In plain English
Ask only for information needed to route and answer the enquiry: usually a name, a reliable contact method, the relevant service, useful context and any necessary location. Explain why information is collected, avoid sensitive details unless truly required, label every field clearly, show usable errors and confirm what will happen after submission.
Which fields does a first enquiry actually need?
Start with the operational decision: who must reply, by which channel and with what minimum context. A common first-contact set is name, email or phone, service of interest, message and location only when serviceability depends on it. Make company name, budget, deadline or referral source optional unless the business can explain why each is necessary at this stage. For high-risk or regulated services, move detailed information to a secure, purpose-built process after the initial contact has been assessed.
South Africa's POPIA includes a minimality condition: personal information should be adequate, relevant and not excessive for its purpose. That is a useful design check, not a substitute for legal assessment. W3C's forms guidance likewise recommends asking only for what is required to complete the process. Remove fields collected merely because the software template provides them.
Sources for this section: Protection of Personal Information Act 4 of 2013, Forms Tutorial.
How should required, optional and formatted inputs be presented?
Give every control a persistent label that describes its purpose. Mark required fields consistently in text, identify optional fields when that list is shorter and put format instructions beside the relevant input before an error occurs. Use appropriate input types and autocomplete tokens where suitable, but do not rely on placeholder text as the only label or instruction.
Group related choices and make the available options understandable without their visual position. W3C recommends explicit associations between labels and controls because they support assistive technology and enlarge the clickable area. Test zoom, keyboard order, screen-reader names, mobile keyboards and touch targets. A short form can still be inaccessible when its labels disappear or its custom controls cannot be operated. Make examples realistic for South African phone, address or currency formats without forcing one format when alternatives are valid.
Sources for this section: Labeling Controls.
What privacy explanation and consent choices belong near the form?
Tell the person who is collecting the information, the purpose, whether requested details are required, and where they can find the fuller privacy information and contact route. Record an approved retention and access process behind the page. POPIA contains notification, purpose, retention and security conditions, but the correct implementation depends on the organisation and should be reviewed by an appropriate adviser.
Keep an enquiry response separate from unrelated marketing. Do not treat submitting a service question as blanket permission for future promotional messages. If the business offers a genuinely optional marketing choice, make it specific, unbundled and recorded, with an accessible way to object or stop. The Information Regulator's direct-marketing guidance is the primary reference for assessing that workflow in South Africa. Avoid preselected permission boxes and store the notice version shown when any optional choice was made.
Sources for this section: Protection of Personal Information Act 4 of 2013, Guidance Note on Direct Marketing under POPIA.
What should happen when submission succeeds or fails?
Validate entries without erasing the person's work. Identify the specific field, explain the problem in plain language and describe how to fix it; a red border alone is not enough. W3C's notification guidance recommends understandable feedback connected to the relevant control. Preserve the form when a network or server error occurs and provide a safe alternative contact route.
After success, confirm receipt without implying acceptance, price or booking unless those facts are known. State the expected next step and response coverage, then create a record, notify the correct owner and handle duplicates safely. Test spam controls, delivery failures, restricted access, retention and manual recovery. Never ask a prospect to place passwords, identity documents, payment data or sensitive case details in a general message box. Monitor failures without placing the submitted message or personal details into broadly accessible logs.
Sources for this section: User Notification, Protection of Personal Information Act 4 of 2013.
Official references
- Protection of Personal Information Act 4 of 2013 (Information Regulator South Africa)
- Forms Tutorial (W3C Web Accessibility Initiative)
- Labeling Controls (W3C Web Accessibility Initiative)
- Guidance Note on Direct Marketing under POPIA (Information Regulator South Africa)
- User Notification (W3C Web Accessibility Initiative)