Readiness assessment
The Act
The DPDP Act, explainedThe DPDP Rules 2025

Ch IPreliminary

S.1 Short title and commencementS.2 DefinitionsS.3 Application and scope

Ch IIObligations of Data Fiduciary

S.4 Grounds for processingS.5 NoticeS.6 ConsentS.7 Certain legitimate usesS.8 Data Fiduciary obligationsS.9 Children’s dataS.10 Significant Data Fiduciary

Ch IIIRights and duties of Data Principal

S.11 Right to accessS.12 Correction and erasureS.13 Grievance redressalS.14 Right to nominateS.15 Duties of the Data Principal

Ch IVSpecial provisions

S.16 Transfer outside IndiaS.17 Exemptions

Ch VData Protection Board of India

S.18 Establishment of the BoardS.19 Composition of the BoardS.20 Salary and term of officeS.21 DisqualificationsS.22 Resignation and vacanciesS.23 Proceedings of the BoardS.24 Officers and employeesS.25 Members as public servantsS.26 Powers of the Chairperson

Ch VIBoard powers and procedure

S.27 Powers and functions of the BoardS.28 Procedure followed by the Board

Ch VIIAppeal and dispute resolution

S.29 Appeal to the Appellate TribunalS.30 Tribunal orders as a decreeS.31 Alternate dispute resolutionS.32 Voluntary undertaking

Ch VIIIPenalties

S.33 Penalties and the ScheduleS.34 Penalties to Consolidated Fund

Ch IXMiscellaneous

S.35 Good-faith protectionS.36 Power to call for informationS.37 Blocking of accessS.38 Consistency with other lawsS.39 Bar of jurisdictionS.40 Power to make rulesS.41 Laying of rules before ParliamentS.42 Power to amend the ScheduleS.43 Power to remove difficultiesS.44 Amendments to other Acts
Industries
Fintech & BFSIPayments & UPIUPIWalletsLendingBNPLLSPsKYCVideo-KYCAadhaar eKYCWealthtechInsurTechHealth insuranceDebt collectionsBanksNBFCsNGOsHealthcare & PharmaHospitalsDiagnostic labsGenetic testingPharmaClinical trialsTelemedicineE-commerce & RetailD2CMarketplacesLogisticsLoyalty & CRMGCCsSaaS & TechnologyAI & MLFoundation modelsB2B SaaSCloudDeveloper toolsEdTech & EducationSchoolsCoachingLMSProctoringChildren-directed appsGovernment & PSUe-GovernancePublic servicesUtilitiesManufacturingAutomotiveDealersIndustrialIoTMedia & EntertainmentAdTechGamingOTTPublishingSocial mediaBrowse all sectors
Implementation
All 17 DPDP servicesFintech & digital lendingGCC & global centresDPDP Compliance AssessmentFind where you stand and your gapsDPDP ImplementationTurn the rules into daily practiceData MappingKnow what data you hold, and whereRoPAYour record of processing activitiesPrivacy AuditIndependent check of your controlsDPO ServicesOutsourced or part-time DPOSDF ReadinessCheck for extra SDF dutiesConsent ManagementCapture, track and withdraw consentNotice & Consent RemediationFix notices and consent flowsData Principal RightsHandle access, correction, erasureRetention & DeletionWhat to keep, how long, how to deleteVendor & Processor ManagementControl third parties handling dataChildren's DataRules for handling minors' dataSecurity SafeguardsTechnical and organisational controlsBreach ResponseWhat to do when a breach happensPrivacy Operations SupportKeep the programme runningDPDP TrainingTrain staff, legal and leaders
Training
All DPDP Act trainingEmployee awarenessCorporate trainingLeadership briefingDPO and certification
Resources
Readiness assessmentGuidesBy roleGlossaryCompareNews
About
AboutEditorial policyContactFAQ
Readiness assessment
Share this section

Chapter II · Obligations of Data Fiduciary

Section 5: Notice

Section 5 requires that, before or when you ask for consent, you give the Data Principal a clear notice: what data, what purpose, how to exercise rights, and how to complain to the Board.

