Anatomy of a DPDP-compliant signup form
Reviewed by Confidential Dispatch Editorial Team · Updated 21 Jul 2026 · 2 min read
This is a mock. The company name, email, and details shown are illustrative, not a real business.
Anatomy of a compliant signup form
One data-collection form, done right. Five things decide whether it meets the DPDP Act at the point of capture — here is where each one lands.
Only what the purpose needs
Three fields — name, mobile, email — and nothing more. Collect the minimum the service actually requires, not everything you might one day want.
Notice at the point of collection
A plain-language notice sits right on the form, not buried in a policy page. The person sees how their data will be used before they hand it over.
A specific, stated purpose
“To create and service your account” names the actual use — not “for our records.” The purpose is concrete enough for the person to judge.
A named way to exercise rights
A real contact for access, correction, deletion, and grievances. Rights mean nothing without a reachable person to action them.
Granular, unticked, separate
Marketing consent is its own box, clearly optional, and starts empty. Agreeing is a deliberate act, kept apart from creating the account.
Every article is checked against the current law and the judgments it cites before it is published.
Updated 21 July 2026 · Not legal advice.
