A PDPA-compliant landing page form is not a form with a "PDPA" checkbox. It is a form that collects only what it needs, tells the user what will happen and why, captures consent for each distinct purpose, respects withdrawal, and produces an auditable trail from the browser all the way to your downstream tools. This article gives you a field-by-field anatomy for such a form, with the reasoning marked as statutory duty or recommended practice.
Field-by-field form anatomy
1 · Purpose statement (top of form)
One short sentence naming the primary purpose (e.g. "To send you our monthly MarTech briefing"). Statutory: notice under Principle 2.
2 · Mandatory identity fields
Only those necessary for the stated purpose. For a newsletter: email. For a booking: name, email, phone. Mark each as required with a visible asterisk. Statutory: collection limited to what is necessary.
3 · Optional fields
Clearly labelled optional. Do not gate submission on them. Recommended: progressive profiling later, not everything at once.
4 · Notice link
Link to the full privacy notice near the submit button, not buried in the footer. Statutory + recommended: notice at point of collection.
5 · Consent controls (per purpose)
Unchecked checkboxes for each distinct marketing/analytics/profiling/third-party-sharing purpose. Do not pre-tick. Statutory: consent per purpose; freely given.
6 · Submit button
Clear action label ("Send me the briefing"), not "Submit". Recommended.
7 · Confirmation & audit
Server records: submitted values, consent state per purpose, timestamp, notice version, source URL and IP where lawful. Statutory: ability to demonstrate lawful basis.
Notice & purpose language principles
Say what you will do
State each purpose in plain language. Do not hide operational purposes ("profiling", "personalisation") behind "improve your experience".
In the language of the form
If the form is in Bahasa Malaysia, so is the notice. Translations must be equivalent, not summaries.
Name who processes
Identify the data user (your company) and, at a minimum, the categories of processors (ESP, ad platform, analytics).
Point to the full notice
Link to a full privacy notice with retention, transfers, rights and contact for the Data Protection Officer where applicable.
Mandatory vs optional fields
| Mandatory | Mandatory | Mandatory | |
| Name | Optional | Mandatory | Mandatory |
| Phone | Do not ask | Optional (mandatory if WhatsApp follow-up) | Mandatory (for delivery) |
| Company | Optional | Mandatory (B2B) | Optional |
| Address | Do not ask | Do not ask | Mandatory (for delivery) |
| Marketing consent | Implied by sign-up, still explicit checkbox | Explicit, unchecked | Explicit, unchecked, separate from transactional |
Separate consent for distinct purposes
Bundling consents is the single most common mistake. Break them apart:
Marketing communications
Emails, WhatsApp, SMS from you about your products/services.
Personalisation & profiling
Use of behavioural data to personalise content or predict interest.
Analytics beyond strictly necessary
Cross-site or aggregated analytics that go beyond what is required to run the service.
Third-party sharing
Sharing with partners for their marketing — usually should be avoided rather than "consented".
Not every checkbox is legally mandatory. What is mandatory is that where consent is your lawful basis for a specific purpose, that consent must be freely given, specific, informed and unbundled for that purpose. Recommended practice is to keep the number of checkboxes small and meaningful, not maximal.
Withdrawal & preference management
- Withdrawal must be as easy as consent. A one-click unsubscribe or a preference centre is the norm; a phone call is not.
- Preference centre lets users toggle per-purpose consents independently. Do not force all-or-nothing.
- Withdrawal cascades: the ESP, CDP, ad platforms and CRM all update their state within a defined SLA (e.g. 24 hours).
- Withdrawal is logged with timestamp and source, alongside the original consent record.
Consent & data flow
User submits
Browser posts to your endpoint (never directly to a third-party unless strictly necessary).
Server validates & records
Fields validated. Consent flags stored per purpose with timestamp, notice version and source URL.
Distribute with consent
Downstream tools receive only the fields their purpose justifies. Marketing consent gates ESP subscription; analytics consent gates cross-site tags.
Confirm
User sees a confirmation with next steps and a link to preferences. Double opt-in for marketing where the risk profile warrants it.
Audit
All events retained for the retention window applicable to that purpose. Available for DSAR responses and Commissioner queries.
Progressive profiling
Do not ask for twelve fields on first contact. Ask for what you need to deliver the immediate value; ask for more later, in the context where the extra data is used (e.g. size preference at the point of a size-related recommendation). This is a compliance win (data minimisation) and a conversion win.
Server-side handling
Own the endpoint
Post to your own server before fanning out to third parties. Avoid arrangements where the form posts directly to an ad platform.
Validate & sanitise
Server-side validation of inputs; input sanitisation; rate limiting to prevent abuse.
Bot & spam controls
Silent honeypots, invisible reCAPTCHA or Cloudflare Turnstile. Avoid controls that discriminate against assistive technologies.
Encryption
TLS in transit. Encryption at rest for stores holding PII. Access controls and audit logs on the store.
Third-party processors
Every tool that receives form data is a processor. Under the amended Act, processors carry direct obligations. Ensure:
- Data-processing terms are in place with each processor, referencing the amended Act.
- Sub-processors are disclosed and controlled.
- Cross-border hosting is documented and covered by the CBPDT basis of transfer (see the CBPDT guideline).
- Breach cooperation is contractually required and rehearsed.
Cookies on the landing page
Cookie handling is a form problem too. If your landing page fires analytics, remarketing or personalisation tags before the user consents to those purposes, your form's consent captures cannot cure the earlier processing. Configure consent-mode so tags respect the user's stated preferences. Server-side tagging (e.g. server-side GTM) improves both governance and reliability.
QA checklist before you ship
Notice present
Purpose statement visible; full notice linked near submit.
Only necessary fields
Nothing collected "just in case".
Consents unbundled
One checkbox per distinct purpose; none pre-ticked; none required unless it truly is.
Language consistent
Form language matches notice language.
Server-side capture
Consent state, timestamp, notice version, source URL saved.
Withdrawal
Preference centre reachable; unsubscribe present in every marketing email.
Cascade
Withdrawal propagates to ESP/CDP/CRM/ad platforms within SLA.
Vendor list
Every processor named; contracts up to date.
Accessibility
Labels, focus order, error messages accessible.
Anti-patterns to remove
Pre-ticked consent
Not valid consent.
All-or-nothing bundling
"By submitting, you agree to all marketing, profiling and third-party sharing" — split it.
PDPA "acceptance" checkbox
Meaningless. Consent is per purpose, not a global "I accept PDPA".
Hidden fields collecting data
Undisclosed collection breaches Principle 2.
Third-party form services with unclear processing
Cheap in the short run, expensive when a DSAR lands.
Frequently asked questions
Do we legally need a PDPA checkbox?
Not as a generic acceptance. What you need is informed consent for each specific purpose where consent is your lawful basis, and adequate notice under Principle 2. A "PDPA acceptance" checkbox is theatre.
Is double opt-in required?
Not by the Act, but it is a defensible practice for marketing consent, particularly where deliverability, disputes or list hygiene matter.
Do these rules apply to B2B forms?
Yes. Professional contact data is still personal data.
Is progressive profiling PDPA-friendly?
Yes — arguably more so than collecting everything up front — provided each additional collection has notice and, where required, consent.
How long do we keep the consent record?
At least for as long as you rely on that consent as your basis for processing, plus a reasonable window to defend a challenge. Set a documented retention period per purpose.
Related reading
PDPA Malaysia compliance for marketers · First-party data strategy · Practical guide to CDPs · Data consulting Malaysia · Talk to us.
Sources & further reading
All sources retrieved 17 July 2026.