DPDPA Section 5: Notice

The notice must itemize the personal data you intend to collect and the specific purpose for which it will be processed. Vague, blanket statements do not satisfy Section 5; each purpose must be stated clearly enough that the person can tell exactly what they are agreeing to.

It must also tell the data principal how to exercise their rights (including withdrawal of consent) and how to make a complaint to the Data Protection Board. These are not optional footnotes, they are part of what makes the consent that follows valid.

The notice must be in clear and plain language, and the data principal must be able to access it in English or any of the languages in the Eighth Schedule of the Constitution. For most consumer services in India that means offering the notice in the major regional languages your users actually read.

ConsentX renders the Section 5 notice as the consent banner and preference center, and serves it in English plus the scheduled Indian languages, so the language requirement is handled at the point of collection.

Where you obtained consent before the DPDP Act commenced, the Act requires you to give a fresh notice as soon as reasonably practicable so the person can continue or withdraw. Plan a one-time re-notice for legacy consents rather than assuming old consent carries over unchanged.