--- title: "Section 5: Notice" url: https://dpdp.myndsolution.com/wiki/act/section-5-notice/ description: "Section 5 of the Digital Personal Data Protection Act, 2023 (Notice). Official text verbatim, comes into force on 13 may 2027, with plain-English…" kind: act-section updated: 2026-09-09 official_source: https://www.meity.gov.in/static/uploads/2024/06/2bf1f0e9f04e6fb4f8fef35e82c42aa5.pdf text_type: official-text-plus-interpretation publisher: MYND Integrated Solutions license: Official Government of India texts are reproduced verbatim (public domain / open government data). Interpretation is CC BY 4.0, MYND Integrated Solutions. disclaimer: Not legal advice. Official text prevails over any interpretation. html_version: https://dpdp.myndsolution.com/wiki/act/section-5-notice/ --- # Section 5: Notice *The Digital Personal Data Protection Act, 2023 (No. 22 of 2023), Chapter II: OBLIGATIONS OF DATA FIDUCIARY. Comes into force on 13 May 2027.* ## Official text - **(1)** Every request made to a Data Principal under section 6 for consent shall be accompanied or preceded by a notice given by the Data Fiduciary to the Data Principal, informing her,— - **(i)** the personal data and the purpose for which the same is proposed to be processed; - **(ii)** the manner in which she may exercise her rights under sub-section (4) of section 6 and section 13; and - **(iii)** the manner in which the Data Principal may make a complaint to the Board, in such manner and as may be prescribed. > **Illustration.** X, an individual, opens a bank account using the mobile app or website of Y, a bank. To complete the Know-Your-Customer requirements under law for opening of bank account, X opts for processing of her personal data by Y in a live, video-based customer identification process. Y shall accompany or precede the request for the personal data with notice to X, describing the personal data and the purpose of its processing. - **(2)** Where a Data Principal has given her consent for the processing of her personal data before the date of commencement of this Act,— - **(a)** the Data Fiduciary shall, as soon as it is reasonably practicable, give to the Data Principal a notice informing her,–– - **(i)** the personal data and the purpose for which the same has been processed; - **(ii)** the manner in which she may exercise her rights under sub-section (4) of section 6 and section 13; and - **(iii)** the manner in which the Data Principal may make a complaint to the Board, in such manner and as may be prescribed. - **(b)** the Data Fiduciary may continue to process the personal data until and unless the Data Principal withdraws her consent. > **Illustration.** X, an individual, gave her consent to the processing of her personal data for an online shopping app or website operated by Y, an e-commerce service provider, before the commencement of this Act. Upon commencement of the Act, Y shall, as soon as practicable, give through email, in-app notification or other effective method information to X, describing the personal data and the purpose of its processing. - **(3)** The Data Fiduciary shall give the Data Principal the option to access the contents of the notice referred to in sub-sections (1) and (2) in English or any language specified in the Eighth Schedule to the Constitution. ## Rules made under this section - [Rule 3: Notice given by Data Fiduciary to Data Principal](https://dpdp.myndsolution.com/wiki/rules/rule-3-notice-given-by-data-fiduciary-to-data-principal/) ## Interpretation in plain English (not legal advice) > This is a plain-English interpretation of the official text, prepared by the DPDP Wiki editorial team. It is not the law and not legal advice, and it may be incomplete or wrong. Always rely on the official text of the Act, the Rules and the notifications, and take advice from a qualified professional for your situation. When a Data Fiduciary (the person or entity deciding how and why data is processed) asks a Data Principal (the individual to whom the data relates) for consent, it must provide a clear notice. This notice must be given at the same time as or before the request for consent. The notice must explain exactly what personal data will be processed and for what purpose. It must also tell the Data Principal how they can exercise their rights, such as withdrawing consent or seeking grievance redressal, and how to make a complaint to the Board (the regulatory body). The exact format of this notice will be set by future rules. If a Data Principal already gave their consent before this Act started, the Data Fiduciary must still provide a similar notice. This past-consent notice must be sent "as soon as it is reasonably practicable." The Data Fiduciary is allowed to continue processing this previously collected personal data until the Data Principal decides to withdraw their consent. The Data Fiduciary must give the Data Principal a choice of languages for reading these notices. The notice must be made available in English or any of the languages listed in the Eighth Schedule to the Constitution. ### Key points - A Data Fiduciary must provide a notice before or alongside any request for consent to process personal data (1). - The notice must state the personal data to be processed, the purpose, how to exercise rights, and how to complain to the Board (1). - For consent obtained before the Act commenced, the Data Fiduciary must send a similar notice as soon as reasonably practicable (2)(a). - Data Fiduciaries can continue processing data collected before the Act commenced until the Data Principal withdraws consent (2)(b). - The notice must be offered in English or any language specified in the Eighth Schedule to the Constitution (3). ### Common misreadings - Assuming Data Fiduciaries must immediately stop processing data collected before the Act until a new notice is sent; the text explicitly allows processing to continue until the Data Principal withdraws consent. - Believing the notice only needs to state what data is collected and why; it must also explain how to exercise rights and how to complain to the Board. *Interpretation prepared 2026-09-09 from the official text only; the official text prevails.* --- Cite as: Digital Personal Data Protection Act, 2023, s. 5. Official source: https://www.meity.gov.in/static/uploads/2024/06/2bf1f0e9f04e6fb4f8fef35e82c42aa5.pdf