DPDPA Section 5: Notice
DPDPA Section 5 explained: the itemized notice a data fiduciary must give before seeking consent, what it must contain, the language requirement, and how ConsentX delivers it.
What the notice must contain
The notice must itemize the personal data you intend to collect and the specific purpose for which it will be processed. Vague, blanket statements do not satisfy Section 5; each purpose must be stated clearly enough that the person can tell exactly what they are agreeing to.
It must also tell the data principal how to exercise their rights (including withdrawal of consent) and how to make a complaint to the Data Protection Board. These are not optional footnotes, they are part of what makes the consent that follows valid.
Language and plain wording
The notice must be in clear and plain language, and the data principal must be able to access it in English or any of the languages in the Eighth Schedule of the Constitution. For most consumer services in India that means offering the notice in the major regional languages your users actually read.
ConsentX renders the Section 5 notice as the consent banner and preference center, and serves it in English plus the scheduled Indian languages, so the language requirement is handled at the point of collection.
Notice for consent taken before the Act
Where you obtained consent before the DPDP Act commenced, the Act requires you to give a fresh notice as soon as reasonably practicable so the person can continue or withdraw. Plan a one-time re-notice for legacy consents rather than assuming old consent carries over unchanged.
This page is a plain-English summary of the Digital Personal Data Protection Act, 2023 for general information and is not legal advice. Confirm your obligations with qualified counsel.
Meet this DPDPA requirement with ConsentX
DPDPA-native consent, Section 9 age-gate and verifiable receipts. Start free or take the DPDPA quiz.
DPDPA Section 5 questions
Does the DPDPA notice have to be in Indian languages?+
The data principal must be able to access the notice in English or any language in the Eighth Schedule of the Constitution, so in practice you should offer it in the regional languages your users read.
When must the Section 5 notice be given?+
Before, or at the time of, seeking consent. The notice precedes and informs the consent it supports.
What must a DPDPA notice contain?+
The personal data collected and its purpose, how to exercise rights and withdraw consent, and how to complain to the Data Protection Board, all in clear and plain language.