GDPR and your contact form: what healthcare needs on top

Why your contact form receives health data

A physiotherapy practice adds a form with name, email and "your question". Within a week someone writes: "My knee has hurt since I fell; can I come without a referral?" That is health data arriving through your website. Home care, mental health and dental practices see the same, often about a relative.

Health data is special-category data under Article 9 GDPR: processing is prohibited unless an exception applies. In the Netherlands, Article 30 of the GDPR Implementation Act (UAVG) provides such an exception for care providers, for proper treatment or care. That does not remove the other duties: only what is necessary, properly secured, not kept longer than needed.

What the GDPR asks of a care website

• Data minimisation: for a call-back request, a name, phone number or email and a short description are enough.
• A processor agreement (Article 28) with every party processing data for you: hosting, form service, email, chat or AI vendor.
• Appropriate security (Article 32): encrypted connections, limited access to submissions, no unnecessary copies in the website database.
• A privacy notice that covers the website itself: forms, vendors, retention and cookies.

Cookies are part of this. Under Article 11.7a of the Dutch Telecommunications Act you need consent to store or read cookies, except for what is strictly necessary and for measurement with little or no privacy impact.

Security: NEN 7510 and secure email

The Dutch decree on electronic data processing by care providers (Besluit elektronische gegevensverwerking door zorgaanbieders) requires providers to use their care information system (the electronic client record) and exchange systems securely in line with NEN 7510 and NEN 7512, with logging under NEN 7513. An ordinary website is not automatically covered, but if medical information arrives through your form and ends up in the record, NEN 7510 is the benchmark a regulator will look at. Article 32 GDPR applies either way. NTA 7516 covers secure email in Dutch healthcare; NEN says it is not (yet) mandatory. Whether a website form falls under it is not settled. Do not assume a form that sends plain-text submissions to an ordinary mailbox is secure enough for medical content.

How to set up your form

• Separate practical questions (opening hours, coverage, call-back) from clinical intake, which belongs in your EHR’s client portal or secure email.
• Tell people in the form what not to include: "Please do not enter medical details, diagnoses or your BSN here."
• Limit the free-text field and call it "short question".
• Switch off storage of submissions in the website, or set a short retention period.

Home care and day care receive many requests from relatives; see our pages on a home-care website and a day-care website. For mental-health practices, where even a registration is sensitive, see websites for ggz.

When do you need a DPIA?

A DPIA is required when processing is likely to result in high risk, including large-scale processing of health data (Article 35 GDPR). Recital 91 says processing by an individual physician or other health professional is not large-scale, and the Dutch Data Protection Authority’s list of mandatory DPIAs repeats that exception. A solo practice with a simple contact form usually needs no mandatory DPIA; for a group practice it is less certain, and a larger care organisation with online intake or an AI assistant on health questions should assess and document it.

Common mistakes

• A large open "Reason for referral" field without guidance.
• Upload fields for referral letters that end up in a normal mailbox or the website’s media library.
• A free form or chat service without a processor agreement, storing data outside the EU.
• Submissions left in the website database for years.
• Advertising or statistics cookies loading before the visitor has chosen.

All points from these guides are on the printable healthcare website checklist.

This guide describes Dutch rules as we read them on 28 October 2026. It is general information, not legal advice. Rules and regulator guidance change; check the sources, and ask your trade association or a lawyer when your situation is specific.