NGO Website Development in India: Building a Newsletter and Donor Email Signup Programme
A good NGO newsletter programme has five parts: a signup form placed where interested visitors already are, a confirmation step that proves the address is real, consent wording that says plainly what people will receive, a preference centre and one-click unsubscribe, and a sending set-up that mailbox providers trust. In NGO website development in India, the form is the smallest part of that list. The harder work is deciding what you promise subscribers, recording that promise, and then keeping it every month. This guide covers each piece in the order you would build it.
It is written for NGO communications and fundraising managers and for anyone briefing a developer. Legal points are summarised from the Digital Personal Data Protection Act, 2023 and commentary on the 2025 Rules as read in October 2026, and are not legal advice. The worked example is hypothetical, and its numbers are illustrations, not benchmarks. Payment, receipt and tax topics are left out on purpose.
How this differs from other donor email posts
This article is about the front door: getting a supporter onto a list properly and keeping the list healthy. What you send a person after their first gift is a separate subject, covered in our donor welcome journey guide. Keeping existing donors giving is covered in donor retention automation for NGOs. Here we stay on signup, consent, list plumbing and deliverability.
NGO website development in India: why a list matters and where to place the signup
An email list is the one audience channel your organisation holds directly, so you carry the duty to look after it. Decide what the list is for first: a newsletter of stories, donor updates for people who have given, and appeals or events. Each is a separate promise, which is what makes a preference centre meaningful later.
Placement
Placement decides how many of the right people subscribe. Put the form where a visitor has just shown interest, and say what they will get.
| Placement | Who sees it | Notes |
|---|---|---|
| Footer on every page | Everyone, late in the visit | Keep it short: email and one button. Never the only place. |
| End of each story or blog post | Readers who finished an article | Match the promise to the post: "More stories like this, once a month." |
| Donation thank-you page | People who just gave | Offer donor updates as an opt-in tick box, not pre-ticked. |
| Event or volunteer registration | People already engaging | Add a separate, unticked box for updates. |
| Dedicated /newsletter page | Social and WhatsApp links | Gives you a clean URL for QR codes and bios. |
| Exit or timed pop-up | Visitors about to leave | Use sparingly. It can annoy mobile visitors and may harm usability. |
Two cautions. First, do not hide the signup inside the donation checkout as a default. People should not have to un-tick a box to avoid emails they never asked for. Second, test the form on a mid-range Android phone on a slow connection. Many of your supporters will use one. Our guide on low-bandwidth mobile donors covers what that means for page weight.
What to ask on the form
Ask for the least you need. For a newsletter that is an email address. A first name helps greetings and costs little. Everything else can wait for the preference centre or the welcome email.
A sensible minimum:
- Email address (required)
- First name (optional)
- One or two interest tick boxes (optional): "Impact stories", "Events", "Volunteering"
- A consent line and a link to your privacy notice
Avoid asking for phone number, city or date of birth at this stage. Each field lowers completion and adds data you must protect. If you later want WhatsApp updates, collect a phone number with a separate consent for that channel; our WhatsApp flow work treats that as its own opt-in.
DPDP-aligned consent wording
India's Digital Personal Data Protection Act, 2023 is the law that governs how you collect and use subscribers' personal data. An email address that identifies a person is personal data, so this applies to your newsletter list. For the wider picture see our guides to DPDP compliance for NGO donor data and DPDP Act website compliance in India. Below are the points that bear on a signup form.
Notice (section 5) and consent (section 6)
Section 5 requires a notice with or before the request for consent. Commentary on the Act and Rules summarises it as: what data, what purpose, how to exercise rights, how to complain to the Data Protection Board, readable on its own. For a form, that is a short notice beside the button linking to your privacy notice.
Section 6(1) describes valid consent as free, specific, informed, unconditional and unambiguous, given by a clear affirmative action. In form terms:
- Free and unconditional: do not make a newsletter signup a condition of downloading a report, registering for an event or donating, unless the email really is needed for that purpose. Sending an event ticket is one thing. Adding the person to appeals is another.
- Specific: name the purpose. "Send me the monthly newsletter" is specific. "I agree to receive communications" is vague.
