Section 5 explained: this guide covers what it means, who it applies to, the step-by-step process, documents required, fees, due dates and penalties in India — so you can stay compliant with confidence and avoid costly mistakes.
Every request for consent under section 6 must be accompanied or preceded by a notice from the Data Fiduciary. Section 5(1) says what the notice must tell the Data Principal, and section 5(3) gives her the option to read it in English or any language in the Eighth Schedule to the Constitution. Notice for consent given before commencement is in section 5(2) and has its own article. If your notice needs redrafting, a legal consultation is a practical starting point.
A notice must accompany or precede every consent request under section 6. It must tell the Data Principal (i) the personal data and the purpose of proposed processing, (ii) how to exercise her rights under section 6(4) (withdrawal) and section 13 (grievance), and (iii) how to complain to the Board, in the manner prescribed. She must be able to read it in English or any Eighth Schedule language (section 5(3)).
Section 5(1) and (3) at a glance
| Item | What the notice must contain or allow | Source |
|---|---|---|
| Personal data and purpose | The personal data and the purpose for which it is proposed to be processed | 5(1)(i) |
| Rights | The manner in which she may exercise her rights under section 6(4) and section 13 | 5(1)(ii) |
| Complaint | The manner in which she may make a complaint to the Board | 5(1)(iii) |
| Manner | "In such manner and as may be prescribed" | 5(1), closing words |
| Language | Option to access in English or any language in the Eighth Schedule | 5(3) |
| Timing | Accompanies or precedes every request for consent under section 6 | 5(1), opening words |
When the notice is required
Section 5(1) is tied to "every request made to a Data Principal under section 6 for consent". So the notice duty arises whenever consent is the ground for processing. The Act does not require the same notice for section 7 legitimate uses, which do not involve a consent request. The notice must accompany or precede the request. A notice sent after consent is obtained does not satisfy the section for that request.
What the three items mean
(i) Personal data and purpose. The notice must identify the personal data and the purpose. The purpose stated becomes the "specified purpose" under section 2(za), which then governs what consent can cover under section 6(1) and when erasure is due under section 8(7). Stating purposes in vague terms creates problems later because the specified purpose is taken from the notice.
(ii) How to exercise rights. The notice must say how the Data Principal may exercise two rights: the right to withdraw consent under section 6(4), and the right of grievance redressal under section 13. It does not list the rights in sections 11 (access), 12 (correction and erasure) or 14 (nomination) in this clause. A well-drafted notice may mention them, but the section text requires sections 6(4) and 13.
(iii) How to complain to the Board. The notice must explain the manner in which she may make a complaint to the Board. Section 13(3) requires her to exhaust the Data Fiduciary's grievance mechanism before approaching the Board, so the notice should make that sequence clear without adding detail the Act does not state.
"In such manner and as may be prescribed"
Section 5(1) ends with "in such manner and as may be prescribed". The form and manner of the notice are therefore left to the rules, and section 40(2)(a) lists this among the matters on which rules may be made. The DPDP Rules, 2025 (notified November 2025) prescribe the detail, and different provisions commence on different dates; check the Rules for the content and format. This article does not state what the Rules require.
The Illustration
The Act's Illustration describes X opening a bank account on Y bank's mobile app, with a live video-based identification process for the Know-Your-Customer requirements. Y must accompany or precede the request for the personal data with a notice describing the personal data and the purpose of its processing. The example shows that the notice goes with the request, not with the final contract, and that it must describe the data and the purpose.
Language: English or the Eighth Schedule
Section 5(3) requires the Data Fiduciary to give the Data Principal the option to access the notice in English or any language specified in the Eighth Schedule to the Constitution. Three points follow from the text.
- It is an option for the Data Principal. The Act does not require a notice to be issued in every language at once, but the option must be available.
- It covers the notice under both section 5(1) and section 5(2).
- Section 6(3) repeats the language option for the consent request itself, so the notice and the request should both be accessible in these languages.
Notice and consent together
Notice and consent are paired under the Act. Section 6(10) puts the burden on the Data Fiduciary to prove that a notice was given and that consent was given in accordance with the Act and the rules. Keeping dated records of the notice version, the language offered and the consent action will help meet that burden.
Practical examples
Example 1: new app sign-up. A fitness app asks for location and health data. The consent screen must be accompanied or preceded by a notice naming the data, stating why each item is needed, and explaining how to withdraw consent and how to complain to the Board. Collecting location only to "improve services" would be vague and risky.
Example 2: language option. A lender's notice is in English. To meet section 5(3), it must also give the Data Principal an option to read it in any Eighth Schedule language. A Hindi or Tamil view chosen by the user satisfies the option.
Example 3: retailer with no consent step. A shop sends a payment receipt to a number the customer supplied. This is a legitimate use under section 7(a), and there is no consent request, so the section 5(1) notice duty, which is tied to requests under section 6, is not triggered by that step alone.
Common mistakes
- Sending the notice after the consent is taken.
- Stating the purpose too broadly and then relying on it as narrow.
- Omitting the route to complain to the Board.
- Offering only English.
Need help with DPDP privacy notices?
If your current privacy notice was written before the DPDP Act and you want it checked against section 5, we can review the wording, the timing and the language options. Begin with our legal consultation service and share the notice along with the screens where consent is taken.
Key takeaways
- A notice must accompany or precede every consent request under section 6.
- It must state the data and purpose, the way to exercise rights under section 6(4) and section 13, and the way to complain to the Board.
- The Data Principal must have the option to read it in English or any Eighth Schedule language.
- The form and manner are prescribed by the rules.
- Keep dated records; section 6(10) puts the burden of proof on the Data Fiduciary.
Read next
- Section 5 of the DPDP Act, 2023: notice for consent given before commencement
- Section 6 of the DPDP Act, 2023: consent that is specific, informed and unambiguous
- Privacy policy draft that is DPDP compliant
- Section 4 of the DPDP Act, 2023: grounds for processing personal data
Disclaimer: Based on the Digital Personal Data Protection Act, 2023 (official text as enacted, No. 22 of 2023) as on 30 September 2026. The DPDP Rules, 2025 were notified in November 2025 and different provisions commence on different dates; this article does not state rule-level detail. Verify the current position in the Rules and the commencement notifications before acting.