DPDP for websites: forms, cookies, analytics and notices

Your website is usually where personal data enters your business. Each form is a collection point that needs a purpose, a notice and a valid ground.

What regulators and customers can see

• Forms and the fields they ask for (name, phone, email, location).
• Whether a notice is linked at the point of collection.
• Whether consent boxes are unticked and specific.
• Third-party analytics and advertising scripts.
• Whether there is a visible way to complain or withdraw consent.
• HTTPS and basic transport security.

Good practice for forms

• Ask only for what the stated purpose needs.
• Link a notice next to the submit button.
• Keep marketing consent separate from the enquiry itself.
• Never pre-tick boxes.
• Post forms only over HTTPS.

Analytics and tracking

Tags that collect identifiers may process personal data. Load non-essential trackers after consent where consent is your ground, and review what each tool receives.