DPDP reference

Section 5: Notice

Last checked 6 Nov 2026

Every request for consent must come with or after a notice. The notice tells the Data Principal the personal data and the purpose, how to exercise the rights in s.6(4) and s.13, and how to complain to the Board (s.5(1)).

Where consent was given before commencement, the Data Fiduciary gives a similar notice as soon as reasonably practicable, and may continue processing until consent is withdrawn (s.5(2)). The Data Principal must be able to read the notice in English or any language in the Eighth Schedule to the Constitution (s.5(3)). Rule 3 sets the content.

Applies to
Every Data Fiduciary that relies on consent, including for consent collected before commencement.
Starts
13 May 2027 (G.S.R. 843(E), item (c)).
Penalty
Up to ₹50 crore (s.33, Schedule item 7).
Source
Digital Personal Data Protection Act, 2023 (22 of 2023), section 5; G.S.R. 843(E), commencement

Questions

Is a notice needed for consent collected before the Act?

Yes. The Data Fiduciary gives notice as soon as reasonably practicable after commencement, and may keep processing until the Data Principal withdraws consent (s.5(2)).

Which languages must a DPDP notice offer?

English or any language specified in the Eighth Schedule to the Constitution, at the Data Principal's option (s.5(3)).

Related

Next

Join early access

Not legal advice.