At a glance
This is a free, ready-to-fill consent form for collecting personal data in India under the DPDP Act. It’s built around what Section 6 makes valid consent: a clear notice first, then separate, unticked opt-ins — one per purpose — confirmed by an affirmative action, with the withdrawal route stated and the fields you need to prove the consent later. Fill in the brackets, add one opt-in row per purpose, and never pre-tick anything. Works as a paper form or a digital consent screen.
Educational resource only. This provides a template for the consent requirement under India’s Digital Personal Data Protection Act, 2023 (DPDP Act) and its Rules; it is not formal legal advice, and you should have it reviewed against your own data collection before you use it.
The situation
Most “consent forms” in circulation are one dense paragraph and a signature line — bundled, vague, and invalid under the DPDP Act’s definition of consent. Building a valid one isn’t harder; it’s just structured differently: notice first, one tick per purpose, nothing pre-ticked. This template is that structure, ready to fill.
What this template is (and when you need it)
A consent form is where a person actually says yes — this template makes that yes free, specific, informed, unconditional and unambiguous, which is what the law requires it to be. Valid consent under the DPDP Act (Section 6) needs all five qualities, given by a clear affirmative action, per purpose, after a notice. Use this wherever you capture consent — client onboarding, a signup flow, an event registration, a document-collection step. It pairs with the DPDP notice template: the notice tells the person what and why; this form captures the agreement. On a digital screen the same structure applies — each opt-in row becomes an unticked checkbox.
The template — copy and fill in
Copy everything below, replace the bracketed fields, and add one opt-in row per purpose. Delete rows you don’t need — and never pre-tick a box.
Consent Form
[Your Business/Product Name] — [the activity, e.g. “New client onboarding”]
Before you decide: our notice at [link/location] explains what personal data we collect for each purpose below, how to withdraw consent, how to exercise your rights, and how to complain. Please read it first.
Your choices — tick only what you agree to:
☐ [Purpose 1 — e.g. “Process my service request”] — using [the data this purpose needs, e.g. “my name, phone number and email”].
☐ [Purpose 2 — e.g. “Send me offers and updates”] — using [the data this purpose needs]. (Optional — saying no does not affect your service.)
☐ [Purpose 3] — using [the data this purpose needs]. (Optional — saying no does not affect your service.)
Withdrawing: you can withdraw any consent above at any time by [method] — it’s as easy as giving it, and it won’t affect anything already done lawfully before you withdrew.
Confirmation:
Name: ______________ Signature / confirmation action: ______________ Date & time: ______________
For our records: consent captured by [name/system], against notice version [version/date].
How to fill it in
One purpose per row is the whole design — everything else supports it.
- [the activity]
- What it means: The specific interaction this form covers.
- Examples: New client onboarding, event registration, document collection for [service].
- [Purpose rows]
- What it means: One row per purpose, each naming the purpose plainly and the data it needs. The purpose the person came for is the only one that isn’t optional; every unrelated purpose (marketing, sharing with partners) must be individually declinable — that’s what keeps consent free and unconditional.
- Examples: “Process my loan application — using my PAN, income documents and contact details.” “Send me promotional offers — using my phone number. (Optional.)”
- [method]
- What it means: However someone can actually withdraw — as simple as the giving was.
- Examples: “Emailing [email protected]”; “the Manage consent setting in your account.”
- [version/date] — the record fields
- What it means: Who agreed, to what, when, and against which notice — the burden of proving consent sits on you, and these fields are the proof. Store the completed form (or the digital equivalent: user, purposes, timestamp, notice version) where you can retrieve it years later.
- Examples: “Notice v3, 12 Aug 2026”; a consent-log entry ID.
What this template doesn’t cover
The form captures consent — it doesn’t design your whole flow, and it isn’t legal advice. It doesn’t replace the point-of-collection notice (pair it with the notice template), doesn’t cover children’s data (anyone under 18 needs verifiable parental consent, a stricter mechanism than a form row), and doesn’t decide which of your purposes can run on a legitimate use instead of consent — some can, and over-asking has its own costs. Have the finished form reviewed against what you actually collect before you rely on it.
FAQ
Can I combine all purposes into one checkbox to keep the form short?
No — bundled consent is exactly what Section 6 rules out. One purpose per row, each separately tickable, is what makes the consent specific and unconditional. Short forms come from having fewer purposes, not fewer checkboxes.
Can the service-delivery purpose be optional too?
The purpose the person came for doesn’t need an “optional” tag — you genuinely can’t serve them without it. What you can’t do is bundle unrelated purposes into that same tick or deny service for declining them.
Does a signed paper form count as valid consent?
Yes — a signature against clearly stated, unbundled purposes is a clear affirmative action. Keep the completed form retrievable; consent you can’t produce later is consent you can’t prove.
Do I need this form if I’m collecting data under a legitimate use?
No — processing that genuinely runs on a defined legitimate use (Section 7) doesn’t need a consent row. But the ground has to actually fit, and any extra purpose beyond it (like marketing) comes back to consent.