Consent-friendly lead capture form template

This is a practical template, not legal advice. Laws differ by country and sector; have your final wording reviewed for the places you operate.

<form action="/your-form-endpoint" method="post">
  <label for="name">Full name</label>
  <input id="name" name="name" autocomplete="name" required>

  <label for="email">Work email</label>
  <input id="email" name="email" type="email" autocomplete="email" required>

  <label for="company">Company</label>
  <input id="company" name="company" autocomplete="organization">

  <label for="message">What do you need help with?</label>
  <textarea id="message" name="message"></textarea>

  <p>We use these details to reply to your request. See our
     <a href="/privacy">privacy notice</a> for how long we keep them and your rights.</p>

  <!-- Optional, separate, unticked: marketing consent -->
  <input id="marketing" name="marketing_consent" type="checkbox" value="yes">
  <label for="marketing">Also send me product news by email. I can unsubscribe at any time.</label>

  <!-- Record on your server: timestamp, form version, the exact consent text shown, source page -->
  <input type="hidden" name="consent_text_version" value="2026-10">
  <button type="submit">Send</button>
</form>

Checklist

1. Ask only for what you need. Collect the fields you will actually use to reply. Each extra field lowers completion and adds data you must protect.
2. Say why you collect the data. Next to the button, say in plain words what you will do with the details and link to your privacy notice.
3. Keep marketing consent separate. Use a separate, unticked checkbox for newsletters or marketing. Do not make it a condition of getting a reply.
4. Record the consent. Store when the person agreed, the exact wording they saw, the form version and the page. You may need to show this later.
5. Make it easy to withdraw. Every marketing message needs a working unsubscribe link, and withdrawing must be as easy as agreeing.
6. Get local advice. Rules differ by country and sector. Have your final wording reviewed by someone qualified for the places you operate.

Why these steps

The EU GDPR (Article 7) says a request for consent must be clearly distinguishable from other matters, in clear and plain language, and that withdrawing consent must be as easy as giving it. The UAE’s Personal Data Protection Law (Federal Decree-Law No. 45 of 2021) generally prohibits processing personal data without the owner’s consent, with listed exceptions. A separate, unticked checkbox with plain wording and a record of what was shown is a common way to meet both.