Inbound Capture
Part of Lead generation data hygiene
Keeping personal data collection proportionate
Review why each enquiry detail is collected, handle unsolicited information and limit access and retention under applicable Australian privacy rules.
Keep personal data collection proportionate: ask what the response offered now needs, then collect further detail when a later task requires it. Review form fields, free-text prompts, attachments and background tracking together. A short visible form can still gather excess information elsewhere in the journey.
Give each field a purpose
For every proposed field, identify who uses it and which first decision it changes. A reply address may be needed for an email enquiry. A phone number may be needed when someone requests a call, but need not be compulsory for an email reply. A broad location may establish whether a visit is possible; an exact address can wait until a visit is arranged.
Ask now when / Defer or remove when
- The answer identifies, routes or helps answer the present request
- It is wanted only for possible future segmentation
- A service boundary cannot be assessed without it
- A less precise answer would settle the boundary
- The person requests a task requiring the detail
- A later conversation is the first point where it matters
These questions guide a field review; they do not prescribe a universal form. A required field deserves a clear purpose beyond the fact that the CRM has space for it.
For organisations covered by the Australian Privacy Principles, APP 3 permits an organisation to collect solicited non-sensitive personal information only when reasonably necessary for its functions or activities. The OAIC's guidance treats proportionality as implicit in the APP 3 requirements and requires entities to take a data minimisation approach. Sensitive information has additional conditions. Coverage and the permissibility of a particular field depend on the circumstances.
Handle information supplied beyond the request
A free-text box or attachment can contain more personal information than the form asks for. Explain what helps the first reply and discourage confidential documents through a general enquiry route. Offer another suitable route if more material becomes necessary.
The OAIC says information supplied beyond what an APP entity requested should generally be treated as unsolicited. Under APP 4, a covered entity must assess within a reasonable period whether it could have collected that information under APP 3.
If it could not, destruction or de-identification is required as soon as practicable, unless an APP 4 exception applies. Storing every attachment with a sales lead is therefore a poor default.
Explain collection where it happens
Say how the details will be used and what response follows. Keep form wording consistent with the confirmation and actual handover. APP 5 requires covered entities to take reasonable steps to notify people of specified collection matters or ensure awareness, at or before collection when practicable. A brief explanation beside a form may need a fuller notice for other relevant matters.
An enquiry request does not by itself establish permission for unrelated future marketing. Keep any separate marketing choice and its record distinct from the request for a reply.
Limit access and retention
Let responders see the detail needed for their work; use less detailed reporting views where possible. Review old messages, attachments and copies against their current purpose.
APP 11 requires covered entities to take reasonable security steps and, subject to its exceptions, reasonable steps to destroy or de-identify personal information no longer needed for a permitted purpose. There is no universal retention period for every enquiry.
If Google Analytics is used, do not send names, email addresses or unfiltered form text to it. Page URLs and campaign parameters can carry personal information as well, so check what the form and confirmation journey actually pass to Analytics.
Revisit the field list when the service or response process changes. Each collected detail should still have an explainable job.
Key Australian Privacy Principle (APP) requirements
- APP 3: Collection necessityOnly collect personal information that is reasonably necessary for functions or activities
- APP 4: Unsolicited informationAssess within reasonable time whether information could have been collected under APP 3
- APP 5: Notification at collectionProvide clear notice about collection, use and disclosure at or before collection
- APP 11: Security and destructionTake reasonable steps to protect data and destroy or de-identify when no longer needed
