Contact Form Compliance and DUAA Marketing Rules
In our recent article, Is Your Website and Complaint Procedure Compliant with the New DUAA Rules?, we set out the changes the Data (Use and Access) Act 2025 (DUAA) has brought in for cookies, complaints handling, and Data Subject Access Requests.
One area that we commonly see confusion on, and may catch several businesses out, including law firms, is the contact or enquiry form, and the way it is used to capture consent for marketing.
For most law firms, the contact form is the front door of the website. It is also one of the easiest places to fall foul of the Privacy and Electronic Communications Regulations 2003 (PECR) and UK GDPR. The DUAA has not changed the underlying rules for commercial organisations like law firms, but it has substantially increased the fines for getting them wrong.
In this article, our compliance teams, working alongside our marketing partners at FireTap Legal, look at where firms typically go wrong, what the rules actually require, and how to put it right.
What Has Changed Under DUAA, and What Has Not
Before looking at contact forms, it is worth being clear about what the DUAA did and did not change for law firms in this area.
What has not changed: The commercial “soft opt-in” exemption under PECR Regulation 22 remains the same. To rely on it, a firm must have:
- Collected the recipient’s contact details in the course of a sale, or negotiations for a sale, of goods or services
- Offered an opportunity to opt out at the point of collection
- Sent marketing only about its own similar services
- Provided an opt-out in every subsequent marketing message
What has changed: The maximum fine for breaches of PECR has risen from £500,000 to £17.5 million or 4% of global annual turnover, whichever is higher. The DUAA also introduced a new “charitable purposes soft opt-in” for charities, which does not apply to law firms.
The DUAA’s new “recognised legitimate interests” lawful basis under UK GDPR does not include direct marketing, so firms cannot use that route to send marketing without consent.
The position for law firms is therefore straightforward; if you want to use enquiry data for marketing, you generally need proper UK GDPR consent. The penalties for getting that consent wrong have risen significantly.
What Law Firms Need to Know About Online Enquiry Forms – The Soft Opt-In
This is where many firms misunderstand the rules. A general contact form enquiry, where a prospective client asks for service information or a quote, is not normally a sale or negotiations for a sale. The ICO has consistently taken a strict view on this; an enquiry is an information request, not a negotiation.
If a prospect has had a substantive consultation, received a fee estimate, and is in active discussions about instructing the firm, the soft opt-in could potentially apply, but only if an opt-out was offered at the point the details were originally captured. In practice, firms must be able to evidence the opt-out option was made available to the contacts sitting on their marketing list.
For most contact form enquiries, the firm needs consent. That brings us to where most contact forms fall short.
What Law Firms Need to Know – The Most Common Contact Form Failure
The wording we see most often on law firm contact forms looks something like this:
“By submitting your details, you agree that [Firm Name] may contact you regarding your enquiry and may also send you marketing communications about our services. You confirm that you have read and agree to our privacy policy.”
It looks reasonable. It is not.
Under UK GDPR Article 4(11), consent must be a “clear affirmative action.” Under Article 7, it must be specific, informed, freely given, and unambiguous. Recital 43 makes clear that consent is not freely given if the user has no genuine choice. The wording above fails on three counts:
1. Forced consent. Submitting the enquiry is conditional on agreeing to marketing. A prospective client cannot ask a question through the form without also “agreeing” to receive marketing. Under Article 7(4), that consent has not been freely given.
2. Bundled consent. Permission for the firm to respond to the enquiry, permission for marketing, and acceptance of the privacy policy are rolled into a single act. UK GDPR requires consent to be specific. Marketing consent must be capable of being given or withheld independently of everything else.
3. No affirmative action for marketing. Clicking submit is an affirmative action to send the enquiry. It is not an affirmative action to subscribe to marketing. Treating the same click as both has never been valid under UK GDPR, and the DUAA has not changed this.
A contact form built this way captures permission that is unlikely to stand up if challenged, and every marketing email subsequently sent on the back of it is a potential PECR breach.
What To Do Now
The first step is a straightforward website review, assessing your cookies, your consent banner, your tag manager configuration, and your privacy documentation against the new rules. Most organisations will need at least some updates. Many will have advertising tags currently firing without proper consent in place, which represents a live breach at the new penalty levels.
