Enquiry and Intake Forms: Short, Secure and Clear About Privacy

What the form should collect

A first enquiry needs enough to reply and to check for conflicts, and no more. For most firms that is:

• Name
• Email address, phone number, or both
• The other party's name, where a conflict check needs it
• The kind of matter, chosen from a short list
• A short description, with a prompt asking people to leave out confidential details until the firm has confirmed it can act
• How they prefer to be contacted

Every extra field lowers the number of people who finish the form, and each one is more personal information the firm then holds. Dates of birth, addresses and detailed accounts of what happened can wait for the first appointment.

Why the prompt about confidential details matters

Your duty of confidentiality under Rule 9 of the Australian Solicitors' Conduct Rules applies to information confidential to a client acquired during the engagement ^[1]. Before the firm has accepted a matter, the person filling in the form may not yet be a client, and the firm may turn out to act for the other side. Asking for a brief description first, and the full story after a conflict check, protects both the enquirer and the firm. The prompt on our forms says this in plain words.

The collection notice

Australian Privacy Principle 5 sets out when an entity that collects personal information must tell the person about certain matters ^[2]. Whether the Privacy Act covers your firm depends partly on turnover: the OAIC explains that a small business is one with an annual turnover of $3 million or less, and lists businesses that are covered regardless of turnover, such as health service providers and businesses that trade in personal information ^[3]. Many firms decide to follow the Australian Privacy Principles anyway, because clients expect it.

A short notice beside the form covers who is collecting the details, why, who they may be shared with (for example, an email provider), and where the full privacy policy is. Our privacy and enquiry forms guide explains what to include.

Security

• HTTPS on every page, so details are encrypted in transit
• Messages sent through authenticated email, not plain server mail, which is more likely to be filtered as spam
• No copies of enquiries stored on the web server unless the firm asks for a secure archive
• A hidden spam trap, a timing check and rate limits instead of puzzles that block people using screen readers
• Protection against forged submissions from other sites

APP 11 requires an entity to take reasonable steps to protect personal information from misuse, interference and loss, and from unauthorised access, modification or disclosure ^[2]. A form that leaks messages into an unsecured inbox or a shared spreadsheet undermines that.

Accessible forms

Every field has a visible label, error messages say what to fix and sit next to the field, and the form works with a keyboard and screen reader. Required fields are marked in text, not only by colour. These are WCAG 2.2 Level AA requirements ^[4] and they also make the form easier for everyone.

Routing

Enquiries can go to one inbox, or to different people by matter type: family law enquiries to the family team, property enquiries to conveyancing. Each enquirer receives a confirmation that the message arrived and what to expect next, without repeating their message back in an email that could be read by someone else.

Booking tools and intake software

If your firm uses practice management or booking software with its own intake forms, we can embed or link to it. We check what personal information the tool collects, where it stores it and whether its scripts set tracking cookies, and we reflect that in your privacy policy.