Web Design Best Practices

What a small business in India should add to its enquiry form: a clear consent line, a short privacy notice and extra care when the enquiry is about a child.

Privacy Notice and Consent on Enquiry Forms in India
On this page 9 sections
  1. What the rules ask for, in brief
  2. The four parts of a good enquiry form
  3. What to write in the privacy notice
  4. Enquiries about children
  5. Marketing messages need their own consent
  6. Keep a record
  7. Common mistakes
  8. Form checklist
  9. FAQs

In short

An enquiry form in India should tell people what data you collect and why, and ask for clear consent before they submit. The DPDP Rules notified in November 2025 call for standalone, clear and simple consent notices and verifiable consent before processing children's data. Collect only what you need.

Your enquiry form should tell people what you will do with their details and ask for their agreement before they press submit. That is the short answer. India's Digital Personal Data Protection Rules were notified in November 2025, and the government's release says they require standalone, clear and simple consent notices. This guide shows how a small business can do that on a simple form.

This is general information to help you prepare, not legal advice.

What the rules ask for, in brief

From the official release of 14 November 2025:

  • Consent notices must be standalone, clear and simple.

  • Verifiable consent is needed before processing the personal data of children.

  • People have rights to access, correct, update and erase their data, and to nominate another person to exercise these rights.

  • There is an 18 month phased timeline to comply.

The four parts of a good enquiry form

1. Ask only for what you need

For a first call back you need a name, a phone number and the service or course. Leave out date of birth, full address and school name unless you truly need them at this stage.

2. A plain purpose line

Say why you are asking, next to the form. Sample wording:

We will use these details to call or message you about your enquiry.

3. A consent tick box

Keep it unticked by default and write it in simple words:

I agree that [Business name] may use my details to respond to this enquiry. I have read the Privacy Notice.

4. A link to your privacy notice

Link the words "Privacy Notice" to a short page on your site.

What to write in the privacy notice

  1. Who you are and how to contact you.

  2. What data you collect through forms, calls and chat.

  3. Why you collect it.

  4. Who you share it with, such as your CRM or messaging provider.

  5. How long you keep it.

  6. How a person can ask to see, correct or erase their data.

  7. How to withdraw consent and stop messages.

Write it in the same simple language as the rest of your site. A notice nobody can read does not help you or your customers.

Enquiries about children

Coaching institutes, schools, tuition centres and clinics often receive enquiries about someone under 18. Since the rules call for verifiable consent before processing children's data, we suggest:

  • Label the fields "Parent or guardian name" and "Parent or guardian phone".

  • Collect the student's class, not unnecessary personal details.

  • Address calls and messages to the parent.

  • Avoid tracking or targeted advertising aimed at the child.

Agreeing to a call back is not the same as agreeing to promotions. Add a second, optional tick box:

Send me updates about courses and offers on WhatsApp and email. I can stop these at any time.

This also matches the WhatsApp Business Messaging Policy, which says you may contact people only if you have received opt in permission, and that you must respect requests to opt out. Our guide on how to get opt in for WhatsApp messages covers this in detail.

Keep a record

For each enquiry, store:

  • The date and time of consent.

  • The wording shown on the form at that time.

  • The page the form was on.

  • Whether marketing consent was given.

If someone asks you to delete their data or stop messages, act on it and note the date.

Common mistakes

  • A consent box that is already ticked.

  • One box that mixes enquiry consent with marketing consent.

  • A privacy link that goes to a missing page.

  • Collecting details "in case we need them later".

  • Sharing enquiry lists with partners without telling people.

Form checklist

  • Four fields or fewer for the first enquiry.

  • Purpose line visible near the button.

  • Unticked consent box with plain wording.

  • Working link to the privacy notice.

  • Separate optional box for marketing messages.

  • Parent details when the enquiry is about a child.

  • Consent stored with date and wording.

For the rest of the page, see what to put on a coaching institute landing page and landing page vs website for a small business. If you want a form audit as part of a site review, our web development team can help.

Need a page with a ready enquiry form? Build and preview your page free with Landing Page Builder and adapt the form wording to your business.

#data privacy#DPDP Act#enquiry form#consent#small business website
Found this useful? Share it.
WhatsApp LinkedIn

Frequently asked questions

Do we need a consent tick box on a simple enquiry form?

It is the clearest way to show that the person agreed. The DPDP Rules call for standalone, clear and simple consent notices, and an unticked box with a plain sentence next to it meets that aim well.

Can the consent box be ticked by default?

We advise against it. Consent should be a clear action by the person. A box that is already ticked makes it hard to show that they chose to agree.

What if the enquiry is about a child?

The rules ask for verifiable consent before processing a child's personal data. Ask for the parent or guardian's name and number, and address your messages to them.

Do we need separate consent for WhatsApp messages?

Yes, treat it separately. WhatsApp's business policy requires opt in before you message someone, so add a second tick box for updates on WhatsApp.

When do the rules apply?

The government release of 14 November 2025 says the DPDP Rules provide an 18 month phased compliance timeline. It is sensible to fix your forms now and not wait for the last date.

Let's Get Your Project
Started!