- Clear affirmative action: an unticked box or a button press whose label states the action. Pre-ticked boxes are not an affirmative action.
- Informed: say who is sending and link to the notice.
Section 6(4) deals with withdrawal. As commentary reads it, the Data Principal can withdraw consent at any time and the ease of withdrawing must be comparable to the ease of giving it. If subscribing took one click, unsubscribing should take about one click.
A wording example
Here is sample wording, written for a hypothetical NGO, which you should adapt and have reviewed by your own adviser:
Email address: [ ]
[ ] Send me the monthly newsletter from [NGO name] with stories and updates on our work. I can unsubscribe at any time from any email.
We use your email only to send what you choose here. Read our privacy notice for how we handle your data, how to withdraw consent and how to contact our grievance officer.
Notice what the sample avoids: no mention of "partners", no bundled purposes, no pre-ticked box.
When do the rules apply?
The Rules were notified on 14 November 2025 with a phased start. Law-firm summaries report that Rule 3, which covers notices, comes into force eighteen months after publication, which they put in mid-May 2027, while consent manager provisions follow around November 2026. The sources differ by a day on the exact dates, so check the Gazette notification before you rely on any date. Most NGOs should build compliant wording now rather than retrofit it. Our article on the DPDP consent manager framework for CRMs explains where consent managers fit.
Keep a consent record
Consent that you cannot show is hard to defend. For every subscriber store:
- The email address and the exact form or page used
- Date and time of the action
- The wording version they saw (for example "newsletter-consent-v2")
- The streams they chose
- Date of any withdrawal
If you change the wording, version it. Do not edit v1 in place.
Double opt-in: how and why
Double opt-in means the person enters an address, you send a confirmation email, and they are added only after clicking a link. Single opt-in adds them immediately.
For an NGO list, double opt-in has three practical benefits:
- It stops typing mistakes and fake addresses from entering the list.
- It stops someone from subscribing another person's address.
- It gives you a second timestamp, which strengthens your consent record.
The cost is a small drop in completed signups, because some people never open the confirmation. For most NGOs, the cleaner list is worth it. Note that double opt-in is a good practice, not a requirement named in the DPDP Act.
Build the flow like this:
- Visitor submits the form. Show a message: "Check your inbox to confirm."
- Send the confirmation email within a minute. Subject line: "Please confirm your subscription to [NGO name]".
- The email has one button and one line of text. Do not mix in other content.
- Clicking the link marks the address confirmed and lands on a thank-you page that shows what happens next and links to the preference centre.
- Confirmation links should expire, for example after seven days, and an unconfirmed address should receive at most one reminder.
The preference centre
A preference centre is a page where a subscriber changes what they receive and how often. It turns "unsubscribe from everything" into "send me less of this". For a small NGO a simple version is enough.
What to include:
- The streams: newsletter, donor updates, events, volunteering, appeals
- Frequency choice where you can honour it, such as monthly or quarterly
- Channel choice if you use more than one (email, WhatsApp)
- Name and email correction
- A clear "unsubscribe from all" option
- A link to request access to or deletion of their data
Reach it through a link in every email footer, using a secure per-subscriber token so people do not need a password. Do not make them log in to unsubscribe.
Unsubscribe that actually works
Unsubscribe is both a legal good practice and a technical requirement for deliverability. Requirements to build:
- A visible unsubscribe link in the body of every marketing email
- A List-Unsubscribe header in the email so Gmail and Yahoo can show their own button
- One-click handling of the header, which Google and Yahoo describe for bulk senders
- Processing within two days, which is Yahoo's stated limit; treat it as your standard and aim for immediate
- A short confirmation page, with a link to the preference centre in case the person only wanted fewer emails
Make sure the unsubscribe state travels everywhere. If your CRM, your email tool and a spreadsheet each hold a list, one unsubscribe must update all of them, or the person will get another email next week.
The welcome email
The first email after confirmation is the one most likely to be opened. Use it to set expectations, and keep it short.
A reasonable shape:
- Thank them by first name if you have it.
- Repeat the promise: what they will get and how often.
