Your contact form probably has a name field, an email field, a phone field and a message box. Somewhere near the button there may be a pre-ticked box that says “I agree to receive updates”, or a line in small print pointing to a privacy policy nobody opens. It has worked fine for years, so why touch it?
Because India’s data protection law has changed what a reasonable form looks like. The changes are small, and most of them can be made in an afternoon with the form plugin you already use. This post covers what to change and why. It is general information, not legal advice, and for decisions about your own business you should speak to a lawyer.
What the law asks of consent
Under India’s Digital Personal Data Protection Act, 2023, where a business relies on consent to process someone’s personal data, that consent should be free, specific, informed, unconditional and unambiguous, given by a clear affirmative action, and limited to the data needed for the purpose. People should be able to withdraw it about as easily as they gave it. If you want the wider picture of the Act and how it touches a website, start with our overview of what the DPDP Act means for a business website.
Consent is not the only basis the Act recognises. It also lists certain “legitimate uses”, including, broadly, where a person voluntarily gives you their data for a specific purpose. A simple enquiry form may fall there. Your adviser can tell you which basis fits each of your forms. The practical steps below are sensible either way, because they make it clear to the visitor what happens to what they type.
Translated into form design, the requirements come down to five habits.
1. A clear notice at the point of collection
The notice is what makes consent “informed”. In broad terms, the Act expects it to tell people what personal data you are collecting and why, how they can withdraw consent or exercise their other rights, and how they can complain to the Data Protection Board of India.
That does not mean pasting your whole privacy policy above the submit button. A good pattern is a short line or two right next to the form, with a link to the full policy for detail:
Example: “We use your name, email and phone number only to reply to this enquiry. You can ask us to delete your details at any time by writing to privacy@yourbusiness.com. Full details are in our privacy policy.”
Write it for the specific form. A job application form collects different data for a different purpose from a quote request, and the notice should say so. The Act also gives people the option of reading the notice in English or in one of the languages listed in the Eighth Schedule of the Constitution, which is worth discussing with your adviser if your customers mainly use another language.
The full privacy policy still matters, and it has to describe what the site actually does. Our post on keeping a website privacy policy current in India covers that review.
2. Unticked boxes and real choices
A pre-ticked box is the clearest example of consent that is not a “clear affirmative action”. The visitor did nothing. Change any consent checkbox so it starts empty and the person has to tick it themselves.
Also look at whether the box is genuinely a choice. If the form cannot be submitted without ticking “I agree to receive marketing emails”, the consent to marketing is a condition of asking a question, which sits badly with consent being free and unconditional. Making a box required is reasonable only when it covers something the form genuinely needs to do its job.
Finally, trim the fields. Consent is meant to be limited to the data needed for the purpose. If you never call enquirers, the phone field can go or become optional. If you ask for a date of birth or full address on a contact form, ask yourself what you do with it.
3. Separate consent for marketing
This is the change that affects most small business forms. Replying to an enquiry and adding someone to a newsletter are two different purposes. Someone asking for a quote has agreed to hear back about the quote, not to receive offers every month.
So give marketing its own checkbox, unticked, with its own plain wording:
Example: “Send me occasional emails about offers and new services. I can unsubscribe at any time.”
Then make sure the form actually respects the answer. If your form plugin sends every submission to your email marketing tool through an integration, set the integration to pass only the people who ticked the marketing box. This step is easy to miss, and without it the checkbox is decoration.
The same applies to WhatsApp. If you plan to send promotional messages on WhatsApp, ask for that separately rather than assuming a phone number on an enquiry form covers it.
4. Keep a record of consent
If a customer, or anyone else, later asks whether a person agreed to something, you want to be able to show it. The Act puts weight on a business being able to show that notice was given and consent obtained, so a record is worth keeping.
A useful consent record holds:
- Who gave it (the email address or account)
- When it was given (date and time)
- What they agreed to (which checkbox, and the exact wording shown)
- Which version of the notice or policy was live at the time
- How it was given (which form, on which page)
Many WordPress form plugins store entries in the database with a timestamp, and the value of a consent checkbox is saved with the rest of the entry. Some, like Contact Form 7, only email submissions unless you add a plugin to store them. Email marketing tools usually record when and how someone subscribed. Check that the wording of your checkbox is kept somewhere too: if you change it next year, you want to know what earlier subscribers actually saw.
Keep in mind that a consent record is itself personal data. Store it securely and do not keep it longer than you need.
5. Make withdrawal easy
Withdrawing consent should be about as easy as giving it. For a newsletter, that means a working unsubscribe link in every email. For other consent, it means a named contact address that someone actually reads, and a routine for acting on what arrives there.
Withdrawal often turns into a deletion request, which involves more than the form. Data may be in form entries, your inbox, a CRM and backups. Our guide to handling a customer’s request to delete their data walks through where to look.
Doing this in WordPress
You rarely need a new plugin. Most well-known form plugins, including Contact Form 7, WPForms, Gravity Forms and Fluent Forms, offer an acceptance or consent field, or a plain checkbox that can do the same job. A sensible order of work:
- List every form on the site, including ones inside popups, footers and checkout pages.
- For each form, write down its purpose and remove fields that do not serve it.
- Add a short notice next to the submit button, linked to your privacy policy.
- Change any pre-ticked consent box to unticked.
- Add a separate, optional marketing checkbox where you use the data for marketing.
- Check integrations so only people who opted in reach your mailing list or CRM.
- Decide whether entries are stored, where, and for how long, and set the plugin’s retention options if it has them.
- Submit a test entry and confirm what was saved, where it went and what the confirmation email says.
If you are building a new form from scratch, our guide on adding a contact form to WordPress covers the basics, and the consent points above can go in from the start.
If you want a hand
We do not sell a compliance package and we are not lawyers. The technical side is something we do every day: auditing forms, adjusting fields and checkboxes, fixing integrations that send everyone to the mailing list, and setting sensible retention. If your forms need that kind of tidy-up, tell us what you need and we will say honestly what is involved.
Next in this series: Handling a Customer's Request to Delete Their Data
