GDPR-Ready Form Builders That Keep Entries on Your Own Server
Every major form builder stores entries in your own database, so the answer to “which one keeps my data on my server” is: all of them. That is not the question worth asking. The question is where the data goes after it is stored, because a single form submission typically touches four or five external services before it reaches your inbox, and not one of them appears on a form plugin’s feature page.
The notification email crosses a mail provider. The spam check may send the submission to a third party for scoring. reCAPTCHA transmits visitor data to Google before anyone presses submit. Uploaded files may sit in cloud storage. This article maps that path hop by hop and names the plugin choices that shorten it.
Verified August 2026. Practical guidance, not legal advice.
Where a form submission actually goes
Trace a single enquiry on a typical WordPress install and the list is longer than anyone expects.
Before submission, the page may already have contacted Google if you use reCAPTCHA, which loads scripts and evaluates the visitor. That happens whether or not they ever submit, which is why it is a consent question rather than a processing one.
On submission, the entry is written to your database, which is the part everyone focuses on and the part that is genuinely fine. Then a spam service may receive the content for scoring. Then a notification email carrying every field value goes to your mail provider and sits in an inbox. Then any integration fires: CRM, email marketing, spreadsheet, webhook.
Afterwards, the entry sits in your database indefinitely unless somebody set a retention policy, and it is duplicated into every backup you take. On a site that has been collecting enquiries since 2021, that table is a substantial personal-data holding nobody has looked at.
The 6 options compared
1. Any self-hosted builder, configured deliberately
Fluent Forms from $63, Gravity Forms from $59, Formidable from $35.55, WPForms from $49.50, Forminator free. All store entries locally by default, so the builder is rarely the deciding factor.
What differs is how much leaves afterwards, and that is a settings question rather than a purchase. Switch the notification email to a bare alert without field values. Remove third-party CAPTCHA. Use a local spam method. Turn off integrations you are not actually using, which on most sites is at least one somebody enabled during a trial. Do that on any of these builders and the data genuinely stays put. The plugin choice then reduces to ordinary criteria, and Forminator being free while including conditional logic, uploads and payments makes it the obvious starting point for a privacy-led build.
- Entries stored: Your database, by default
- Price: Free to $63/yr
- Best for: Almost everyone; the work is in the settings
- Watch out for: Defaults send data outward until you change them
2. Replacing reCAPTCHA with Turnstile or a honeypot
The single largest privacy improvement available on a form, and it is free. reCAPTCHA loads Google scripts and evaluates visitors before they interact, which makes it a third-party processor operating on people who have not submitted anything.
Cloudflare Turnstile is free, largely invisible and explicitly not built to profile users for advertising, which is a materially different position even though it is still a third party. Better still for a low-profile site: your form plugin’s built-in honeypot and time-based checks, which involve nobody at all and stop the overwhelming majority of automated spam. Switch honeypot and minimum-submission-time on before adding any external service, and only escalate if spam actually gets through. This also removes the awkward loop where a consent banner blocks the CAPTCHA and the contact form becomes unusable until someone accepts tracking.
- Data leaving: None with a honeypot; minimal with Turnstile
- Price: Free either way
- Best for: Every form, as the first change to make
- Watch out for: Honeypots alone will not stop targeted spam
3. Local spam filtering instead of a cloud service
Cloud spam services score submissions by receiving them, which means the content of every enquiry, including whatever somebody typed into the message box, is transmitted to a third party for analysis.
Antispam Bee is the notable local alternative: built to European data protection expectations, it filters without sending submissions to an external service. On forms carrying anything sensitive, a medical enquiry, a legal question, a whistleblowing report, that architectural difference matters more than the filtering accuracy difference. On a general contact form the trade is genuinely arguable, because cloud services with millions of sites behind them catch human-written spam that local heuristics miss. Decide by content sensitivity rather than by spam volume.
- Data leaving: None with local filtering
- Price: Free
- Best for: Forms carrying confidential or sensitive content
- Watch out for: Weaker against human-written spam than cloud services
4. Self-hosted email delivery
The hop everyone forgets. A notification email containing every submitted field travels through your mail provider and lands in an inbox, which is usually the least controlled place the data will ever sit.
Two fixes, and the free one is better. Send a bare alert: “New enquiry received, view it in the dashboard”, with no field values at all. That removes the hop entirely, costs nothing, and has the useful side effect of keeping personal data out of an inbox that gets forwarded, archived and searched. If you genuinely need values in the email, at least control the transport: FluentSMTP is free and routes through a provider you choose, so you can pick an EU-hosted relay rather than whatever your host defaults to. Both approaches beat the default, which is unconfigured PHP mail carrying full submissions to a mailbox nobody thinks of as a data store.
- Data leaving: None if the alert carries no field values
- Price: Free; FluentSMTP is free including logging
- Best for: Every site, and the easiest win in this article
- Watch out for: Email logging plugins store the message body too
5. Automatic entry deletion and retention policies
The control that turns a growing liability into a bounded one, and the one almost nobody configures. Several builders can delete entries automatically after a set period; on the others it is a scheduled task or a manual habit.