- Give one useful thing: your best impact story, a short film or the latest annual report.
- Link to the preference centre.
- Say who they can reply to. A real reply-to address, answered by a person, helps both trust and deliverability.
- Do not ask for money in this email.
That last point matters. A welcome email that goes straight into a donation ask treats a new reader as a prospect rather than a supporter. If the new subscriber is already a donor, the welcome sequence is a different job, which our donor welcome journey guide covers.
Connecting the form to your CRM
A signup form that drops addresses into a mailing tool and nowhere else leaves you with two systems that disagree. Connect it to the system where you keep donors, volunteers and enquiries.
What to sync:
- Contact record: email, first name, source form, date
- Consent fields: streams chosen, wording version, timestamps for signup and confirmation, withdrawal date
- Tags or lists for each stream
- A source field, so you can see which placement produced which subscribers
- A match rule: if the email already belongs to a donor, attach the subscription to the existing record rather than creating a duplicate
Two-way sync matters. If a subscriber unsubscribes in the email tool, the CRM should reflect it immediately, and the reverse. If your tools cannot sync both ways, make the CRM the source of truth and push suppression lists out to the sending tool daily at minimum.
Our guide to NGO donor CRM software in India covers what to look for in the donor system itself, and website lead capture and CRM integration covers the plumbing in more detail. If you want the form, CRM and sending tool set up together, that is the kind of work our CRM services cover.
Deliverability basics: SPF, DKIM and DMARC
You can write a perfect newsletter and still not reach inboxes if the sending set-up is weak. Since February 2024, Google and Yahoo have published requirements for senders.
What the official pages say:
- All senders to Gmail should set up SPF or DKIM, keep spam rates reported in Postmaster Tools below 0.3%, and meet basic technical requirements such as valid forward and reverse DNS, TLS and correctly formatted messages.
- Bulk senders, defined by Google as those sending more than 5,000 messages a day to Gmail accounts, need SPF, DKIM and DMARC, with the From domain aligned to SPF or DKIM. Marketing mail must support one-click unsubscribe and include a visible unsubscribe link. Google's guidelines say to aim to keep the spam rate below 0.10% and to avoid ever reaching 0.30%.
- Yahoo asks bulk senders for SPF, DKIM and a DMARC policy of at least p=none, a working List-Unsubscribe header with one-click support, and unsubscribes processed within two days, with a spam rate below 0.3%.
Most NGO lists are far smaller than 5,000 messages a day, so the bulk rules may not strictly apply. Treat them as the standard anyway. They describe what mailbox providers want to see, and a list that grows or has a viral campaign can cross the line quickly.
A practical set-up for a small NGO:
- Send from a domain you own, such as news.yourngo.org, rather than a free Gmail address.
- Publish SPF for the sending tool and sign with DKIM, using 2048-bit keys if the provider supports them (Google requires at least 1024).
- Publish a DMARC record starting at p=none with a reporting address, then review reports before tightening.
- Register the domain in Google Postmaster Tools and watch spam rate and reputation.
- Remove hard bounces immediately and stop mailing addresses that have not opened for a long period, such as twelve months, after one last re-engagement email.
The step-by-step DNS details are in our article on SPF, DKIM and DMARC email deliverability. If you are comparing tools, our email marketing tool comparison for India is a starting point.
Content cadence: what to send and how often
Frequency is a promise you made on the form. Keep it.
A realistic plan for a small team:
- Monthly newsletter: one lead story, two short updates, one clear action. Aim for something one person can produce in a day.
- Quarterly impact report: a short summary with numbers you can support. Avoid inventing totals; use only figures you hold records for.
- Event emails: an invitation, one reminder, a thank-you. Only to people who chose events.
- Appeals: sparingly, and only to people who opted in to appeals. A calendar with no more than a few appeals a year is a common approach, but test what your own readers tolerate.
Respect the stream. Someone who joined for monthly stories and receives a fundraising appeal has not agreed to it. Honouring that is both a DPDP point and a trust point.
