Section 5: Notice
Section 5 requires that consent never be collected blind: every consent request must come with a notice telling the Data Principal what data is being collected, why, how to exercise their rights, and how to complain. It also covers organisations whose users already consented before the Act's obligations took effect.
Quick summary
What Section 5 says
- Sub-section (1) — every consent request under Section 6 must be accompanied or preceded by a notice, in the prescribed manner, telling the Data Principal (i) the personal data and purpose for which it's to be processed; (ii) how she may exercise her rights under Section 6(4) (withdrawal) and Section 13 (grievance redressal); and (iii) how she may complain to the Board.
- Sub-section (2) — where consent was given before this section's commencement, the Fiduciary shall, as soon as reasonably practicable, (a) give the Data Principal a notice with the same three elements as above, and (b) may continue processing until and unless the Data Principal withdraws consent.
- Sub-section (3) — the Data Fiduciary shall give the Data Principal the option to access the notice's contents in English, or any language listed in the Eighth Schedule to the Constitution.
Breaking it down
Notice is a precondition, not an afterthought. The notice under sub-section (1) has to come with or before the consent request — not buried in a privacy policy discovered later. The Act's own illustration is a bank's video KYC process: when the bank asks for consent to process personal data as part of live, video-based identification, that request must be accompanied by notice describing the data and the purpose.
Three fixed ingredients, every time. Whatever the context, a valid notice always needs the same three things:
- 01
What & why
The personal data being collected and the purpose it will be processed for.
- 02
How to act
How to withdraw consent (Section 6(4)) or raise a grievance (Section 13).
- 03
How to escalate
How to complain to the Data Protection Board if that doesn't resolve things.
The transition problem, and how sub-section (2) solves it. Millions of people had already “consented” to countless apps and services long before this section existed. Sub-section (2) doesn't require Fiduciaries to go back and re-collect consent from scratch — it requires sending the required notice retrospectively, as soon as reasonably practicable, while letting processing continue on the strength of the original consent unless and until it's withdrawn. The Act's own illustration: an e-commerce platform whose users consented before commencement must, as soon as practicable, inform them through email, in-app notification or another effective method, describing the data and purpose.
Language access isn't optional. Sub-section (3) requires the Data Principal be able to access the notice in English or any of the 22 languages listed in the Eighth Schedule to the Constitution — a meaningful accessibility requirement, not a footnote.
Why this section matters
Consent collected without proper notice isn't meaningfully informed consent — and Section 6(1) specifically requires consent to be “informed.” Section 5 is what makes that requirement concrete: it defines exactly what information has to reach the Data Principal, and when. Get the notice wrong, and the consent built on top of it is vulnerable too.
Real-world example
Vantra Insurance, rolling out a new health-data-sharing feature to existing policyholders
Vantra has 2 million existing policyholders who signed up years before Section 5 took effect, and wants to launch a feature sharing claims data with a partner hospital network.
- For existing policyholders' original data — under sub-section (2), Vantra sends a retrospective notice via email and in-app banner describing what data it holds and why, and how to withdraw consent or complain — existing processing continues unless a policyholder acts on it.
- For the new hospital-data-sharing feature — this is a new purpose, so it needs its own fresh consent request under Section 6, accompanied by its own Section 5 notice specific to that sharing — the retrospective notice for the original purpose doesn't cover it.
- For a policyholder who only reads Tamil — under sub-section (3), Vantra must make the notice available in Tamil (an Eighth Schedule language) or English, not force it on them in a language they can't read.
Who needs to care about this section
- Product and legal teams designing consent flows — the notice has to sit alongside the consent request itself, with all three required elements, not live only in a separate privacy policy.
- Any organisation with users who consented before this section's commencement — the retrospective notice obligation under sub-section (2) applies regardless of how long ago consent was originally given.
- Localisation and accessibility teams — sub-section (3)'s language requirement needs to be built into the notice infrastructure itself, not treated as a translation nice-to-have.
Common questions
Is a privacy policy the same thing as the notice required by Section 5?
Do we need to renotify every user who already consented before the Act's obligations took effect?
Does the notice have to be a separate document from the consent request itself?
Related sections
Section 6 — Consent
Continue to the next section in sequence.
Read Section 6Section 4 — Grounds for Processing Personal Data
Go back to the previous section.
Read Section 4Chapter II — Obligations of Data Fiduciary
See every section in this chapter together.
View the chapterFull DPDP Act Guide
Back to the overview page, with the complete section-by-section guide.
View all 44 sections