Make sure the forms you create using Formidable Forms follow the General Data Protection Regulation (GDPR) set by the European Union. It is important to prioritize personal information and privacy. By including GDPR elements in your forms, it will help you to properly manage user permission and enhance data security methods.

Subscribe on YouTube

Overview of GDPR

The General Data Protection Regulation (GDPR) was created by the European Union (EU) with the intention of protecting individuals' personal information. It went into effect on May 25, 2018 and imposes strict rules on how personal data must be handled, stored, and gathered.

• Consent requirement: Organizations must obtain clear, explicit consent from people before gathering or using their personal data.
• Data access and deletion: Individuals have the right to seek access to their personal data and, under particular conditions, to have their data deleted.
• Applicability: GDPR applies to all businesses that collect personal information from EU individuals, regardless of where the organization is located.
• Compliance: Organizations have to guarantee compliance with GDPR rules in order to save personal privacy rights and avoid penalties.

GDPR compliance settings

This guide outlines the steps to configure GDPR compliance settings in Formidable Forms. Implementing these settings will help ensure that your website's data collection practices align with GDPR regulations. These settings are included in Formidable Forms Lite.

1. Access Global settings. Go to Formidable → Global Settings → General Settings.
2. Enable GDPR features. Scroll down to the GDPR section and check the box for Enable GDPR related features and enhancements.
   

   

3. Additional GDPR options. Once the GDPR feature is enabled, these additional options appear:
   • Disable user tracking cookies. Enabling this option prevents user tracking with cookies. In the form's Settings → Form Permissions → Limit number of entries per setting, the Saved Cookie option can no longer be selected.
   • Do not store user IPs with form submissions. Enabling this option prevents the storage of user IP addresses with form submissions. It also disables the IP Address option in the same Limit number of entries per setting and hides the option for using custom headers when retrieving IPs.
   • Use custom headers when retrieving IPs. Only turn this on if IP addresses are incorrect in entries. Some server setups may require spoofable headers to determine an accurate IP address.

Custom headers

Select the box for Use custom headers when retrieving IPs with form submissions if all of your entries appear to use the same IP address. This setting is disabled by default to protect against IP spoofing but is required when using a reverse proxy.

The Custom Headers option allows you to configure how IP addresses are handled for entries that may appear to come from the same source. It is useful when using a reverse proxy, where multiple requests may show the same IP address.

Form GDPR settings

Each form also has its own GDPR settings. Use them to add a consent checkbox to the form and to delete old entries automatically.

1. Go to Formidable → Forms and edit your form.
2. Click the Settings tab (1) at the top of the form builder. Then click GDPR (2).
   

   

The tab also lists the global GDPR settings in effect for every form, with a link to change them.

Include a GDPR agreement field

Add a GDPR agreement field to the form without opening the form builder.

1. On the form's GDPR settings tab, check Include a GDPR agreement field. This box is already checked when the form has a GDPR field. A message confirms that the field will be added when you save.
   

   

2. Click Update to save your changes. The GDPR field is added to the form, just before the Submit button.

To remove the GDPR field, uncheck Include a GDPR agreement field and click Update.

Automatically delete entries

This setting is available on the Basic, Plus, Business, and Elite licenses.

Keep only the data you need. When this setting is on, entries older than the number of days you choose are deleted automatically.

1. On the form's GDPR settings tab, check Automatically delete entries after.
2. Enter the number of days to keep each entry. The default is 90 days.
   

   

3. Click Update to save your changes.

Once saved, entries older than this are deleted at Formidable's next hourly check. Each check deletes up to 200 entries across all forms, so a large backlog of old entries can take a few hours to clear. After that, entries are deleted soon after they reach that age.

Posts created from the deleted entries are moved to the trash. Uploaded files are deleted too when the File Upload field is set to delete files with the entry.

Entries are only deleted while Enable GDPR related features and enhancements is on in the global settings.

Create a GDPR compliant form

Create a form that complies with GDPR regulations by obtaining explicit user consent before collecting personal data. By adding a GDPR consent checkbox, you ensure that users actively agree to share their information.

1. Enable GDPR feature. Go to Formidable → Global Settings and verify that the GDPR feature is activated in the general settings. You can then use the form builder to add a GDPR field.
2. Create or edit a form. Open the form builder to create a new form or edit an existing one.
3. Add GDPR field. In the form builder, click the GDPR field in the Add Fields list to add it to your form. It's labeled GDPR Consent. A field added from the form's GDPR settings is labeled GDPR. You can also add it from the form's GDPR settings.
   

   

GDPR field features:

• Always required. The GDPR field must be filled out; it cannot be optional.
• No default check. The consent checkbox is unchecked by default, requiring users to actively check it.
• One checkbox. Each GDPR field is a single consent checkbox. Add only one GDPR field per form. Every GDPR field is required, so the form can't be submitted until each one is checked.