Measuring signups in GA4
Count signups as events, not page views. A GA4 event such as generate_lead, which Google defines as a user submitting a form online, or a custom event like newsletter_signup, is a sensible choice. The sign_up event is listed in the recommended events for accounts created on a site or app, so for a newsletter a custom name is clearer. Whichever you choose, keep it consistent.
Fire the event on the confirmation step if you use double opt-in, not on the first submit. Otherwise you count people who never confirm.
Do not put email addresses or names in GA4 parameters. Keep personal details out of analytics; it would also work against your consent wording. Check Google Analytics' current policy on personally identifiable information before finalising your event setup.
Our guides on GA4 conversion tracking setup and donation analytics with a GA4 funnel cover the set-up in detail.
A hypothetical worked example
The following is illustrative only. It does not describe a real NGO.
A small education NGO in Pune has 40,000 website visits a month and no email list. It adds a footer form, an end-of-story form and an opt-in box on its volunteer page, with double opt-in.
Suppose, for the sake of the example, that 1.0% of visits lead to a submitted form, giving 400 submissions. If 70% confirm, 280 people join each month. The rates here are assumptions for the example, and real figures will vary widely. After six months the NGO has about 1,700 confirmed subscribers, before unsubscribes and bounces.
The NGO then compares placements, finds that story-end forms convert best, and notices confirmation emails landing in spam, which sends it back to fix DKIM. It also records the wording version per subscriber.
A launch checklist
- Signup form placed in at least three places, tested on mobile
- Consent line is specific, unticked and linked to the privacy notice
- Privacy notice lists data, purpose, rights, grievance contact
- Double opt-in email works and expires links
- Consent record stored with wording version and timestamps
- Preference centre reachable without login
- Unsubscribe link and List-Unsubscribe header in every marketing email
- CRM and email tool sync both ways, including unsubscribes
- SPF, DKIM and DMARC published; Postmaster Tools set up
- Welcome email written, with no donation ask
- GA4 event fires on confirmation, with a placement parameter
Working with Govindani Infotech on newsletter and donor signup set-up
If you are planning a wider NGO site, our NGO website page describes how we approach donation and engagement sites.
Govindani Infotech is a Pune-based web development company at 2nd Floor, Landmark Plaza, 206 Satara Road, Parvati Paytha, Pune 411009. We build NGO websites, CRM systems, WhatsApp automation and e-commerce sites, and a newsletter programme is often one piece of a larger NGO website or CRM project. If you want signup forms, consent records, a preference centre and a CRM connection planned together, send us your current website address and a note on the streams you want to run. You can request a quotation on WhatsApp at wa.me/919201958278 or through our contact page, and we will reply with questions before we propose anything.
Frequently Asked Questions
Do NGOs in India need consent to send a newsletter?
If the email address identifies a person, it is personal data, and the DPDP Act, 2023 expects consent that is free, specific, informed, unconditional and unambiguous, given through a clear affirmative action. In practice, an unticked box with a clear purpose and a link to your notice meets that spirit. Check dates and exceptions with a legal adviser.
Is double opt-in mandatory under the DPDP Act?
The Act does not name double opt-in. It is a good practice that confirms the address belongs to the person and gives you a second timestamp for your consent record. Most NGOs find the cleaner list worth the small drop in signups.
Do I need SPF, DKIM and DMARC for a small NGO newsletter?
Google asks all senders to Gmail to set up SPF or DKIM, and bulk senders sending more than 5,000 messages a day to also publish DMARC. Even if you send less, setting up all three helps your mail reach inboxes. Start DMARC at p=none and review reports.
How often should an NGO send its newsletter?
Monthly is a workable starting point for a small team, with occasional event emails to people who opted in. Whatever you choose, state it on the signup form and keep to it. Let people choose less frequent options in the preference centre.
How do I track newsletter signups in GA4?
Send a GA4 event, such as generate_lead or a custom newsletter_signup, when a subscriber confirms. Add a parameter for the placement of the form so you can compare footer, post and event signups. Never send email addresses or names to GA4.
Sources: Google Email sender guidelines, Yahoo Sender Best Practices, Google Analytics recommended events, Digital Personal Data Protection Act, 2023 (MeitY), JSA Prism: DPDP Rules, November 2025, DSCI consent management FAQ