Contact forms do not require consent under GDPR. The conditions for the lawfulness of processing personal data, as set out in Article 6 GDPR, are equivalent.

This means that companies can process contact form data under the legitimate interest of communicating with potential or existing customers and suppliers. However, it is essential to implement risk-appropriate technical and organizational measures.

In practice, this means that the form should be encrypted (e.g., via HTTPS).