Section 5: Notice

Statutory Text (Official Gazette)

(1) Every request made to a Data Principal under section 6 for consent shall be accompanied or preceded by a notice given by the Data Fiduciary to the Data Principal, informing her,—

• (i) the personal data and the purpose for which the same is proposed to be processed;
• (ii) the manner in which she may exercise her rights under sub-section (4) of section 6 and section 13; and
• (iii) the manner in which the Data Principal may make a complaint to the Board,

in such manner and as may be prescribed.

Illustration.—X, an individual, opens a bank account using the mobile app or website of Y, a bank. To complete the Know-Your-Customer requirements under law for opening of bank account, X opts for processing of her personal data by Y in a live, video-based customer identification process. Y shall accompany or precede the request for the personal data with notice to X, describing the personal data and the purpose of its processing.

(2) Where a Data Principal has given her consent for the processing of her personal data before the date of commencement of this Act,—

• (a) the Data Fiduciary shall, as soon as it is reasonably practicable, give to the Data Principal a notice informing her,—

  • (i) the personal data and the purpose for which the same has been processed;
  • (ii) the manner in which she may exercise her rights under sub-section (4) of section 6 and section 13; and
  • (iii) the manner in which the Data Principal may make a complaint to the Board,

  in such manner and as may be prescribed.

• (b) the Data Fiduciary may continue to process the personal data until and unless the Data Principal withdraws her consent.

(3) The Data Fiduciary shall give the Data Principal the option to access the contents of the notice referred to in sub-sections (1) and (2) in English or any language specified in the Eighth Schedule to the Constitution.

What Section 5 Means in Plain English

You cannot show a generic, one-line banner saying “We use cookies to enhance your experience, click OK to continue.”

Section 5 requires a notice that comes with or before every consent request. Read together with Rule 3 of the DPDP Rules 2025, which takes effect on May 13, 2027, the notice must cover:

1. Itemised data and purposes: Rule 3 requires “an itemised description” of the personal data and the specified purpose for it (e.g., IP address, device identifier, name, phone number), plus a description of the goods, services or uses the processing enables. The notice must make sense on its own, without depending on your privacy policy or terms.
2. How to withdraw consent and use other rights: The notice must explain how to withdraw consent under Section 6(4) and how to raise a grievance under Section 13. Rule 3 adds a direct link to your website or app for doing this.
3. How to complain to the Board: The notice must tell the user how to make a complaint to the Data Protection Board of India.
4. Contact person (from Section 6(3)): The consent request itself must give the contact details of a Data Protection Officer, where applicable, or another person authorised to respond. This duty sits in Section 6(3), not Section 5, but in practice it goes in the same notice.
5. Notice for existing users: If you got consent before the Act came into force, sub-section (2) requires you to send existing users the same notice “as soon as it is reasonably practicable”. You may keep processing their data until they withdraw consent.

Engineering & Website Checklist

To comply with Section 5 on your website or mobile application:

• Itemised notice modal: Configure your cookie banner or signup form to display itemised purpose tables instead of a single wall of text.
• Grievance contact in banner: Include a link or section disclosing the designated privacy officer or email address (e.g., privacy@yourcompany.com).
• Link to statutory complaint mechanism: Mention the user’s right to complain to the Data Protection Board of India.
• Language option: Give users the option to read the notice in English or any Eighth Schedule language they choose.

How ConsentPlix Solves Section 5

ConsentPlix automates Section 5 notice generation out of the box:

• Dynamic purpose tables: Breaks down tracking cookies and scripts into clear, human-readable purposes (Strictly Necessary, Analytics, Advertising, Functional).
• Auto-generated privacy notices: Inserts your company’s DPO contacts, withdrawal mechanics, and Board complaint disclosures automatically.
• 22 language support: Instant localization across English, Hindi, Tamil, Telugu, Marathi, and all official regional languages.