/The Act · Chapter II · Obligations of Data Fiduciary
Section 5: Notice
DPDP Act, 2023 (No. 22 of 2023). Comes into force on 13 May 2027.
- Provision
- Section 5 of The Digital Personal Data Protection Act, 2023
- Status
- Comes into force on 13 May 2027 (phase 3) G.S.R. 843(E)
- Rules made under it
- Rule 3
- Source
- Ministry of Law and Justice (Legislative Department) · 11 August 2023 · Official PDF
Every request made to a Data Principal under section 6 for consent shall be accompanied or preceded by a notice given by the Data Fiduciary to the Data Principal, informing her,—
the manner in which she may exercise her rights under sub-section (4) of section 6 and section 13; and
in such manner and as may be prescribed.
Where a Data Principal has given her consent for the processing of her personal data before the date of commencement of this Act,—
the Data Fiduciary shall, as soon as it is reasonably practicable, give to the Data Principal a notice informing her,––
the manner in which she may exercise her rights under sub-section (4) of section 6 and section 13; and
in such manner and as may be prescribed.
the Data Fiduciary may continue to process the personal data until and unless the Data Principal withdraws her consent.
The Data Fiduciary shall give the Data Principal the option to access the contents of the notice referred to in sub-sections (1) and (2) in English or any language specified in the Eighth Schedule to the Constitution.
When a Data Fiduciary (the person or entity deciding how and why data is processed) asks a Data Principal (the individual to whom the data relates) for consent, it must provide a clear notice. This notice must be given at the same time as or before the request for consent. The notice must explain exactly what personal data will be processed and for what purpose. It must also tell the Data Principal how they can exercise their rights, such as withdrawing consent or seeking grievance redressal, and how to make a complaint to the Board (the regulatory body). The exact format of this notice will be set by future rules.
If a Data Principal already gave their consent before this Act started, the Data Fiduciary must still provide a similar notice. This past-consent notice must be sent "as soon as it is reasonably practicable." The Data Fiduciary is allowed to continue processing this previously collected personal data until the Data Principal decides to withdraw their consent.
The Data Fiduciary must give the Data Principal a choice of languages for reading these notices. The notice must be made available in English or any of the languages listed in the Eighth Schedule to the Constitution.
Key points
- A Data Fiduciary must provide a notice before or alongside any request for consent to process personal data (1).
- The notice must state the personal data to be processed, the purpose, how to exercise rights, and how to complain to the Board (1).
- For consent obtained before the Act commenced, the Data Fiduciary must send a similar notice as soon as reasonably practicable (2)(a).
- Data Fiduciaries can continue processing data collected before the Act commenced until the Data Principal withdraws consent (2)(b).
- The notice must be offered in English or any language specified in the Eighth Schedule to the Constitution (3).
Common misreadings
- Assuming Data Fiduciaries must immediately stop processing data collected before the Act until a new notice is sent; the text explicitly allows processing to continue until the Data Principal withdraws consent.
- Believing the notice only needs to state what data is collected and why; it must also explain how to exercise rights and how to complain to the Board.
Interpretation prepared from the official text only, 9 September 2026. The official text above prevails.
/MYND · DPDP practice
Putting this into practice?
MYND runs DPDP compliance programmes for the data that flows through HR, payroll, finance and vendor operations: readiness assessments, consent and notice design, processor contracts and breach playbooks. Tell us what you are working on and a compliance lead will reply within one working day.