I am building an online registration form for a voluntary organisation in the UK and am considering data security measures.
The form will be served up over https and there may be an optional payment fee involved. We are using Stripe.js to handle PCI compliance so we never see credit card details.
One thing I would like to do from an end user point of view is to provide a copy of the submitted application form to the user for their own records. However, with email being an inherently insecure protocol, I am wondering if I should be doing this even though it is common place.
The form itself will take basic personal details, name, email ,address and date of birth details as well as some checkboxes where they agree to conditions of membership. This is a one time submission to the user so we will not be asking for or storing a user name or password.
Is it 'appropriate', considering data protection principle 7 to send the complete submission details (minus credit card details obviously) back to the user, in a formatted PDF file by email?