DUAA Website Compliance Audit
Regulation and Compliance Office and FireTap Legal have joined together to offer Firms a range of solutions which will provide you with:
- A new complaint policy for data related complaints
- A cookie policy review and a new cookie policy if required
- Guidance note for handling DSARs
| Service | What’s Included | Price |
| Core Website Package | • Updated data protection complaints policy • Cookie policy review and updated cookie policy • DSAR guidance note | £500 + VAT |
| Core Website Package + Training | Everything in the Core Website Package, plus a GDPR/DUAA training session (course preparation, delivery and detailed handout). In-person: £2,000 + VAT | Online: £1,800 + VAT | From £1,800 + VAT |
| Core Package + Training + Full Policy Suite | Everything in the Core Package and Training option, plus the complete GDPR and DUAA policy suite. | From £2,000 + VAT |
Find out more about our full range of services here: GDPR & Data Protection Audit, Compliance, and Training Services.
For firms wanting comprehensive, ongoing data protection compliance, not just a one-off fix, our Annual GDPR & Data Protection Compliance Service provides complete managed protection as an annual subscription.
| Annual Compliance Service — What’s Included | Annual Cost |
| ✔ Full set of GDPR & DUAA A policies, controls and procedures (PCP’s) — drafted and maintained for you | From £3,000 + VAT per annum |
| ✔ Internet and website policies included | |
| ✔ Annual GDPR audit with full written report | |
| ✔ Annual GDPR training for all staff | |
| ✔ Ongoing policy updates as legislation and regulation changes | |
| ✔ Compliance helpline — raise queries as they arise | |
| ✔ Regular regulatory briefings and newsletters |
Download the brochure for detailed information on this service: GDPR Data Protection Compliance Service.
Already on our SRA Compliance Essentials service?
GDPR policies are included as standard, so much of what is covered in these standalone policy packages is already taken care of for you. If you already have our website add-on package, our compliance team will be in touch to get these updated for you as part of that service.
For firms wanting to understand the full picture before deciding, the rest of this article sets out the remaining technical and regulatory detail.
What Law Firms Need to Know – Pre-Ticked Boxes and Opt-In Versus Opt-Out
The other common contact form failure is the pre-ticked marketing checkbox. Both the ICO and the Court of Justice of the European Union, in the Planet49 case, have confirmed that pre-ticked boxes do not constitute valid consent.
There is often confusion between “opt-in” and “opt-out” in this context. The two terms describe opposite models:
- Opt-in. The user is not subscribed unless they actively take a step, typically ticking a box, to say they want to be. Default position: unsubscribed.
- Opt-out. The user is automatically subscribed and has to take a step to unsubscribe. Default position: subscribed.
UK marketing law requires opt-in consent for electronic marketing to individuals. The “opt-out” part of the regime is a separate requirement that every marketing message must contain a working unsubscribe mechanism, regardless of how consent was originally captured.
A firm wanting to use contact form details for marketing therefore needs to provide a separate, unticked opt-in checkbox on the form, make sure the form can be submitted whether or not the box is ticked, and include a working unsubscribe link in every marketing email sent afterwards.
What Law Firms Need to Consider – The SRA Angle
For firms regulated by the Solicitors Regulation Authority (SRA), there is an additional layer of regulation alongside the data protection rules. The SRA Standards and Regulations require firms to act with integrity (Principle 5) and in a way that maintains the public’s trust in the profession (Principle 2). Capturing marketing consent through an opaque or coercive contact form is difficult to reconcile with either.
The SRA’s transparency requirements also extend to how firms collect and use client and prospective client information. A privacy policy that misdescribes how contact form data is used, or a contact form that captures permission for purposes the user is not clearly told about, creates regulatory exposure on top of the data protection breach. A complaint to the ICO about marketing practices that triggers an SRA enquiry is not a position any firm wants to be in.
For firms regulated by the Council for Licensed Conveyancers (CLC) or the Law Society of Scotland, parallel principles apply. The route to a regulatory referral is the same.
What To Do Now – The Compliant Position for a Contact Form
The compliant setup is straightforward and can be implemented quickly:
- The contact form collects only the details necessary to respond to the enquiry. Processing is on the basis of legitimate interests under Article 6(1)(f), or pre-contract handling under Article 6(1)(b) if instruction is being discussed.
- A short notice below the form explains what the details will be used for, and links to the privacy policy.
