What does a DPDPA-compliant lead form look like for an Indian website?

Consent Manager registration under the DPDP Rules, 2025 opens on 13 November 2026, four days from now, and the notice-and-consent provisions that govern every web form in India follow on 13 May 2027. Most Indian lead forms we review would fail that test today: name, phone and email fields, one pre-ticked box bundling the privacy policy with marketing, and fine print saying that submitting the form means agreeing to everything. Here is what the Act and Rules require at the point of capture, what the form should look like, and what the CRM behind it must record.

Why do most Indian lead forms fail DPDPA today?

Five patterns account for almost every failure we see. The pre-ticked marketing box: Section 6(1) requires a clear affirmative action and excludes consent by mere inaction, so a box the visitor must untick is not consent. Bundling: one checkbox covering the terms of use, the privacy policy and promotional messages is not specific to any purpose. The implied-consent footer, "by submitting this form you agree to be contacted", which is inaction dressed as agreement. Over-collection: asking for date of birth or PAN on a brochure-download form whose purpose is to email a PDF. And the missing notice: a link to a 4,000-word privacy policy is not the notice Section 5(1) requires to accompany or precede the consent request.

A sixth sits in a grey zone. Gating a brochure or price list behind a marketing opt-in makes marketing consent a condition of receiving something unrelated to it, which strains the word "unconditional" in Section 6(1), and Section 6(2) makes any infringing part of a consent invalid to that extent. Settle this with counsel before May 2027; gated content is one of the most common B2B lead tactics in India.

What does Section 6 require from the consent a lead form captures?

Section 6(1) sets the standard: consent must be free, specific, informed, unconditional and unambiguous, given by a clear affirmative action, and limited to the personal data necessary for the specified purpose. Section 6(3) requires the request to be in clear and plain language, readable in English or any Eighth Schedule language, and to carry the contact details of the Data Protection Officer or another person who answers processing questions. Section 6(4) requires withdrawal to be as easy as giving consent. Section 6(10) puts the burden of proof on the Data Fiduciary: if consent is questioned before the Data Protection Board, the business must prove that notice was given and consent obtained. A single boolean in a CRM field, with no notice version or timestamp attached, is not proof.

What must the notice next to the form actually say?

Section 5(1) requires a notice to accompany or precede every consent request, and Rule 3 of the DPDP Rules, 2025 fixes its content. The table maps each requirement to the form itself.

Rule 3 requirement	What it means on a lead form	Common mistake
Understandable independently of any other information	A short notice block beside the fields, not a link to the privacy policy	"See our privacy policy" as the only disclosure
Itemised description of the personal data	"Name, work email, mobile number, company name" listed as collected	"Your information" or "your details"
Specified purpose and the goods, services or uses enabled	"To respond to your demo request"; "to send product updates by email and WhatsApp"	"For business purposes"
Link and other means to withdraw consent, exercise rights and complain to the Board	A preferences or unsubscribe link, the DPO or contact email, and the Board complaint route	No withdrawal path until the first email arrives
Language option (Section 6(3))	A language toggle offering English plus the Eighth Schedule languages your customers use	English only on a form serving Marathi or Tamil speakers

The language requirement is lighter than it sounds. Section 6(3) gives the visitor the option to access the request in one of 22 scheduled languages; it does not require the form to open in all of them. A toggle serving English, Hindi and the regional languages matching your traffic covers most B2B sites, with the full set on the hosted notice page.

Do you need consent at all for a "request a quote" form?

Not for the quote itself. Section 7(a) treats personal data a person provides voluntarily, for a purpose she has not indicated she objects to, as a legitimate use, so a demo request can be processed to arrange the demo without a separate consent tick. The limit is the purpose. Adding the same person to a newsletter, a WhatsApp broadcast or a retargeting audience is a different purpose, and marketing almost never qualifies as a legitimate use, so it needs its own consent. The form therefore needs separate decisions: the enquiry, which proceeds on Section 7(a), and marketing, which does not. Handing leads to a channel partner or co-marketing sponsor is a third purpose and a third unticked box. The downstream rules for the messaging channels themselves are covered in our guide to WhatsApp and SMS marketing under DPDPA.

What are the eight elements of a compliant lead form?

1. Fields limited to the purpose (Section 6(1)): name, work email and mobile for a callback, nothing more.
2. An inline notice block of two to four lines naming the data, the purpose and the collector, linking to the full Rule 3 notice.
3. A language toggle covering English and the scheduled languages your audience uses, applied to the notice and checkbox text.
4. Separate, unticked checkboxes for marketing by each channel and for any sharing with partners; the enquiry itself needs none.
5. Neutral submit wording: "Request a callback", not "Submit and agree". The button completes the enquiry, it does not grant marketing consent.
6. Contact details for the Data Protection Officer or designated contact (Section 6(3)) and the route to complain to the Board.
7. A confirmation that restates the choices on screen and by email, with a one-click way to change them (Section 6(4)).
8. A consent record written on submit: purpose, notice version and language, timestamp, source URL and channel, stored against the contact.

What should the CRM record when the form is submitted?

The form is the visible half of compliance; the record is the half the Board will ask for. Because Section 6(10) places the burden of proof on the business, each consent event should be a row, not a flag: contact identifier, channel and page, notice version and language displayed, each purpose consented to or declined, timestamp and method, and every later change including withdrawal. Rule 6 requires security logs to be kept for at least one year, and registered Consent Managers must keep consent records for seven years under Part B of the First Schedule, a sensible benchmark for your own retention. Withdrawal must suppress the contact in every downstream system at once: email tool, WhatsApp Business provider, dialler and agencies. A CRM that cannot store purpose-level consent needs a spreadsheet beside it, and spreadsheets are the first thing an audit challenges. Our eight-point DPDPA CRM checklist sets out the controls around the record, and our analysis of the legacy notice under Section 5(2) covers the contacts already in the system before the new form goes live.

What happens if the form is not fixed by 13 May 2027?

From that date, Sections 5 and 6 and Rule 3 are in force and the Data Protection Board's inquiry and penalty powers apply. A notice-and-consent failure falls under the general cap of ₹50 crore per instance in the Schedule to the Act; failures involving children's data carry a ₹200 crore cap, which matters for EdTech, gaming and consumer brands whose forms attract under-18 visitors and so need verifiable parental consent under Section 9. These are ceilings, not automatic fines. Public reporting in October 2026 noted that the Board's chairperson and members had still not been appointed, so early enforcement may be slower than the calendar suggests, but the burden of proof does not move: a form rebuilt in 2027 cannot evidence consent collected in 2026. The 13 November milestone itself is explained in our post on what changes when Consent Manager registration opens.

How do QQCRM and DAPro handle consent at the point of capture?

QQCRM, Qodequay's AI CRM accelerator, captures leads from web forms, WhatsApp and events into contacts that carry purpose-level consent fields, the notice version shown and the source of each record, and suppresses marketing automatically on withdrawal. DAPro (Data Adhikaar) supplies the notice layer: itemised Rule 3 notices in 22 languages, a tamper-evident Evidence Vault for every consent event and withdrawal, and 25+ connectors into the CRM, marketing and support tools where the data flows. Qodequay is ISO 9001:2015 and ISO 27001:2022 certified.

If your website forms were last reviewed before the DPDP Rules were notified, we will audit them against Section 6 and Rule 3 and map what your CRM must record. Book a 30-minute DPDPA readiness call.

This article is for general information and is not legal advice. It reflects the DPDP Act, 2023 and the DPDP Rules, 2025 as notified at the time of writing; proposals under consultation may change the dates described. Confirm obligations against the official texts and consult qualified counsel for your situation.