Most Hong Kong SME owners can tell you exactly how many enquiries came in last month. Very few can tell you what those enquiries actually collected. A contact form feels like a simple tool — a name, an email, a message — but by the time it has been through a plugin, a CRM, a notification email and a backup, the same customer record may exist in five places, three of which nobody is watching.
This is not a scare piece about hackers. It is an inventory exercise. If you cannot list where a single customer's details live, you cannot protect them, delete them on request, or notice when they turn up somewhere they should not.
Why the form is the weak point
Your website's public pages are, by design, open to anyone. The form is the one place where an outsider can push data into your systems. That makes it both the most valuable page on the site and the most exposed.
Three things tend to go wrong for small teams:
- Over-collection. Fields get added over the years — company size, budget range, ID number for a booking — and nobody removes them.
- Silent forwarding. The form sends entries to a shared inbox, a free CRM, a spreadsheet, and a notification group chat. Each copy has its own retention rules, usually none.
- No exit. There is no routine for deleting old enquiries, so the archive grows indefinitely.
None of these require a malicious actor to become a problem. A shared inbox on a departed employee's account, or a spreadsheet link forwarded one time too many, is enough.
Step 1: List every field and justify it
Open your live form and write down every field, including hidden ones. For each, ask a single question: do we need this to answer the enquiry?
Phone number, email, name and message are almost always justified. Date of birth, HKID, full address, budget and job title usually are not — at least not at first contact. If a field exists because someone once thought it might be useful, remove it. You can always ask later, once there is a reason.
Check the hidden fields too. Many form plugins record IP addresses, browser details and referral sources by default. That data has legitimate uses for spam filtering, but you should know it is being stored.
Step 2: Follow the data, not the form
Submit a test enquiry with a distinctive name, then track where it appears. Check:
- The notification email — and who is on the recipient list.
- Any CRM or helpdesk tool the form feeds.
- Spreadsheets, including ones on personal drives.
- Chat groups or messaging apps used for alerts.
- Your website backup, which will contain the database entry.
Draw this as a simple map. Most owners find at least one destination they had forgotten about. If a tool you no longer use is still receiving entries, that is your first fix.
Step 3: Decide who can see what
Access should follow a simple rule: if a person does not need the data to do their job, they should not be able to open it. In practice that means:
- Remove former staff from shared inboxes and CRM seats the week they leave, not the month after.
- Use individual logins rather than one shared password for the enquiries inbox.
- Turn on two-factor authentication wherever it is offered — email, CRM, hosting panel.
- Keep the spreadsheet out of personal cloud drives.
If you are unsure whether your current setup meets this bar, it is worth a short conversation with whoever maintains your site. Our team can review the setup as part of a practical security review rather than a theoretical audit.
Step 4: Set a retention clock
Customer data that is never deleted is a liability that grows quietly. Pick a period that matches your sales cycle — for many SMEs, 12 to 24 months after the last contact is reasonable — and write it down.
Then make it real: a calendar reminder each quarter to export anything still needed and clear the rest. This applies to the CRM, the inbox, the spreadsheet and the old form entries sitting in your database.
If you cannot say when a record will be deleted, you have not decided how long you are responsible for it.
Step 5: Write the two paragraphs customers never see
Under Hong Kong's Personal Data (Privacy) Ordinance, customers are entitled to know what you collect and why. A short paragraph under the form, plus a linked privacy page, covers most of it: purpose, who it is shared with, how long it is kept, and how to ask for a copy or deletion.
Keep it readable. A customer who understands what happens to their details is also a customer who is less likely to be fooled by a scam email claiming to be you.
Summary
The form is where customer data enters your business, and it is usually the least examined part of the website. Run the five steps — justify every field, map every destination, restrict access, set a deletion clock, and publish a plain-language notice. None of it requires new software, and all of it reduces the chance that a routine enquiry becomes an incident. If you want the setup checked properly, start with a clear scope and price before anyone touches the site.