- A separate, unticked checkbox is provided specifically for marketing, with clear wording such as: “I would like to receive [Firm Name]’s legal updates, information on related services, and event invitations by email. I can unsubscribe at any time.”
- The submit button works regardless of whether the marketing box is ticked.
- Every marketing email sent afterwards contains a clear, one-click unsubscribe mechanism.
The privacy policy must distinguish between the two purposes (enquiry handling and marketing) and explain how to withdraw consent at any time. The withdrawal process must be as straightforward as giving consent in the first place.
What Law Firms Need to Know – Cleaning Up Existing Marketing Lists
This is the harder conversation, and one we have with most firms during their first DUAA audit.
If a firm has been capturing marketing “consent” through a non-compliant contact form for some time, the technically correct position is that the consent is not valid and the list is not lawful for marketing purposes. The pragmatic position is that firms can run a re-permissioning campaign, contacting existing subscribers and inviting them to opt in afresh through a compliant mechanism.
The ICO has accepted re-permissioning as a route to clean lists in the past, but it expects firms to stop relying on the invalid consents once identified and to take care with how the re-permissioning campaign itself is run. The campaign cannot become marketing in disguise, or it is the same breach repeated. Wording, frequency, and follow-up all need to be handled carefully.
What Law Firms Need to Consider
For firms regulated by the Solicitors Regulation Authority (SRA), there is an additional layer of regulation. The DUAA complaints handling obligation sits alongside, but is not identical to, the SRA’s existing complaints requirements. Both must be satisfied, and they must be consistent across your website. A privacy policy that describes one complaints process and a complaints page that describes another creates a regulatory inconsistency that neither the ICO nor the SRA would look favourably upon.
What Law Firms Need to Know – Complaints Procedures Under DUAA
It is recommended that firms implement a Complaint Policy accessible via their website, setting out how to complain about a data breach or data-related issue and setting out how the firm will handle and deal with the complaint.
It is important to cover key areas such as:
- Acknowledgement
- Time to deal and respond
- When and how to complain to the ICO
What Law Firms Need to Know – Training
The ICO recommends that training is provided annually to all staff as a sensible step to help control and minimise data breaches.
With the changes already underway, this is a perfect time to provide training for all staff.
Our training solutions will cover all the essential areas, including the updates, and provide a framework for dealing with data breaches and Data Subject Access Requests.
What Law Firms Need to Know – Policies, Controls, and Procedures
The ICO and the SRA expect firms to document its compliance with UK GDPR through a set of policies, controls, and procedures. Compliance with GDPR is not optional; it is essential, and failing to document your procedures and train staff can have consequences in terms of regulatory investigations and fines. To prevent this, a set of detailed policies, controls, and procedures is recommended. If you require these as a standalone option, the cost is £1,200 + VAT.
The Policies will include:
- A GDPR and DUAA Policy
- Data Retention Policy
- Bring Your Own Device Policy
- IT and Cybersecurity Policy
- Information Security Policy
- DSAR notices
- Data Notices
- Clients
- Employees
- Data Protection Impact Assessment Template
- Data Protection Privacy Notices
- Employees
- Recruitment
For RACO Member firms using our SRA Compliance Essentials services, we will be in touch to discuss any updates needed. If you are a firm that does not utilise our Risk and Compliance Services, you can find more information below.
Our Compliance Services
At the Regulation & Compliance Office, we can offer a number of outsourced support solutions, including:
- SRA Compliance Essentials – SRA Compliance Essentials gives you ongoing, specialist support to meet SRA Standards and Regulations and, where relevant, Anti-Money Laundering Regulations. It’s designed to give you peace of mind and free up time, while helping you evidence a robust compliance environment to the SRA and insurers.
- Regulation & Compliance Management – Risk & Compliance Management provides law firms with a dedicated external compliance function. It operates as an extension of your firm, delivering day-to-day regulatory guidance, register administration and structured reporting without the cost of a full in-house compliance department.
Find out more about our full range of Data Protection and GDPR services here: GDPR & Data Protection Audit, Compliance, and Training Services.
Contact Us
To ask any questions about the Regulation and Compliance Office and how we can
support your Law Firm, please call us on 0203 985 8550, complete the online enquiry form, or email us at info@regulationandcomplianceoffice.co.uk