Storage limitation is not an optional nicety under GDPR: personal data should not be kept longer than necessary for the purpose you collected it for. A contact enquiry from 2021 has no live purpose, and keeping it means it is in scope for every access request, every erasure request and every breach. Pick a period that matches the actual business need, ninety days for general enquiries is defensible on many sites, set it at build time, and write it into your privacy notice. Doing it later means auditing thousands of rows to work out which are still needed, which is why later never happens.
- Data leaving: Not applicable; this bounds what you hold
- Price: Free in most builders
- Best for: Every form, configured on day one
- Watch out for: Backups retain deleted entries until they age out
6. Not storing entries at all
The option that removes the problem rather than managing it, and it suits more sites than it gets used on. Most builders can be configured to email a submission without writing it to the database.
If enquiries are answered from an inbox and never revisited in the WordPress admin, the database copy serves no purpose and is pure exposure. Turning storage off means there is nothing to breach, nothing to include in a subject access request from the site, and nothing accumulating in backups. The obvious risk is that email is now your only copy, so a delivery failure loses the enquiry outright, which is exactly why this pairs badly with unconfigured mail and well with a properly configured SMTP plugin. The honest middle path most sites should take: store entries, set a short retention period, and send a bare notification, which gives you a safety net without an archive.
- Data leaving: Only via the email you send
- Price: Free, a setting in most builders
- Best for: Sites that answer from an inbox and never look back
- Watch out for: A failed email means the enquiry is gone permanently
Comparison table: where the data goes
| Component | Default behaviour | Third party involved | Better option | Cost |
|---|---|---|---|---|
| Entry storage | Your database | None | Add a retention period | Free |
| CAPTCHA | reCAPTCHA, fires pre-submit | Honeypot, or Turnstile | Free | |
| Spam filtering | Cloud scoring service | Yes, receives content | Antispam Bee, local | Free |
| Notification email | All field values | Mail provider | Bare alert, no values | Free |
| Email transport | Unconfigured PHP mail | Host default | FluentSMTP, chosen relay | Free |
| Integrations | Whatever is enabled | Each destination | Disable unused ones | Free |
The consent field, and what it is actually for
Most GDPR advice about forms ends at “add a consent checkbox”, which is both incomplete and frequently wrong. Consent is one lawful basis among several, and for a contact form it is usually not the right one.
- Answering an enquiry does not need consent. Somebody who fills in a contact form asking you to reply has requested a service. A checkbox saying “I consent to you replying to me” is theatre, and it implies you would otherwise have no basis to act.
- Marketing does need a basis, and consent is the usual one. The checkbox belongs on the newsletter opt-in, not on the enquiry itself, and it must be unticked by default and separate from submitting the form.
- Bundling them is the common error. “Submit this form and agree to receive marketing” is not freely given consent, because the person cannot get the first without the second.
- Record what they agreed to. If consent is your basis, you need to be able to show what wording was on screen when they ticked. Store the consent text version with the entry, not just a yes.
- Link the privacy notice from the form itself. Fair processing means telling people what happens to their data at the point you collect it, which is a link, not a paragraph of legalese in the form.
One last check worth running: submit your own form and then look at what actually happened. Open the entry, read the notification email, check your spam service’s dashboard, and see what appeared in any connected CRM. Most sites find at least one destination the owner had forgotten about, and that is the audit that makes everything above concrete.
Frequently asked questions
Which form plugin is the most GDPR-friendly?
They are broadly equivalent, because all major builders store entries locally. The difference is configuration: CAPTCHA choice, spam filtering, notification content and retention. A well-configured free plugin beats a badly configured expensive one.
Is reCAPTCHA a GDPR problem?
It is a third-party processor that transmits visitor data before submission, so it needs a basis and disclosure, and under a consent banner it should be blocked until accepted. Honeypots and Turnstile avoid most of that.
Do I need a consent checkbox on a contact form?
Usually not for replying to the enquiry itself. You do need one for marketing, unticked and separate from submission, and you need a privacy notice linked from the form.
How long can I keep form entries?
As long as you need them for the purpose you collected them for, and no longer. Ninety days is defensible for general enquiries on many sites. Set it deliberately and document it.
Do form entries count in a data subject access request?
Yes. They are personal data you hold, and they are one of the most commonly missed sources because they sit in a plugin’s own tables rather than in core user data. Include them in your response process.
Are uploaded files a separate problem?
Yes, and a bigger one. Check whether uploads land in a publicly guessable directory, because a CV or an ID document reachable by URL is a disclosure regardless of how well the entry itself is protected.
The verdict
The plugin is not the decision; the configuration is. Every major builder stores entries on your server, so choose on ordinary criteria and spend the effort on the four settings that actually move data off it.
Do these four things, all free. Replace reCAPTCHA with a honeypot or Turnstile. Strip field values from notification emails. Use local spam filtering on sensitive forms. Set a retention period today rather than auditing thousands of rows later.
If you want a specific recommendation: Forminator free, which includes conditional logic, uploads and payments at no cost, configured as above. Paying more does not buy you a better privacy position.
Then submit your own form and follow it. Read the notification, check the spam dashboard, look at any connected CRM. Almost every site discovers one destination nobody remembered enabling, and that is the finding this whole exercise exists to produce.
