Chapter II · Obligations of Data Fiduciary
Section 5: Notice
Section 5 requires that, before or when you ask for consent, you give the Data Principal a clear notice: what data, what purpose, how to exercise rights, and how to complain to the Board.
- Chapter
- Chapter II · Obligations of Data Fiduciary
- Status
- Enacted · phased commencement
- Full compliance
- 13 May 2027
- Applies to
- Data Fiduciaries
- Official citation
- DPDP Act, 2023, s.5
- Reading time
- 5 min
- Updated
- August 2026
At a glance
Section 5 requires a Data Fiduciary relying on consent to give the Data Principal a notice, before or at the time of the consent request, setting out the personal data and the purpose of processing, how she can exercise her rights (including withdrawing consent) and how she can complain to the Data Protection Board. For consent obtained before the Act, a notice must be given as soon as reasonably practicable. The notice must be available in English or any Eighth Schedule language.
Key takeaways
- A notice must accompany or precede every request for consent.
- It must state the personal data and the purpose for which it will be processed.
- It must explain how to withdraw consent and exercise other rights, and how to complain to the Board.
- For consent given before the Act, a notice must follow as soon as reasonably practicable.
- It must be available in English or any Eighth Schedule language.
- The detailed contents are set by Rule 3 of the DPDP Rules, 2025.
Who should read this
Read this if you collect personal data on the basis of consent, it defines the single most visible compliance artefact your users will see.
In plain language
The notice is the moment of honesty in the Act. Before, or at the time, you ask someone to consent, you must tell them plainly what data you want and why. It is a separate, focused thing, not a link to a twenty-page privacy policy.
Beyond purpose, the notice must show the person how to take back control: how to withdraw consent, how to exercise their rights, and how to complain to the Data Protection Board. Rule 3 of the DPDP Rules, 2025 sets out the itemised contents.
Two practical points. If you obtained consent before the Act commenced, you still owe a notice as soon as reasonably practicable, and may keep processing until the person withdraws. And the notice must be offered in English or any language in the Eighth Schedule to the Constitution.
The text of the law
Section 5: Notice
5(1) Every request for consent shall be accompanied or preceded by a notice given by the Data Fiduciary to the Data Principal, informing her of (i) the personal data and the purpose for which it is proposed to be processed; (ii) the manner in which she may exercise her rights to withdraw consent and to grievance redressal; and (iii) the manner in which she may make a complaint to the Board.
5(2) Where a Data Principal has given consent before the commencement of this Act, the Data Fiduciary shall, as soon as reasonably practicable, give her a notice with the above information; the Data Fiduciary may continue processing until she withdraws her consent.
5(3) The Data Fiduciary shall give the Data Principal the option to access the contents of the notice in English or any language specified in the Eighth Schedule to the Constitution of India.
Wording reproduced or summarised from the enacted Act. Always confirm against the official Gazette text for authoritative language.
What this means for you
- Serve a short, standalone notice at the point of collection, not buried in a policy.
- List specific purposes, not vague ones like "business purposes".
- Give an easy withdrawal path and a named grievance route.
- Offer the notice in the required languages, and keep a record of what was shown.
- Use the notice how-to guide and the build-a-consent-notice workflow.
Frequently asked questions
What must a Section 5 notice contain?
Is the notice the same as my privacy policy?
What about consent I collected before the Act?
In what languages must the notice be available?
Sources
- Digital Personal Data Protection Act, 2023Ministry of Electronics and IT (MeitY)
- DPDP Rules, 2025Notified 13–14 November 2025
This is an educational explanation, not legal advice. dpdpactindia.in is an independent resource and is not affiliated with the Government of India.