DPDP consent for website forms
Contact, demo, newsletter and sign-up forms set up with a clear notice, an unticked consent box, a visible privacy policy link and consent recorded with every submission.
- Part of Implementation, from ₹39,999
- No CRM access needed
Written by Shuruthi Sellamuthu. Last reviewed .
What does DPDP form consent setup include?
DPDP form consent setup includes a form inventory, the legal basis for each form agreed with your legal contact, a short notice below the form, an unticked consent checkbox kept separate from the Terms where consent is needed, a visible privacy policy link, and a consent field recorded with each submission.
One form, before and after
The same sign-up form, the way we often find it and the way we leave it.
- Asks for more than the service needs
- One pre-ticked box bundles Terms, data and marketing
- No notice saying what is collected or why
- Only the fields the service needs
- A short notice and a visible privacy policy link
- Separate boxes, all unticked, marketing optional
- Consent recorded with the submission
What we see in practice
We often find forms with a pre-ticked box, or one box that bundles the terms, the privacy policy and marketing. We also find forms with no privacy notice or policy link below them.
Six things we do for each form
Contact, demo, newsletter and sign-up forms. Each one is looked at on its own, because each collects different data for a different reason.
The law behind each step is explained in the website guide to the DPDP Act. The sections cited are from the DPDP Act, 2023 and the DPDP Rules, 2025.
Form inventory
We list every form on the site: what personal data it asks for, and whether it asks for more than it needs.
Legal basis, agreed with your legal contact
Some forms need consent. Others can rely on the person giving their details for a specific purpose. We supply the facts. Your legal contact decides.Act Sections 6 and 7(a)
A short notice
Below the form, in plain words: what you collect, why, and how to withdraw or complain.Act Section 5, Rule 3
An unticked checkbox, separate from the Terms
Where consent is needed, the box starts unticked and stands on its own. Marketing is always optional.Act Section 6(1)
A visible privacy policy link
Next to the notice, not hidden in the footer. It points to the privacy policy we draft and your legal contact approves.
Consent recorded with the submission
We add a consent field to the form, so every submission carries the visitor's answer.Act Section 6(10)
We work on the form. Your team owns the CRM.
We add the consent field to the form. Your team maps that field into your CRM or email tool, the same way they map any other form field.
We do not need access to your CRM or internal systems.
At handover you get a form inventory that names the consent field on each form, so your team knows exactly what to map.
What you get, and what it costs
- A form inventory
- The consent pattern applied to each form
- A consent field on each form, recorded with the submission
Form consent is part of the Implementation, with the cookie banner and the policy drafts. It is not sold on its own.
| Plan | Forms covered | Price |
|---|---|---|
| Starter | Up to 5 forms | ₹39,999 |
| Growth | Up to 15 forms, plus a privacy requests form | ₹89,999 |
| Scale | Quoted per project | From ₹1,79,999 |
One-time fees. GST extra where applicable.
View pricingWhat form consent setup is not
Not a legal decision
We do not decide the legal basis for a form. We show what each form collects, and your legal contact decides.
Not CRM work
We do not log in to, configure or clean up your CRM, HR or back-office data.
Not sure where your forms stand?
The Website Audit checks up to 5 forms for a notice, a policy link and an unticked box.
DPDPWeb works on websites only: cookie banners, form consent, and privacy and cookie policy pages. We are not a DPO service and not a law firm. Nothing on this site is legal advice.
Form consent questions
Does every form need a consent checkbox?
Not always. If a person gives their details for a specific purpose, such as a callback, Section 7(a) can cover that purpose without a separate consent. Using the same details for marketing, or sharing them, needs consent. Confirm the route for each form with your legal contact.
Who decides the legal basis for each form?
Your legal contact. We supply the facts: what each form collects and what it is used for. They decide the legal basis, and we build the form to match.
Do you connect the consent to our CRM?
No. We add the consent field to the form, so it is recorded with every submission. Your team maps that field into your CRM. We never need CRM access.
Our forms are embedded from a CRM or marketing tool. How does that work?
For forms embedded from a CRM or marketing tool, for example HubSpot or Zoho forms, we specify the notice text, the checkbox and the consent field. Your team makes the change in the form builder. We then test the result on the live page. We do not log in to the CRM.
Can the consent box be ticked by default?
No. Consent has to be shown by a clear affirmative action (Section 6(1)), so every box starts unticked.
Can we keep consent inside the Terms and Conditions?
No. We keep the Terms separate from consent to use personal data, and marketing consent is optional. Each has its own box.
Is an email address personal data?
Yes. Personal data is any data about an individual who can be identified by it (Section 2(t)). Name, phone number and email address count in the same way as PAN or Aadhaar. A simple contact form needs the same care as a KYC form.
How many forms are included?
Up to 5 forms in Starter and up to 15 in Growth. Larger sites get a Scale quote.
Do you need developer time from us?
Often not. We need a developer only when the forms are custom built.
See how your forms ask for consent today
Send your URL. We run five checks on your homepage, forms included, and email you a one-page summary within two working days. No call needed.