Data protection · Provision
Before collecting personal data a Data Fiduciary must give a clear notice of what it collects, why, and how consent can be withdrawn. No notice means no lawful collection. (Section 5, Digital Personal Data Protection Act, 2023.) Comes into force on 13 May 2027 · Text checked against India Code on 25 October 2026.
Quick Statutory Answer
Under Section 5 of the DPDP Act 2023, every Data Fiduciary must give an itemised, plain-language consent notice before or at the time of seeking personal data consent. The notice must specify the personal data to be collected, the exact purpose of processing, how consent may be withdrawn, how grievances can be raised, and how a complaint can be made to the Data Protection Board. A generic privacy policy does not substitute for a Section 5 notice.
5. Notice.— (1) Every request made to a Data Principal under section 6 for consent shall be accompanied or preceded by a notice given by the Data Fiduciary to the Data Principal, informing her,— (i) the personal data and the purpose for which the same is proposed to be processed; (ii) the manner in which she may exercise her rights under sub-section (4) of section 6 and section 13; and (iii) the manner in which the Data Principal may make a complaint to the Board, in such manner and as may be prescribed. Illustration. X, an individual, opens a bank account using the mobile app or website of Y, a bank. To complete the Know-Your-Customer requirements under law for opening of bank account, X opts for processing of her personal data by Y in a live, video-based customer identification process. Y shall accompany or precede the request for the personal data with notice to X, describing the personal data and the purpose of its processing. (2) Where a Data Principal has given her consent for the processing of her personal data before the date of commencement of this Act,— (a) the Data Fiduciary shall, as soon as it is reasonably practicable, give to the Data Principal a notice informing her,— (i) the personal data and the purpose for which the same has been processed; (ii) the manner in which she may exercise her rights under sub-section (4) of section 6 and section 13; and (iii) the manner in which the Data Principal may make a complaint to the Board, in such manner and as may be prescribed. (b) the Data Fiduciary may continue to process the personal data until and unless the Data Principal withdraws her consent. Illustration. X, an individual, gave her consent to the processing of her personal data for an online shopping app or website operated by Y, an e-commerce service provider, before the commencement of this Act. Upon commencement of the Act, Y shall, as soon as practicable, give through email, in-app notification or other effective method information to X, describing the personal data and the purpose of its processing. (3) The Data Fiduciary shall give the Data Principal the option to access the contents of the notice referred to in sub-sections (1) and (2) in English or any language specified in the Eighth Schedule to the Constitution.
| Mandatory Notice Item | Statutory Requirement (s.5) | Non-Compliant Practice | Compliant Implementation |
|---|---|---|---|
| Personal Data Categories | Itemise exact data fields collected | Vague phrase: "such other information" | Explicit list: Name, email, mobile, PAN, IP |
| Specified Purpose | State precise processing objective | Broad catch-all: "to improve our services" | Distinct purpose: "to process payment and issue invoice" |
| Withdrawal Path | Describe clear withdrawal mechanism | Requiring a written registered post letter | In-app or 1-click toggle matching consent ease |
| Grievance Redressal | Publish name & contact of DPO/Grievance Officer | Generic unmonitored mailbox (info@) | Named officer email with statutory turnaround |
| Language Accessibility | English or any Eighth Schedule language | English-only form for regional app users | Language selector offering user preferred regional tongue |
Processing is unlawful. Collection without a proper notice is a breach of the Act and may engage the penalty schedule under section 33.
A notice required under section 5 of the Digital Personal Data Protection Act, 2023, given before or at the time of collecting personal data. It must state what personal data is collected, the specific purpose, how to withdraw consent, how to raise a grievance, and how to complain to the Data Protection Board. It must be in plain language in English or any Eighth Schedule language.
Under section 5, the consent notice must: (1) identify the personal data being collected; (2) state the purpose of processing; (3) describe how consent may be withdrawn; (4) describe how a grievance may be raised; and (5) describe how a complaint may be made to the Board. It must be in clear and plain language, not buried in a longer document.
Not on its own. A privacy policy is a disclosure document; a consent notice under section 5 is a specific, itemised communication given before or at the point of collection. Linking to a policy without the required elements in the notice does not satisfy section 5.
Collection without a section 5-compliant notice is processing without valid consent. The Data Protection Board can investigate and impose penalties under the Schedule, with ceilings up to ₹250 crore for the most serious failures.
Similar in purpose, different in structure. The DPDP Act does not replicate GDPR's six lawful bases — consent and certain legitimate uses are the only two grounds in India (section 4). The notice format, language requirements and grievance path are India-specific. A GDPR-format notice does not satisfy section 5.
Before every collection of personal data: signup forms, order flows, CCTV systems, HR files, contact forms — any point where a name, phone number, email, address, photograph or any identifier is taken from a natural person in India.
On 13 May 2027. Notification G.S.R. 843(E) of 13 November 2025 brought the Act into force in three stages: the definitions and the Data Protection Board that day; Consent Manager registration one year later; and, eighteen months later, the provisions that carry the obligations and the penalties — sections 3 to 5, most of section 6, sections 7 to 17 and 27 to 34. Section 5 is in the last group.
Maintains the law explainers, calculators, templates and blog posts on vidhisar.in: checks them against the statute text and updates them when the law changes. Errors and changes in the law can be reported to legal@vidhisar.in.
The section in its own words, with a plain-English explanation of what it requires. Not legal advice: take advice on anything turning on your own facts.