Guide · June 17, 2026
Download-for-email forms under the PDPL: what's needed?
PDPL guide to ebook/lead magnet download-for-email forms: clear purposes, separate marketing consent, keep consent evidence.
Quick answer
What is a PDPL lead magnet download-for-email form?
This is a form that collects an email address in exchange for a document, ebook, checklist, webinar recording, or template. Under the PDPL, this is not just “collecting an email” but an activity that processes personal data. Therefore, right on the form, you need to be transparent about who is collecting the data, for what purposes, whether it will be shared with third parties, and which parts the user can opt out of.
For SMEs in Vietnam, the most common mistake is bundling everything into a single checkbox like “I agree to receive the material and promotional messages.” This can be ambiguous. It’s better in practice to separate clearly: one part to send the material the user requested; a separate part for email marketing.
What information should a PDPL download-for-email lead magnet form include?
At a minimum, the form should include: the document name, the purpose of collecting the email, the data controller, a contact channel, a link to the personal data protection policy, and a marketing consent option if applicable.
You don’t need to turn the form into a “3-page legal document.” But users must understand what their email will be used for. For example, if they download the ebook “10 contract templates for online shops,” the email may be used to send the file, notify about document updates, or for post-download follow-up. If you want to use the email to send newsletters, invite to demos, or offer promotions, this should be a separate option.
| Component | Include | Why | |
|---|---|---|---|
| Document description | Yes | Users know what they're getting in exchange | |
| Purpose of using the email | Yes | Transparency required by law | |
| Link to PDPL policy | Yes | Lets users check their rights and how data is handled | |
| Checkbox to receive the material | Optional | Records that the user requested the material | |
| Separate marketing checkbox | Recommended | Separates advertising consent from getting the file | |
| Evidence of consent | Yes | Needed for compliance checks |
Do you need a separate marketing consent checkbox?
Recommended, if you intend to use that email to send promotional content, sales newsletters, or email remarketing. The reason is simple: agreeing to download a document does not mean they agree to receive all marketing emails afterwards.
In practice, many businesses only have one box: “I agree to receive information from the company.” This can lack clarity. Under the rules, you should separate at least two layers: consent to receive the requested material, and consent to receive marketing. If the user doesn’t tick marketing, you can still send the file they requested, but you shouldn’t default them into your advertising list.
Real example: a B2B software company runs a landing page to download the ebook “Sales process for sales teams.” The form can include: full name, company email, a checkbox “I want to receive the ebook,” and a separate checkbox “I agree to receive product introductions/updates from consent.vn.” This is both clear and makes it easy to store evidence of consent.
How to design a PDPL-compliant download form?
Follow these 5 steps to make the form both effective and easy to control:
Define the primary purposes:
State clearly whether the email is used to send the material, for post-download follow-up, or for marketing. Don’t lump everything into one vague sentence.
Write a short notice on the form:
State who is collecting the data, for what purposes, whether it’s shared with third parties, and include a link to the personal data protection policy.
Separate checkboxes by purpose:
One checkbox for receiving the material; a separate checkbox for email marketing if applicable.
Store evidence of consent:
Record timestamp, checkbox text, form version, IP or system logs in a suitable way.
Set up opt-out/withdrawal processes:
Provide a visible unsubscribe option in emails and handle withdrawal requests as required.
Is there a ready-to-use form content sample?
You can refer to the short sample below and adapt it to your actual product:
Form title: Download the free ebook “Legal checklist for websites 2026”
Description: We will use your email to send the ebook you requested and, if you consent, to send additional materials, product updates, or related offers. See the Personal Data Protection Policy at [link].
Input fields:
- Full name
- Company (if needed)
Checkboxes:
- [ ] I agree to receive the ebook via email.
- [ ] I agree to receive additional marketing emails, product news and offers.
Button: Get the ebook
This sample is not a “complete legal template” for every situation, but it’s good enough for quick deployment on a lead magnet landing page, provided you have a proper data policy and a process to log consent.
How should you update an existing form?
Audit it with three questions: does the form clearly state the purposes, is marketing separated, and can you store evidence of consent? If the answer is “no,” prioritize fixes on the landing page, email automation, and CRM.
Especially with lead forms running ads, data often flows into a CRM or email tool. You need to check who the processor is, who has access, how long the data is retained, and how it is deleted upon user request. If data is transferred abroad or you use third-party platforms, you should carry out additional reviews as required and consult a lawyer when configurations are complex.
On compliance risk, the Personal Data Protection Law (Law 91/2025/QH15) is expected to take effect from 01/01/2026, replacing Decree 13/2023/ND-CP. The enforcement authority is the Ministry of Public Security, specifically the Department of Cybersecurity and High-Tech Crime Prevention (A05). If a personal data incident occurs, businesses must notify within 72 hours of discovery as required. Specific penalties will follow the guiding decree; serious violations may be subject to criminal handling.
If you operate multiple lead forms, consent.vn can help standardize banners, store consent evidence, and set up DSAR flows so the marketing team doesn’t have to process requests manually.
- Not every form is mandatory, but if you plan to send promotional emails afterwards, you should separate the marketing checkbox so consent is clear under the rules.
- Yes. Even if you only send the requested file, you should state what the email is used for, who processes it, and include a link to your data policy.
- Not recommended. Separating them improves transparency and makes it easier to prove the user consented to each purpose.
- Stop sending marketing emails immediately, update the status in your CRM/email tool, and keep logs to prove you handled the request as required.
Source: the Personal Data Protection Law (Law 91/2025/QH15); Decree 13/2023/ND-CP — thuvienphapluat.vn; A05 — bocongan.gov.vn
Get started — set up in 5 minutes.
Need help with PDPL compliance?