if something goes wrong.
On that last point, the Commission’s rules set a fixed deadline for reporting a serious breach, and the affected people must be told as well. A lost phone with the inbox open, a form plugin with a known vulnerability left unpatched, or a spreadsheet emailed to the wrong person could all qualify, depending on what was in it. Decide who handles that before it happens, not during.
Whether your company must also register with the Commission depends on your size, your sector and what you process. Check the Commission’s current circular and ask a lawyer if the answer is not obvious.
The plugins that copy your submissions somewhere else
Open the settings of your form plugin and look at the integrations tab. This is where the quiet copying happens. A tick next to Mailchimp, HubSpot, Zapier, Google Sheets or a CRM means every submission is sent to that vendor as it arrives. If the spam checker is Google’s, it sends the visitor’s browser details to Google to decide whether they are human. The chat widget in the corner stores the conversation on its own servers. The Messenger button hands the whole exchange to Meta.
Each of those can be legitimate. But each vendor is a personal information processor working on your behalf, the data is usually leaving the country, and the Act keeps you accountable for what they do with it. In practice that means three things. You should know the full list. Your notice should say that you share data with service providers, and roughly for what. And you should have read enough of each vendor’s terms to know they commit to protecting the data and deleting it when you stop paying.
Expect the list to take a morning to assemble, because the integrations were added by different people at different times and nobody wrote them down. Notice, too, which ones exist only because nobody turned them off. Three copies to protect are three copies to delete, and one is usually enough.
The housekeeping list
This is a job for whoever runs operations, and it does not need a developer to begin.
- List every form on the site, including the ones on landing pages and the newsletter box in the footer, and what each one collects.
- For each form, list every place a submission goes: inboxes, phones, the database, spreadsheets, integrations.
- Write a one-paragraph notice for each form and put it next to the button. Add an unticked box for any marketing use.
- Set a retention period, delete what is past it, and put the next deletion in someone’s calendar.
- Name the person responsible and write it down. Then check the Commission’s registration rules against your company’s size and sector.
Most of this is housekeeping. The form still works and the enquiries still come in. The difference is that when someone asks what you do with their number, you can answer in one sentence, and mean it.