Consent checkbox templates for website forms under PDPL

What is consent checkbox copy for website forms?

Short answer: it’s the text next to a checkbox that tells users what personal data the business will collect and process, for what purposes, and how they can withdraw consent.

With the Personal Data Protection Law (Law 91/2025/QH15, expected effective 01/01/2026), businesses should design checkboxes that are clear, specific, and easy to understand. If you use web forms for signup, contact, or purchase, each purpose should have its own wording; avoid a single “agree to everything” checkbox for all purposes.

Quick templates for website forms

Variant 1 — account signup form

[ ] I consent to [Company Name] collecting and processing my full name, email, phone number, and account information to create and manage my account, support login, authenticate, and provide customer support, as described in the Privacy Policy.

Variant 2 — contact/consultation form

[ ] I consent to [Company Name] processing the information I submit in this form (full name, email, phone number, message content) to respond to my request, provide service consultation, and keep a record of the conversation, as described in the Privacy Policy.

Variant 3 — purchase/order form

[ ] I consent to [Company Name] using my full name, phone number, shipping address, email, and order details to process payment, deliver goods, issue invoices, provide after-sales support, and handle complaints, as described in the Privacy Policy.

Variant 4 — separate marketing opt-in form

[ ] I agree to receive promotional emails/SMS/Zalo messages, offers, and newsletters from [Company Name]. I understand I can withdraw my consent at any time by [withdrawal instructions].

How should you write consent checkboxes for easier compliance?

Short answer: write to cover four layers of information: what data, for what purposes, who processes it, and how the user can control it.

In practice, many web forms only say “I agree to the terms” but do not specify what data is collected or for what purposes. That approach creates ambiguity. Under the regulations, for each form you should at minimum separate into:

• one checkbox for processing data necessary to fulfill the user’s request;
• a separate checkbox for marketing, newsletters, remarketing, and sharing with third parties;
• a link to the Privacy Policy;
• a mechanism to store consent evidence.

Consent checkbox templates for signup, contact, and purchase forms

Short answer: below is copy you can paste into forms right away, but you still need to adapt it to your actual data and systems.

1) Account signup form

Required checkbox

[ ] I confirm I have read and agree to [Company Name]’s Privacy Policy. I consent to [Company Name] collecting and processing the personal data I provide to create an account, authenticate, operate the service, and support me when needed.

Optional marketing checkbox

[ ] I agree to receive product updates, offers, and newsletters from [Company Name] via email/SMS/Zalo.

2) Contact form

Required checkbox

[ ] I consent to [Company Name] processing the information I submit in this form to respond to my inquiry, provide consultation, or technical support, as described in the Privacy Policy.

Practical note: if the form is only for a callback request, you may not need a separate marketing checkbox. But if you later want to add them to advertising lists, you need a separate consent mechanism as required by the regulations.

3) Purchase form

Required checkbox

[ ] I consent to [Company Name] collecting and using my full name, phone number, delivery address, email, and order information to process the purchase, deliver goods, handle payment, issue invoices, and provide after-sales support.

Optional checkbox

[ ] I agree to receive information about similar products, offers, and promotions from [Company Name].

Which checkboxes should be required, and which should be optional?

Short answer: required checkboxes should apply only to data necessary to fulfill the user’s request; marketing, profiling, and sharing beyond what’s necessary should be optional.

If you force users to consent to advertising before they can submit a contact form, that is not a safe compliance design. A better practical approach is to:

1. let the form work if the user consents only to what is necessary;
2. separate the marketing checkbox;
3. log the timestamp, wording, policy version, and source of consent.

Do we need to store consent evidence?

Short answer: yes. If the business cannot demonstrate what the user ticked, when, and on which version, it will be hard to justify in case of complaints or inspections.

For SMEs and dev teams, the minimum you should do is:

• store consent_text_version;
• store consent_timestamp;
• store form_id and purpose;
• store user_id or an equivalent identifier;
• store the opt-in/opt-out status;
• store the traffic/source if needed for reconciliation.

If you’re implementing a cookie banner, consent evidence storage, or DSAR processes, consent.vn can help you standardize logging and tracing to make operations easier.

Source: the Personal Data Protection Law (Law 91/2025/QH15); Decree 13/2023/ND-CP — https://thuvienphapluat.vn; Ministry of Public Security (A05) — https://bocongan.gov.vn