PDPA Consent Wording for Forms: Clear Examples You Can Adapt

What PDPA consent wording on a form must do

Three obligations in the Personal Data Protection Act shape the wording on any form that collects names, emails or phone numbers.

PDPC's Advisory Guidelines on Key Concepts explain each one with examples. The wording below follows those guidelines.

The purpose statement: say what you will do with the data

Most small business forms need only one or two purposes. Name them in plain words, link to your full privacy policy, and keep it next to the submit button where people actually read it.

PDPC's guidelines also say that if a person voluntarily gives you their details for an obvious purpose, such as asking for a quote, they are deemed to consent to that use (section 15). The purpose statement still matters, because it is how you meet the notification obligation and how you show what the person agreed to.

PDPC's free Data Protection Notice Generator can produce a starting notice for your website.

Marketing consent: a separate, unticked checkbox

This is where most forms go wrong. PDPC's Key Concepts guidelines say organisations should generally get express consent for direct marketing through an opt-in method, such as "requiring action to check an unchecked box". The Commission says it does not consider a pre-checked box appropriate for marketing consent, and that consent obtained that way does not count as clear and unambiguous consent under the Do Not Call provisions.

Section 14(2) adds a second rule: you must not require consent beyond what is reasonable to provide the product or service. So a quote form cannot make the newsletter compulsory. You can offer it, but the person must be able to submit without ticking it.

If you will send promotions by SMS, WhatsApp or calls to Singapore numbers, the consent should be in written or other accessible form, and PDPC says verbal consent alone is not enough. Otherwise you must check the number against the Do Not Call Registry. Our guide to checking the Do Not Call Registry explains when that applies.

Example consent wording for common forms

Adapt these to your business. Replace the brackets, keep the sentences short, and make sure what they say matches what you actually do.

Enquiry or quote form

• Under the submit button: "We use your name, email and phone number to reply to your enquiry and prepare a quote. See our [privacy policy] for how we protect your data and how to contact our Data Protection Officer."
• Optional checkbox, unticked: "Yes, send me occasional offers and updates by email. I can unsubscribe at any time."

Newsletter sign-up

• Next to the email field: "Sign up to receive our monthly newsletter and promotions by email. You can unsubscribe at any time using the link in every email. [Privacy policy]."
• Here the whole purpose of the form is marketing, so submitting it is the opt-in. Do not add other uses, like sharing with partners, to the same sign-up.

Booking or appointment form

• Under the submit button: "We use your details to confirm and manage your booking, send reminders by SMS or email, and contact you if your appointment changes. [Privacy policy]."
• Optional checkbox, unticked: "Send me promotions by SMS or WhatsApp. I can opt out at any time by replying STOP."

Booking reminders about an appointment the person made are not marketing. Promotions sent to the same number are, so keep them separate.

Withdrawal wording and how fast you must act

Section 16 lets people withdraw consent by giving reasonable notice. PDPC says it will not set one fixed time, but as a rule of thumb it considers at least 10 business days from when you receive the notice to be reasonable. If you need longer, tell the person when the withdrawal will take effect.

The guidelines also show that an unsubscribe link in an email can be channel-specific: unsubscribing from emails withdraws consent for email marketing, while a general "stop all marketing" request should cover every channel.

PDPC publishes free consent withdrawal templates and a deemed consent checklist in its tools and templates section.

Deemed consent by notification: when it fits

Since the 2021 amendments, section 15A lets an organisation use data for a new purpose by notifying people and giving them a reasonable time to opt out, instead of asking each person to say yes. PDPC sets conditions: you must first assess and reduce any adverse effects on individuals, notify them clearly, give a reasonable opt-out period, and keep the assessment.

For a small business, this suits things like using past customer records for a new service reminder or internal analysis. It does not suit marketing, which is excluded. If in doubt, ask for consent directly; it is simpler to show.

Your forms also need to match your website's privacy policy and cookie notice. Our guide to website privacy policies and cookie consent under the PDPA covers those pages.

Do it yourself or get help?

Updating the wording on a handful of forms is a job you can do in an afternoon with the examples above. Check every form: contact, quote, booking, newsletter, careers and any embedded third-party forms. If you use a form builder, our Tally vs Google Forms vs Jotform comparison notes where each stores responses.

If you want the full set done, our PDPA Compliance Pack (S$690) includes a website privacy policy, a cookie and consent notice, a data inventory and a breach response plan. If your forms themselves need rebuilding with proper consent fields and storage, a Business Website (S$1,490) includes forms built that way. We are not a law firm; for disputes, use a lawyer.