Section 5 of Digital Personal Data Protection Act, 2023 - Notice

Section 5 of the Digital Personal Data Protection Act, 2023 deals with the notice that a Data Fiduciary must give to a Data Principal in connection with consent-based processing of digital personal data.

Commencement update: The Central Government notification dated 13 November 2025 provides that sections 3 to 5 of the Act come into force eighteen months from publication of that notification. Rule 3 of the Digital Personal Data Protection Rules, 2025, which prescribes the detailed form and content of the notice, also comes into force eighteen months from publication of the Rules. Accordingly, as on 24 September 2026, these provisions have been notified but their scheduled commencement date has not yet arrived.

Meaning and purpose of Section 5

The notice requirement is intended to enable a Data Principal to understand what personal data is proposed to be processed, why it is required, how consent may be withdrawn and rights exercised, and how a complaint may be made to the Data Protection Board of India.

Section 5(1): Notice before or with a request for consent

Where a Data Fiduciary requests consent under section 6, the request must be accompanied or preceded by a notice. The notice is required to inform the Data Principal about:

  1. the personal data proposed to be processed and the purpose for which it is proposed to be processed;
  2. the manner in which the Data Principal may exercise the right to withdraw consent under section 6(4) and the right of grievance redressal under section 13; and
  3. the manner in which a complaint may be made to the Data Protection Board of India, in the prescribed manner.
Illustration in the Act: Where an individual uses a bank's app or website and chooses a live video-based identification process for KYC, the bank must accompany or precede its request for personal data with a notice describing the personal data and the purpose of processing.

Section 5(2): Consent given before commencement

Section 5 also addresses personal data for which consent was given before commencement of the Act. As soon as reasonably practicable, the Data Fiduciary must give the Data Principal a notice stating the personal data and purpose for which it has been processed, how the Data Principal may exercise the relevant rights, and how a complaint may be made to the Board.

Subject to the Act, the Data Fiduciary may continue processing such personal data until the Data Principal withdraws consent.

Illustration in the Act: If an individual consented to processing by an e-commerce service before commencement, the service provider is required, as soon as practicable after commencement, to provide the prescribed information through an effective method such as email or an in-app notification.

Section 5(3): Language of the notice

The Data Fiduciary must give the Data Principal an option to access the contents of the notice in English or in any language specified in the Eighth Schedule to the Constitution of India.

Rule 3 of the Digital Personal Data Protection Rules, 2025

The final Digital Personal Data Protection Rules, 2025 were notified in November 2025. Rule 3 supplements section 5 and requires the notice to be independently understandable and written in clear and plain language. At a minimum, it must provide an itemised description of the personal data and the specified purpose or purposes of processing, together with a specific description of the goods, services or uses enabled by that processing.

The notice must also provide a particular communication link for the Data Fiduciary's website or app, or both, and describe other available means through which the Data Principal may withdraw consent, exercise rights under the Act and make a complaint to the Board.

Important terms

Data Principal

Under section 2, a Data Principal is the individual to whom the personal data relates. The statutory definition also covers the parent or lawful guardian in specified cases involving a child or a person with disability.

Data Fiduciary

A Data Fiduciary is any person who, alone or together with other persons, determines the purpose and means of processing personal data.

Personal data

Personal data means any data about an individual who is identifiable by or in relation to such data.

Consent

Section 6 requires consent to be free, specific, informed, unconditional and unambiguous, with a clear affirmative action, and limited to personal data necessary for the specified purpose. The Data Principal must also be able to withdraw consent with ease comparable to the ease with which consent was given.

Practical compliance points

  • Give the notice before or at the same time as the consent request, as applicable.
  • Identify the personal data in an itemised and understandable manner.
  • State the specific purpose of processing and the relevant goods, services or uses.
  • Provide an accessible route for withdrawal of consent and exercise of statutory rights.
  • Explain how a complaint may be made to the Data Protection Board of India.
  • Provide the required language choice.
  • Review implementation dates before treating the substantive obligations as legally commenced.

This page is an explanatory article. For authoritative legal text and commencement dates, refer to the Act, the Rules and notifications published by the Government of India.