DPDP Act Consent Forms: A Practical Guide for Indian Businesses

India’s Digital Personal Data Protection Act, 2023 (DPDP) changed what a data-collection form has to do. If your organisation collects personal data from people in India — customers, patients, clients, job applicants — the consent you gather and the notice you show are now legal obligations with real penalties attached. This guide covers what valid consent looks like under the DPDP Act and how to structure an intake form around it.

Who the Act applies to

The DPDP Act applies to the processing of digital personal data within India, and to processing outside India where it relates to offering goods or services to people in India. If you run a clinic, a fintech, a law practice, a SaaS product, or a CA firm and you collect personal data through a form, you are almost certainly a Data Fiduciary under the Act — the entity that decides why and how personal data is processed.

What “consent” means under the DPDP Act

Consent under the Act is not a single checkbox at the bottom of a form. To be valid, it must be:

• Free — not bundled with unrelated terms or forced as a condition of an unrelated service.
• Specific — tied to a defined purpose, not “for business purposes”.
• Informed — the person knows what they are agreeing to before they agree.
• Unconditional — no pre-ticked boxes, no assumed agreement.
• Unambiguous — expressed through a clear affirmative action.
• Itemised — where you process data for several purposes, each purpose is presented separately so a person can agree to one and decline another.
• As easy to withdraw as it was to give.

The itemisation requirement is the one most existing forms fail. A single “I agree to the privacy policy” tick that silently covers marketing emails, analytics, and data sharing with partners does not meet the bar.

The notice you must show

Alongside the consent request, the Act requires a clear notice — in plain language, and available in English and the languages listed in the Eighth Schedule to the Constitution — that tells the person:

1. What personal data you will collect.
2. The specific purpose for processing it.
3. How they can exercise their rights (correction, erasure, grievance redressal).
4. How to withdraw consent.
5. How to complain to the Data Protection Board of India.

Structuring a compliant intake form

Here is a practical layout that satisfies the requirements without turning the form into a legal document:

1. Purpose-first framing

Open with a one or two line statement of why you are collecting the data. “We use this information to open your account and meet KYC obligations.” Specific, not generic.

2. Collect only what you need

Data minimisation is built into the Act’s purpose-limitation principle. Every field should map to your stated purpose. If you cannot explain why a field is there, remove it.

3. Itemised consent block

Separate, individually tickable consent statements — never pre-ticked:

• I consent to VerifID processing the data above to [primary purpose].
• I consent to receiving service-related updates by email. (optional)
• I consent to my data being shared with [named third party] for [purpose]. (optional)

4. Link the notice

A visible link to your DPDP notice / privacy notice, not buried in a footer.

5. Withdrawal and rights information

A short line telling people how to withdraw consent and raise a grievance, with a working contact route.

Security is part of compliance

The Act requires Data Fiduciaries to protect personal data with “reasonable security safeguards” to prevent breaches. If a form tool stores submissions in plaintext that the vendor can read, the set of people who can cause or suffer a breach includes the vendor’s staff and anyone who compromises the vendor.

Client-side encryption narrows that exposure: the response is encrypted in the browser and only the form owner holds the key. It also makes erasure requests verifiable — if you destroy the key, the data is unrecoverable. VerifID Forms is built this way; the DPDP compliance page maps each obligation to how the platform handles it, and the architecture page covers the cryptography.

Common mistakes

• One checkbox for everything. Fails itemisation.
• Pre-ticked consent. Fails the “unconditional” and “clear affirmative action” tests.
• Purpose creep. Collecting data for onboarding, then using it for marketing without separate consent.
• No withdrawal route. Consent must be as easy to withdraw as to give.
• Retention forever. Keep personal data only as long as the stated purpose requires.

A quick checklist

• Purpose stated in plain language, up front.
• Every field maps to that purpose.
• Separate, un-ticked consent for each distinct purpose.
• DPDP notice linked and readable.
• Withdrawal and grievance route shown and working.
• Submissions encrypted, with limited key access.
• Retention and deletion schedule defined.

Our free compliance checklist generator will produce a DPDP-specific version of this list for your industry, and the templates gallery includes consent-structured starting points for healthcare, finance, and legal intake.