Lead capture forms and GDPR consent: UK compliance checklist

What to take away

A lead capture form needs a lawful basis before it needs a consent checkbox, and consent is only one of six lawful bases under the UK GDPR.
Consent must be freely given, specific, informed and unambiguous, with a positive action and no pre-ticked box.
The privacy notice must name the controller, purposes, lawful basis, recipients, retention period and individual rights.
Marketing consent is separate from the lead capture purpose, and PECR rules apply to email and SMS.
Keep a dated record of the form wording and the lawful basis, because the ICO can ask for evidence.

The lawful basis question comes before the checkbox

Under the UK GDPR, processing personal data requires a lawful basis. Consent is one option. Legitimate interests, contract and legal obligation are others. A checkbox alone does not create lawfulness.

Is consent the right basis?

Do you need consent for this lead data?

Yes

Use clear affirmative action, record evidence

Document legitimate interests balancing test

The ICO's consent guidance explains that consent means a clear affirmative action. Silence, inactivity and pre-ticked boxes do not count. For lead capture, record what the person saw, when they acted and what they were told.

A legitimate interests assessment is not the same as consent. It needs a documented balancing test. The person still needs a privacy notice, and they can object to processing.

Consent wording that meets the UK standard

The retained EU GDPR text sets the conditions for consent. It requires a request in clear and plain language, separate from other terms, and an easy way to withdraw consent at any time.

Compliant vs non-compliant consent wording

Compliant

Language: Clear and plain
Separation: Separate from terms
Withdrawal: Easy at any time
Purpose: Specific to what they get

Non-compliant

Language: Vague or legalistic
Separation: Bundled with T&Cs
Withdrawal: Hidden or absent
Purpose: Unrelated purposes mixed

A compliant checkbox should say what the person will receive, from whom, and how often. Avoid bundled consent for unrelated purposes. If a landing page offers a guide download and a newsletter, collect two separate choices.

Keep consent records for as long as you rely on that consent. If the purpose changes, ask again. A new purpose needs a new lawful basis review, not a recycled checkbox.

A six-step lead capture compliance checklist

Six-step lead capture compliance checklist

Name the lawful basis for every field in the form, including any hidden fields passed by tracking.
Write consent wording that is specific to the purpose and not mixed with terms and conditions.
Use an unticked checkbox for marketing consent and a separate unticked checkbox for any other optional purpose.
Link to the privacy notice from the form, and state the retention period or the criteria used to set it.
Record consent evidencethe wording shown, the timestamp, the source URL and the form version.
Give a withdraw option in every marketing message, and honour it without asking for a reason.

Before release, run the page through a landing page quality checklist that includes the form, the privacy notice and the consent record. The same checklist should apply to pop-ups, exit intent forms and chat widgets. If a tool captures an email address, it captures personal data.

Retention, rights and marketing rules

Keep lead data only as long as needed for the stated purpose. The ICO's individual rights guidance covers access, rectification, erasure and objection. A form should make those rights easy to exercise.

Electronic marketing has its own rules under PECR. The ICO's direct marketing guidance explains that soft opt-in applies only in limited situations. A lead form for a newsletter should not assume consent to sell data to third parties.

A processor contract is needed with any form builder or CRM that handles lead data. The contract must set out instructions, security and deletion terms.

This article is general guidance, not legal advice. Individual cases need a qualified adviser.

Common questions

Do I need a consent checkbox on every lead capture form?

No. A checkbox is only needed when consent is the lawful basis. If you rely on legitimate interests or contract, you still need a privacy notice and an easy way to object.

Can I pre-tick the marketing consent box?

No. Pre-ticked boxes do not count as consent under the UK GDPR. The person must take a clear affirmative action, and the box must be unticked by default.

How long can I keep lead data?

Set a period that matches the purpose and tell people about it. The ICO does not prescribe one fixed retention period for all leads. Review and delete data when the purpose ends.

What should a UK small business do first?

Write down the purpose and lawful basis before you choose a form builder. The guide on how to build a landing page for a UK small business shows a simple way to structure that record.