Which enquiry form fields are useful without collecting unnecessary documents?

Define the first decision the form needs to support

Start with what the business will do after receiving the form. It may need to route the enquiry, contact the person or decide which service is relevant. Those purposes do not automatically require the full set of documents needed for a later engagement.

Write a short internal purpose statement and use it to review every field. Ask how the answer changes the first response. If the team cannot explain why a field is needed at that stage, consider removing it or requesting the information later.

The Protection of Personal Information Act includes a minimality principle: information must be adequate, relevant and not excessive for its purpose. The field suggestions below are practical design choices to apply to the actual service, not a statutory form template.

Choose a small set of useful initial fields

Do not make a field mandatory merely because it may be useful someday. A person exploring company formation may not yet have a registration number. A form that requires one can prevent the very enquiry the business wants to receive.

Use clear labels and a response route that the team actually supports.

Move detailed document collection to the appropriate stage

An initial enquiry is different from an accepted engagement, verification process or application. Detailed records may become necessary later, after the business has explained the service, confirmed the purpose and identified the authorised people involved.

For a tax or company service, avoid requesting identity documents, tax returns or bank statements through a general contact form by default. First establish what help is needed. Then request the specific records through an appropriate process with clear instructions and access controls.

Staging the collection also improves service quality. Staff can ask for the relevant period and document type instead of receiving a large unsorted archive. It reduces unnecessary exposure while making the later request more precise and easier for the customer to complete.

Keep the message field useful without inviting oversharing

Ask for a short description of the problem or service required. Avoid prompts such as upload everything or provide all personal details. Where relevant, tell visitors not to include passwords, one-time codes or confidential documents in the initial message.

Set a reasonable message limit that still allows the person to explain the issue. Do not rely on a limit alone to prevent sensitive information from being submitted. Staff need a process for handling unexpected private material and moving the conversation to the appropriate channel.

If attachments are unnecessary for initial triage, leave them out. Where an attachment is genuinely needed, define accepted types, access, storage and handling before enabling uploads. A file-picker control does not by itself provide a secure document-management process.

Use an appropriate basis and explain the purpose

POPIA provides several possible grounds for lawful processing; consent is not the only one. The business should identify the appropriate basis for its actual enquiry handling and meet the other applicable conditions. A required tick box does not make excessive collection or unsuitable handling acceptable.

Provide understandable privacy information about the collection and the business responsible for it. The notice should reflect the actual recipients, purposes and practices. Do not promise that information is never shared if a service provider processes the form or email on the business's behalf.

Keep the first-contact experience proportionate. The visitor needs the relevant information to understand the request, while detailed policies can be available through a clear link. The business should review the wording and operation together instead of treating the notice as decoration.

Separate responding to the enquiry from future marketing

A person asking about a service expects a response to that request. Do not automatically treat the enquiry as permission for unrelated promotional campaigns. Decide whether the business needs a separate optional marketing choice and implement it accurately.

Section 69 of POPIA addresses unsolicited electronic direct marketing, including consent and a qualified existing-customer route. Apply the actual conditions rather than assuming every contact-form submission creates the required relationship or permission.

If an optional choice is offered, keep it distinct from the ability to submit the enquiry. Record what the person selected and ensure the receiving system respects it. A front-end checkbox that is ignored when contacts are added to a mailing list does not provide a meaningful choice.

Limit access to the people handling the request

Identify who needs to see the enquiry and why. Route it to the appropriate team rather than copying every staff member. Review access to the mailbox, customer system and website administration where the information is stored.

Consider the full path of the data. A form may send email, save a database record, trigger an automation and appear in logs. The business needs to understand those destinations before making privacy promises or deciding how long the information is retained.

Use suitable security arrangements for the systems and authorised users. Do not send personal login credentials to colleagues as a routine way to share enquiries. Access should be appropriate to the role, reviewable when staff change and supported by a process for addressing suspected misuse or accidental disclosure.

Decide what happens after the enquiry is resolved

Define how long enquiry records are needed for the actual purpose and any applicable obligations. An unconverted initial request may have a different retention basis from records supporting an ongoing client engagement. Avoid keeping every attachment indefinitely simply because storage is available.

Assign responsibility for deletion, restriction or transfer into the proper client record where appropriate. The process should cover relevant systems, not only the visible inbox. If a record must be retained for a particular reason, document that reason and review access.

Provide a practical route for requests about personal information and handle them under the applicable rules. Do not promise immediate deletion of every record regardless of legal requirements or unresolved matters. The published explanation should match what the business can lawfully and operationally do.

Test the form and the staff workflow together

Use controlled test details to check required fields, validation, submission and delivery. Confirm that the intended recipient receives enough context to respond and that the acknowledgement does not repeat unnecessary sensitive content.

Verify that an email address or phone number is treated as contact information, not automatic proof of identity or authority. A visitor should not gain access to private company or tax records simply by entering a matching identifier. Any later verification process needs its own appropriate controls.

Check errors and mobile use. A failed submission should tell the visitor what to correct without losing their work unnecessarily. A successful message should describe the actual outcome, such as receipt of an enquiry, rather than implying that a registration, application or service engagement has been approved.

Review fields when the service or process changes

After the form is in use, ask the receiving team which fields support the response and which create unnecessary work or information. Review actual needs before adding more mandatory questions. A request for one difficult case should not automatically become a requirement for every visitor.

Website-design support can help align the form with the real enquiry process. The business should approve the purpose, access and information-handling arrangements, with appropriate advice where needed.

A useful initial form makes contact possible, gives staff enough context and leaves detailed evidence collection for the right stage. Its quality depends on the complete handling process as well as the fields a visitor sees.