GDPR in lead quizzes: what you can ask, and what you cannot

A lead quiz collects personal data, so it sits squarely inside GDPR. The good news is that the rules which affect daily practice are few and reasonably clear. One caveat up front: this is a practical guide based on the regulation's own text, not legal advice — for your specific situation, talk to a professional.

Consent, as the regulation actually defines it

For consumer-facing lead generation, consent is the usual basis, and GDPR requires it to be freely given, specific, informed and unambiguous. In practice that rules out three very common patterns:

• Pre-ticked boxes — invalid, because the user must take an affirmative action.
• Consent bundled into acceptance of terms — it has to be separable.
• Vague wording like «I agree to receive communications» — you must say who processes the data and for what.

Minimisation: every extra field is exposure

The minimisation principle requires collecting only what the stated purpose needs. If a name and a phone number are enough to call a customer back, also asking for address, email and date of birth «just in case» is not diligence, it is added liability with no upside.

Here GDPR and conversion pull the same way. A shorter form converts better and leaves you less data to protect.

Special categories: the most overlooked part

Article 9 prohibits processing certain categories — health data among them — unless a specific condition is met, and the usual route is explicit consent, a higher bar than ordinary consent. And «health data» is broader than people assume: any information about a person's physical or mental health, past, present or future.

The practical consequence for clinics and health services: the quiz should not ask for medical history or diagnoses. You can qualify perfectly well on interest in a treatment, urgency, timeline and budget, leaving clinical detail for the consultation. Article 9 penalties sit in the regulation's upper tier, so this is not a minor nuance.

What you need in place

• A privacy notice reachable from the quiz itself, not buried in a website footer.
• A declared purpose you then respect: if you collected data to quote a job, do not repurpose it for a newsletter without fresh consent.
• A defined retention period, and deletion that actually happens when it expires.
• A simple route for access and erasure requests, answered within the statutory window.
• Processors identified: the tool you build the quiz with processes data on your behalf, so you need the corresponding agreement and you need to know where the data is hosted.

Quizanta hosts data in the EU, and the templates are written to qualify on intent rather than on sensitive information. The rest — your privacy notice, your retention periods, your legal basis — remains your business's responsibility, and is worth one proper review with a professional.