Anatomy of a DPDP-compliant signup form
Anatomy of a compliant signup form
One data-collection form, done right. Five things decide whether it meets the DPDP Act at the point of capture — here is where each one lands.
Only what the purpose needs
Three fields — name, mobile, email — and nothing more. Collect the minimum the service actually requires, not everything you might one day want.
Notice at the point of collection
A plain-language notice sits right on the form, not buried in a policy page. The person sees how their data will be used before they hand it over.
A specific, stated purpose
“To create and service your account” names the actual use — not “for our records.” The purpose is concrete enough for the person to judge.
A named way to exercise rights
A real contact for access, correction, deletion, and grievances. Rights mean nothing without a reachable person to action them.
Granular, unticked, separate
Marketing consent is its own box, clearly optional, and starts empty. Agreeing is a deliberate act, kept apart from creating the account.
This is a mock. The company name, email, and details shown are illustrative, not a real business.
Related Articles
Collecting personal data from your own customers?
These are the rights your business has to honour. See where you stand with a two-minute self-check — no sign-up, no data stored.
Run the compliance self-check →