Define what the first message is for

Decide whether the form requests a callback, asks a general question, or begins a structured intake process. Ask only for information needed at that stage. An unrestricted invitation to describe every fact can encourage unnecessary disclosure. The FTC’s security guidance recommends limiting collection to information with a legitimate need. Review proposed fields with the people responsible for intake and professional obligations.

Explain the limits before submission

Place clear, appropriately reviewed information where visitors encounter the form. Describe the purpose of the enquiry and avoid implying that a message automatically establishes representation. ABA Model Rule 1.18 addresses duties concerning prospective clients; an organisation should not assume that generic disclaimer text eliminates every duty. The responsible lawyer should assess the process and notices under the rules that apply to the firm.

Map where information travels

Document the form provider, receiving system, staff access, notifications, and any stored copies. Check retention and deletion arrangements with the relevant advisers. Avoid placing message contents in ordinary analytics events or unnecessary notifications. A secure-looking page is not evidence that every later handling step is appropriate. Review vendors and access permissions as part of the process rather than relying solely on the appearance of the form.

Design understandable outcomes

Use clear labels, distinguish required fields, and provide specific guidance when something needs correction. Show a success message only after the receiving system has actually accepted the submission. Explain what happens next without promising an unavailable response time. Include an appropriate alternative contact route for people who cannot complete the form, and make sure staff understand how enquiries arriving by different routes are handled.

Test the handoff with fictional details

Use invented test information to verify delivery, routing, duplicate handling, errors, and the confirmation shown to the visitor. Check what happens when the receiving service is unavailable. Assign someone to notice delivery failures and maintain the configuration when staff or providers change. A form that once worked can fail quietly later, so the operational owner needs a practical way to recognise that problem.

From reading to doing

Put it into practice

  • Define the purpose of the first enquiry.
  • Remove unnecessary sensitive fields.
  • Review notices and information handling.
  • Test receipt, failure, and staff ownership.

Reference points: FTC, “Start with Security: A Guide for Business”; ABA Model Rule 1.18, “Duties to Prospective Client.” Local professional and privacy requirements require separate assessment. Reviewed September 30, 2026.

General editorial guidance. Assess technical and professional requirements for the actual website, audience, and jurisdiction.