Section 5 — Notice

What this section requires

Before (or together with) asking for consent under Section 6, a Data Fiduciary must give the Data Principal a notice: what personal data will be processed and for what purpose, how she can exercise her withdrawal right under Section 6(4) and her rights under Section 13, and how she can complain to the Board.

For consent already collected before the Act commenced, the Data Fiduciary must still send an equivalent notice as soon as reasonably practicable — covering what was processed and why, plus the same rights and complaint information — and may keep processing on that pre-existing consent until it's withdrawn.

Either way, the Data Principal must be given the option to read the notice in English or in any language listed in the Eighth Schedule to the Constitution.

Who it applies to

Every Data Fiduciary that relies on Data Principal consent as its ground for processing under Section 4 — notice is tied to consent, not to every processing activity generally.

Checklist

• Issue the notice before or together with the consent request — not as an afterthought once processing has started.
• Cover, at minimum: an itemised description of the personal data, the specific purpose, how to withdraw consent, how to exercise Section 13 rights, and how to complain to the Board.
• For consent already held from before commencement, send the equivalent retrospective notice as soon as reasonably practicable — don't wait for a trigger event.
• Offer the notice in English or an Eighth Schedule language, on request.
• Rule 3 adds detail once it takes effect: the notice must stand independently of any other information the Data Fiduciary provides, and must give the actual communication link (not just a description) for the website or app where the Data Principal can withdraw consent, exercise her rights, or complain to the Board.

Penalty exposure

No Schedule item names Section 5 by number. A defective or missing notice falls under the Schedule's residual item 7 — "breach of any other provision of this Act or the rules made thereunder" — up to ₹50 crore.

Implementation timeline

Not yet in force. Commences 13 May 2027, eighteen months after the DPDP Rules, 2025 were published (13 November 2025) — per the commencement notification G.S.R. 843(E).