How-To Guide · DPDP Compliance
How to Build a DPDP-Compliant Consent Flow for Your Website or App — Without a Developer
If your website or app collects names, phone numbers, email addresses, or any other personal data, the DPDP Act now requires a clear notice, valid consent, and an easy withdrawal path before processing begins. The good news is that you can build a compliant flow without writing code - using forms, no-code tools, and a simple process design.
This guide is written for founders, operators, and SMB teams who need something practical they can launch quickly.
What DPDP Requires
The DPDP Rules require the notice to be presented independently of other information, in clear and plain language, with an itemised description of the personal data, the specified purpose, and a communication link for withdrawal, rights, and complaints. The Rules also require withdrawal to be as easy as giving consent.
In practice, your consent flow must do three things well:
- Tell the user exactly what you collect and why.
- Capture an active, specific, informed choice.
- Make withdrawal and grievance handling easy to find and use.
The Simplest No-Code Architecture
A compliant setup can be assembled with three layers:
- Notice layer: a short, plain-language privacy notice on the form or screen.
- Choice layer: one or more unchecked consent boxes mapped to specific purposes.
- Record layer: a log of who consented, when, how, and to what version of the notice.
If you already use Typeform, Google Forms, Webflow, Framer, Shopify, Zoho, or a CRM form, you can implement all three with minimal setup.
What Your Notice Should Say
Keep the notice short enough to read in a few seconds. It should explain:
- What data you collect.
- Why you collect it.
- Who receives it, if anyone.
- How long you keep it.
- How the user can withdraw consent.
- How the user can contact you with a complaint.
Keep the notice near the form field, not buried in a footer or a long terms page.
How to Structure the Consent Choices
Do not use one master checkbox for everything. Split consent by purpose so the user can make a real choice.
| Purpose | Suggested consent wording |
|---|---|
| Account creation | I consent to the use of my name, email, and phone number to create and manage my account. |
| Service communication | I consent to receive order, appointment, or service updates by email, SMS, or WhatsApp. |
| Marketing | I consent to receive promotional messages and offers. This is optional. |
| Analytics | I consent to the use of my activity data for product improvement and analytics. |
Only collect what is necessary for each purpose. If a user declines marketing, that should not block account creation or service delivery.
Step-by-Step Setup Without a Developer
Step 1 — Draft the Notice
Write a short notice in plain English. If your audience needs it, translate it into Hindi or another relevant language. Keep the tone direct and specific.
Step 2 — Add Separate Checkboxes
Use unchecked checkboxes for optional processing. For essential processing, explain why it is needed rather than forcing a generic consent phrase. Never pre-tick anything.
Step 3 — Add a Withdrawal Link
Place a clear link in the form footer, confirmation email, and account settings page. It should go to a simple page where the user can withdraw marketing consent, request deletion, or raise a complaint.
Step 4 — Store Proof of Consent
Record the timestamp, user identifier, consent version, and source URL. A spreadsheet, CRM note, or form submission log is enough to begin with, as long as it is organised and retrievable.
Step 5 — Automate the Follow-Up
Use no-code tools to trigger email confirmations, update CRM fields, or move users into different workflows depending on which consents they granted.
What the Consent Screen Should Look Like
A practical consent screen should be compact and easy to scan. Here is a simple structure you can copy:
1. Create and manage your account.
2. Send service-related updates.
3. Send marketing messages, if you choose to allow it.
4. Improve our product through analytics.
Your rights: You can withdraw consent, request access, correction, or deletion at any time using the link below.
After the notice, place the relevant consent checkboxes, then a submit button. Do not pre-tick anything.
How to Handle Withdrawal
Withdrawal must be as easy as consent. A user should not have to email support, wait days, or navigate a maze of settings just to opt out.
For a no-code setup, the withdrawal page can offer three actions:
- Stop marketing messages.
- Delete my account and data where legally possible.
- Contact support for a rights request or complaint.
When a user withdraws consent, make sure the request is reflected in your CRM, email tool, and any connected workflows.
Common Mistakes to Avoid
- Using one checkbox for all purposes.
- Hiding the notice inside a privacy policy link only.
- Pre-ticking consent boxes.
- Blocking service if the user refuses marketing consent.
- Not recording the version of the notice shown.
- Making withdrawal harder than consent.
Practical Checklist
- Write a plain-language notice.
- Separate essential and optional processing.
- Add unchecked consent boxes for each optional purpose.
- Add a withdrawal link on the form, app, and email.
- Store consent logs with timestamp and version.
- Test the withdrawal process end to end.
This is the fourth blog in the SecureConsent DPDP series. Start from the beginning: What Is DPDP? A Guide for SMBs →
Build your consent flow in minutes
SecureConsent is the control layer for DPDP consent — create notices, capture consent, store logs, and handle withdrawal requests from one dashboard.
Get Early Access →