At a glance
A Contact Us form collects personal data — name, email, phone, and whatever the visitor types — so under the DPDP Act it needs a plain-language notice at the form itself, a single clear purpose (answering the enquiry), a retention limit, and no pre-ticked box signing people up for marketing. On WordPress or Wix that means configuring your form plugin’s notice, consent and data-handling settings, not just dropping in a stock form. The fix here is mostly settings, not code.
Educational resource only. This explains how to set up a Contact Us page in line with India’s Digital Personal Data Protection Act, 2023 (DPDP Act) and its Rules; it is not formal legal advice.
The situation
A Contact Us page feels too small to worry about — it’s just a name, an email, and a message box. But it’s a live personal-data collection point on a public URL, and the DPDP Act draws no exemption for “small” forms. The good news is that making it compliant is almost entirely a matter of configuring the form you already use, not rebuilding anything — once you know what the four settings that matter are.
Why a contact form is a data-collection point
The moment your form captures a name and an email, you’re collecting personal data — and the same duties apply as to any bigger form. There’s no threshold below which collection stops counting. A contact form that takes a name, email or phone number, and a free-text message is gathering personal data (and often more than people realise — the message box itself can contain anything the visitor chooses to type, including sensitive details). That makes you responsible for the same core obligations you’d have on a signup or checkout form: tell the person what you’re collecting and why at the point you collect it, use it only for that purpose, keep it only as long as you need it, and be reachable if they want it corrected or deleted. Contact forms usually run on a clear footing — the person is contacting you and expects a reply — but “they expect a reply” covers answering the enquiry, and nothing beyond it.
What the form’s notice has to say
A short, plain notice at the form does the Section 5 job — a link to your privacy policy alone does not. Section 5 of the DPDP Act requires the notice to appear at or before the point of collection, which is the form, not a policy page elsewhere on the site. It doesn’t need to be long. A compliant contact-form notice states, in plain language: what you collect (the fields on the form), the purpose (to respond to your enquiry), how long you’ll keep it, and how to reach your grievance contact or ask for the message to be deleted. Put it directly beneath or beside the form fields, where the person reading the form will actually see it.
Use the templateDPDP notice template — a free, ready-to-fill notice covering every item Section 5 requires. For a contact form you’ll use a short, trimmed version of it placed right at the form.
The marketing-consent trap
The single most common way a contact form breaks DPDP is quietly turning an enquiry into a mailing-list signup. A visitor filling in a contact form has consented to one thing: you replying to them. Adding their address to your newsletter, your CRM’s marketing sequence, or a remarketing audience is a different purpose they didn’t agree to — and a pre-ticked “keep me updated” box doesn’t fix it, because a pre-ticked box isn’t consent. If you want to offer a newsletter opt-in on the same form, it has to be a separate, unticked checkbox with its own plain label, and the contact form has to work whether or not it’s ticked. The other frequent trap is over-collection: a “phone number (required)” field on a form whose only purpose is an email reply asks for more than the purpose needs. Collect the fields the purpose actually requires, and make the rest optional or drop them.
Step by step: setting it up on WordPress or Wix
Configure the form you already have — four settings carry most of the work.
- Trim the fields to the purpose. Keep name, a contact method, and the message; make anything else optional or remove it. In both WordPress form plugins (Contact Form 7, WPForms, Gravity Forms, Fluent Forms) and Wix’s form editor, fields and their required/optional status are edited directly in the form builder.
- Add the notice at the form. Use the form’s description or an HTML/text block immediately below the fields to place the short notice — what’s collected, the purpose, retention, and your grievance contact. Don’t rely on a footer privacy-policy link to carry it.
- Keep marketing consent separate and unticked. If you offer a newsletter opt-in, add it as its own checkbox, unchecked by default, with a clear label — never merged into a “by submitting you agree to everything” line.
- Turn off silent list-building integrations. Check whether your form auto-syncs submissions into a marketing tool (Mailchimp, HubSpot, a CRM). If a submission flows straight into a marketing audience, disconnect that automation or gate it behind the separate opt-in.
- Set a retention limit on stored entries. Both WordPress form plugins that store entries in the database and Wix’s inbox retain submissions indefinitely by default. Decide how long you keep enquiry data and delete on that schedule — manually, or with a plugin/automation that prunes old entries.
- Make deletion and grievance reachable. Ensure the grievance contact named in the notice is a real, monitored route, and that you can actually find and delete one person’s messages if they ask.
Where the messages go: retention and access
A contact form quietly becomes a years-deep archive of personal data unless you decide otherwise. Every submission lands somewhere — your site’s database, an email inbox, a form-tool dashboard, sometimes all three — and by default none of them forget. That growing pile is personal data you’re responsible for: it should have a retention period tied to its purpose (once an enquiry is resolved and any follow-up window has passed, the record has served its purpose), and you need to be able to locate and remove an individual’s messages on request. Set the retention rule once, wire it into whichever store actually holds the messages, and the Contact Us page stops being a slow-growing liability and becomes what it should be — a way for people to reach you that respects the data they hand over to do it.
FAQ
Does a simple contact form really fall under the DPDP Act?
Yes. It collects personal data, and the Act sets no minimum size below which collection is exempt. The obligations are lighter in practice than for a big signup flow, but the same principles — notice, purpose, retention, reachability — apply.
Can I just link my privacy policy under the form instead of writing a notice?
No. Section 5 requires the notice at or before the point of collection. A privacy-policy link is a useful addition, but the short notice has to be present at the form itself; the policy page doesn’t discharge that duty.
Is a pre-ticked “subscribe to our newsletter” box on the contact form allowed?
No. A pre-ticked box isn’t consent. Marketing opt-in must be a separate, unticked checkbox, and submitting the contact form has to work whether or not it’s ticked.
How long can I keep contact-form submissions?
As long as the purpose needs and no longer. For an enquiry, that’s typically until it’s resolved plus any reasonable follow-up window. “Forever, by default” — which is what most form tools do unless you change it — isn’t a defensible retention position.
Do I need this if my form just emails me and stores nothing?
You still need the notice and the purpose discipline, because you’re still collecting the data — it’s just landing in your inbox instead of a database. And “stores nothing” usually isn’t true: the email itself is stored in your mailbox indefinitely, so the retention question still applies.