Official text
Section 5Notice
Chapter
Chapter II · Obligations of Data Fiduciary
Status
Enacted · phased commencement
Full compliance
13 May 2027
Applies to
Data Fiduciaries
Official citation
DPDP Act, 2023, s.5
Reading time
5 min
Updated
August 2026

At a glance

Section 5 requires a Data Fiduciary relying on consent to give the Data Principal a notice, before or at the time of the consent request, setting out the personal data and the purpose of processing, how she can exercise her rights (including withdrawing consent) and how she can complain to the Data Protection Board. For consent obtained before the Act, a notice must be given as soon as reasonably practicable. The notice must be available in English or any Eighth Schedule language.

Applies to Data FiduciariesChapter Chapter IIEffective 13 May 2027Read time 5 min

Section 5: key takeaways

  • A notice must accompany or precede every request for consent.
  • It must state the personal data and the purpose for which it will be processed.
  • It must explain how to withdraw consent and exercise other rights, and how to complain to the Board.
  • For consent given before the Act, a notice must follow as soon as reasonably practicable.
  • It must be available in English or any Eighth Schedule language.
  • The detailed contents are set by Rule 3 of the DPDP Rules, 2025.

Who Section 5 applies to

Read this if you collect personal data on the basis of consent, it defines the single most visible compliance artefact your users will see.

FoundersLegal / DPOCompliance leadsProduct / engineering

Section 5 in plain language

The notice is the moment of honesty in the Act. Before, or at the time, you ask someone to consent, you must tell them plainly what data you want and why. It is a separate, focused thing, not a link to a twenty-page privacy policy.

Beyond purpose, the notice must show the person how to take back control: how to withdraw consent, how to exercise their rights, and how to complain to the Data Protection Board. Rule 3 of the DPDP Rules, 2025 sets out the itemised contents.

Two practical points. If you obtained consent before the Act commenced, you still owe a notice as soon as reasonably practicable, and may keep processing until the person withdraws. And the notice must be offered in English or any language in the Eighth Schedule to the Constitution.

Section 5 of the DPDP Act: full text

Section 5: Notice

5(1) Every request for consent shall be accompanied or preceded by a notice given by the Data Fiduciary to the Data Principal, informing her of (i) the personal data and the purpose for which it is proposed to be processed; (ii) the manner in which she may exercise her rights to withdraw consent and to grievance redressal; and (iii) the manner in which she may make a complaint to the Board.

5(2) Where a Data Principal has given consent before the commencement of this Act, the Data Fiduciary shall, as soon as reasonably practicable, give her a notice with the above information; the Data Fiduciary may continue processing until she withdraws her consent.

5(3) The Data Fiduciary shall give the Data Principal the option to access the contents of the notice in English or any language specified in the Eighth Schedule to the Constitution of India.

Wording reproduced or summarised from the enacted Act. Always confirm against the official Gazette text for authoritative language.

What Section 5 means for your business

Frequently asked questions about Section 5

What must a Section 5 notice contain?
The personal data and the purpose of processing, how to withdraw consent and exercise rights, and how to complain to the Data Protection Board. Rule 3 of the DPDP Rules, 2025 itemises the contents.
Is the notice the same as my privacy policy?
No. The notice is served at the point of collection and is focused on the specific data, purpose, rights and complaint route. A privacy policy is broader and complements it.
What about consent I collected before the Act?
You must give a notice as soon as reasonably practicable, and may continue processing until the person withdraws consent.
In what languages must the notice be available?
English or any language listed in the Eighth Schedule to the Constitution.

Sources

Related sections
Section 6: ConsentSection 4: GroundsNotice (glossary)Chapter II overview

This is an educational explanation, not legal advice. dpdpactindia.in is an independent resource and is not affiliated with the Government of India.

Start readiness assessment