Contact Form Disclosure

NDPA Section 27 privacy notice on a public contact form — what you collect, lawful basis, retention, complaint route.

Open in StackBlitzOpen in CodeSandbox

Public contact forms collect personal data (name + email at minimum). Section 27(1) requires you to inform the data subject — before collection — of what you're doing with it. The notice doesn't have to be long; it just has to be there and link to the full policy.

Minimum-viable disclosure

'use client';
import { useState } from 'react';
import Link from 'next/link';
import { sanitizeInput } from '@tantainnovative/ndpr-toolkit/core';

export function ContactForm() {
  const [name, setName] = useState('');
  const [email, setEmail] = useState('');
  const [message, setMessage] = useState('');

  async function onSubmit(e: React.FormEvent) {
    e.preventDefault();
    await fetch('/api/contact', {
      method: 'POST',
      headers: { 'Content-Type': 'application/json' },
      body: JSON.stringify({
        name: sanitizeInput(name),
        email: sanitizeInput(email),
        message: sanitizeInput(message),
      }),
    });
  }

  return (
    <form onSubmit={onSubmit} className="space-y-3">
      <input
        type="text"
        required
        placeholder="Your name"
        value={name}
        onChange={(e) => setName(e.target.value)}
        className="w-full rounded border px-3 py-2"
      />
      <input
        type="email"
        required
        placeholder="Your email"
        value={email}
        onChange={(e) => setEmail(e.target.value)}
        className="w-full rounded border px-3 py-2"
      />
      <textarea
        required
        rows={4}
        placeholder="How can we help?"
        value={message}
        onChange={(e) => setMessage(e.target.value)}
        className="w-full rounded border px-3 py-2"
      />

      {/* Section 27 minimum-viable notice — directly above the submit button */}
      <div className="rounded border border-blue-200 bg-blue-50 p-3 text-xs text-blue-900">
        <strong>How we use your data.</strong> We process the name, email, and message
        you submit only to respond to your enquiry (lawful basis: legitimate interest under
        NDPA Section 25(1)(f); contract steps under Section 25(1)(b) for existing customers).
        We retain enquiries for 12 months, then delete them. You have the right to access,
        rectify, or erase your data — contact our DPO at{' '}
        <a href="https://acme.ng/privacy" className="underline">acme.ng/privacy</a>{' '}
        for full details, or lodge a complaint with the NDPC (Section 46(1)).
      </div>

      <button type="submit" className="px-4 py-2 rounded bg-blue-600 text-white">
        Send message
      </button>
    </form>
  );
}

What Section 27(1) wants you to disclose

The Act gives a checklist. For a contact form, the relevant items are:

  • (a) Your identity and contact details
  • (b) The lawful basis (Section 25(1) — for a contact form it's usually legitimate interest or pre-contract)
  • (c) Recipients of the data (if any third parties — e.g. your email provider)
  • (d) The data-subject rights under Part VI (point them at your full privacy policy)
  • (e) Retention period (or the criteria — "12 months" is concrete and audit-friendly)
  • (f) Right to lodge a complaint with NDPC under Section 46(1)
  • (g) Automated decision-making (if any — usually n/a for contact forms)

The short notice above covers (a)–(f); (g) is omitted because contact forms don't do automated decisions. If you DO route enquiries through an automated triage / chatbot, add a sentence per Section 37.

Don't over-collect

A contact form needs name + email + message. Resist the urge to ask for phone, company, country, role. NDPA Section 24(1)(c) requires data minimisation — only collect what's necessary for the stated purpose. Sales lead enrichment is not the stated purpose of a public contact form.

Related