What should an accounting firm contact form ask?

Someone looking for a bookkeeper reaches your website and finds a contact form. It asks for a name and email, then a business number, annual revenue, last year’s return, and a file upload. They only wanted to find out whether you take on new clients. How much information does your practice need before it can answer that question?

For an initial inquiry, ask for enough to route the message and reply, then move sensitive details into your established onboarding process when they are actually needed. A short form could ask for a name, a way to reply, the service of interest, and a brief description of the question. The precise fields depend on your practice. A tax specialist with a defined intake process may need different routing information from a bookkeeper who offers discovery calls. The point is to decide what each field does before making it required.

Privacy is a practical reason to make that choice deliberately. In the Office of the Privacy Commissioner of Canada’s 2024–25 public opinion research, Figure 18, 78% of respondents for whom the question applied said they had refused to give an organization or business personal information because of privacy concerns. The national telephone survey included 1,500 residents aged 16 and older and was conducted in early 2025; the report does not give the exact base for this question. The finding describes self-reported behaviour across organizations, not abandonment of accounting contact forms or the effect of shortening one. It cannot predict how your visitors will respond.

Give the form one job

Write the purpose of the form in a sentence: “Help us decide who should reply to this prospective client and how.” That sentence is a useful test for every proposed field. If a question does not help your team make that first decision, consider asking it after you have established a suitable and secure next step.

For example, a practice that offers bookkeeping, business tax, and personal tax services could use a plain service choice. If the team works only with certain business types or locations, ask for the minimum detail that helps identify a fit. Avoid asking for a precise revenue figure or copies of financial records merely to sort a general inquiry. If a phone number is genuinely optional, label it optional; do not require both phone and email when either would let you reply.

This is a recommendation for designing an inquiry, not a universal field list. The federal privacy commissioner’s guidance on limiting collection says organizations should collect only the personal information needed for an identified, legitimate purpose. For Quebec private-sector businesses, the Commission d’accès à l’information’s collection guidance likewise says to determine the purpose before collection and limit it to necessary information. Which privacy rules apply to your practice and its clients deserves a jurisdiction-specific review.

Tell visitors what belongs in the message

A free-text box is useful because real inquiries rarely fit a menu perfectly. It also invites people to paste far more than you need. Put a short instruction next to it: “Briefly tell us what help you are looking for. Please do not include tax returns, account numbers, passwords, or client records here.” If your practice has a separate secure document process, say that you will explain it when appropriate. Do not imply that an ordinary contact form is a secure client portal.

Make the instruction specific to the way the form actually works. If the submission arrives as an email notification, check what the notification includes and who receives it. If it enters a third-party form tool, find out where the original message is stored, who can access it, and how long it remains there. Turning off a file-upload button does not settle the whole privacy question when the message itself can contain sensitive details.

Place a short purpose statement near the submit button: what the practice will use the information for and how the visitor should expect a reply. Link to an accurate privacy policy that describes the actual tools and handling practices. The Quebec commission’s guidance for private businesses explains the information to provide when collecting personal information and the policy requirement for collection through technology. Have the person responsible for privacy review the final wording and data flow; copying a generic notice does not make it accurate.

Check the form as a visitor would

Fill it out on a phone and with a keyboard. Can you tell which fields are required before pressing submit? Does each field have a visible label? If you leave something out, does the error say what to fix without erasing the rest of the message? After submitting, can you tell whether it worked and what happens next? The W3C forms tutorial recommends clear labels, instructions, validation, and success or error feedback. These checks are useful even if your form came from a website builder or booking provider.

Test the reply path too. Send a harmless test inquiry, confirm it reaches the right people, and read the automatic response. If the form is meant for new clients, a confirmation should not accidentally promise that the practice has accepted the work. If you serve people in English and French, make sure the form instructions, errors, confirmation, and reply path make sense in each language offered. A translated heading alone does not complete the inquiry journey.

Review what happens after submission

The form is only the collection point. Map the path from submit button to form provider, notification inbox, customer relationship system, staff member, and deletion or retention process. Remove recipients who do not need the messages. Decide who monitors the inbox when someone is away. Check whether test messages, spam, and unanswered inquiries are being kept indefinitely.

The privacy commissioner’s breach-prevention guidance for businesses recommends limiting staff access, setting clear expectations with service providers, and disposing of personal information that no longer serves a business need. Your practice should set retention and access rules with its own legal and professional obligations in mind. A site designer can implement the agreed routing and controls, but the practice must decide what it is authorized and equipped to collect.

A small example to adapt

Imagine a bookkeeping practice whose first task is to decide whether a prospective client’s question fits its services. Its form asks for a name, an email address, a service choice, and a short message. Near the message box it asks visitors to leave financial documents out. The confirmation explains when and how the team normally replies, using only a timing statement the team can actually meet. If the inquiry is a fit, a staff member sends the next steps through the practice’s approved channel.

That design is an illustrative workflow, not a measured conversion result or a template for every firm. If your team cannot decide fit without another detail, add that field and explain why it is needed. If you need documents before taking on a client, plan a separate, reviewed intake process. Do not stretch the public contact form into a makeshift records system.

An effective review combines content, design, and operations: decide what the first conversation needs, write understandable instructions, verify the form on real devices, and trace every copy of the submission. A developer can help with the form and routing; a privacy or legal adviser can assess the obligations that apply to your practice. If you are planning a new accounting website, see how Red Comet approaches websites for accountants and bookkeepers.

Sources

• Office of the Privacy Commissioner of Canada, 2024–25 Public Opinion Research on Privacy Issues, Figure 18 and methodology
• Office of the Privacy Commissioner of Canada, PIPEDA Fair Information Principle 4 — Limiting Collection
• Commission d’accès à l’information du Québec, Collecte de renseignements personnels
• World Wide Web Consortium, Forms Tutorial
• Office of the Privacy Commissioner of Canada, Prevent a privacy breach at your business