Section 5 Notice Requirements Under the DPDP Act

Section 5 of the Digital Personal Data Protection Act, 2023 establishes specific transparency obligations before an organization requests user consent. The law mandates that a notice accompany or precede every request for consent under Section 6. Section 4 dictates that an entity processes personal data only for a lawful purpose. The Act defines lawful purpose as any objective not expressly forbidden by law. Organizations specify the personal data collected and the exact purpose of the processing in the notice. The text also explains how Data Principals exercise their statutory rights regarding consent withdrawal and grievance redressal. Under Section 5(3), companies provide the option to access this notice in English or any language listed in the Eighth Schedule to the Constitution. Fiduciaries update their digital interfaces to accommodate these mandatory language selectors.

A privacy policy link at the bottom of a webpage fails to meet the standard set by Section 5. The obligation binds the Data Fiduciary directly. Data Processors do not carry the statutory burden to issue notices. This transparency requirement covers all digital personal data processed within India. The rule applies equally to processing outside the country if it involves offering goods or services to Data Principals within India. Enterprises cannot rely on generic overarching policies to satisfy this duty. Notices are granular and itemized. The Fiduciary presents the text exactly when the individual faces a consent prompt.

Section 5(1) names three distinct elements of a valid notice. An organization informs the individual about the personal data collected and the specific purpose of the proposed processing. The company explains how the Data Principal exercises rights under Section 6(4) regarding consent withdrawal and Section 13 regarding grievance redressal. The text specifies the exact procedure for the Data Principal to make a complaint to the Data Protection Board. The Act provides a clear illustration of this mechanism. An individual opens a bank account using the mobile app or website of a bank. To complete the Know-Your-Customer requirements under law for opening the account, the individual opts for processing of her personal data in a live video-based customer identification process. The bank supplies the Section 5 notice before capturing the video. This notice forms the statutory prerequisite for valid consent under Section 4(1)(a).

Section 5(2) addresses personal data collected before the Act commences. Many companies hold large databases built on prior consent models. The statute requires the Data Fiduciary to give the Data Principal a retrospective notice as soon as reasonably practicable. This legacy notice contains the exact same three informational elements as a new front-end collection prompt. Companies execute a specific communication cycle to deliver this information. Methods include email campaigns or in-app notifications. The organization continues processing the data until the individual withdraws consent. Systems record the date and time the company sent the legacy notice to prove compliance during an audit. Legal departments draft specific modular texts to satisfy these retrospective communication obligations.

Section 5(3) introduces a language translation requirement for Fiduciaries. Organizations give the Data Principal the option to access the notice contents in English or any language specified in the Eighth Schedule to the Constitution. The Eighth Schedule contains 22 recognized languages. A user selects their preference through a toggle or dropdown menu built directly into the digital interface. The statute does not explicitly mandate the full translation of extensive corporate privacy policies. The obligation applies strictly to the modular notice presented at the time of consent. Engineering teams build language selectors into the user experience to satisfy this rule. The DPDP Rules, 2025 detail the mechanics by requiring itemized notices tied directly to specific consent requests across all platforms.

Organizations execute distinct phases to remediate legacy interfaces.

1. Map existing data collection touchpoints across the enterprise. Control owners document every user interface gathering consent. A centralized record of processing activities details data categories and processing purposes.

2. Draft modular itemized notices. The legal department creates text blocks answering the three requirements of Section 5(1). Teams track the approved text strings over time to maintain an accurate history.

3. Implement interface language switching. Engineering departments build toggles allowing users to read the notice in the 22 Eighth Schedule languages alongside English. Testing documentation proves the selector operates correctly.

4. Log the notice display event. Database administrators configure systems to record the exact notice version presented before the user consented. The resulting database links consent artifacts to specific notice identification numbers.

Processing relies on consent under Section 4(1)(a) or certain legitimate uses under Section 4(1)(b). Section 5 interacts directly with Section 6 because the notice anchors valid consent. The notice requirement falls away where Section 7 applies. If an enterprise relies entirely on a Section 7 legitimate use, the Section 5 notice obligation does not attach to that specific processing activity. Medical emergencies and employment purposes fall under these exemptions. Under Section 8, the burden of proof falls entirely on the Data Fiduciary. Companies possess the statutory duty to prove that they gave the required notice to the Data Principal.

Non-compliance with Section 5 triggers general penalty provisions under the Schedule of the Act. The Data Protection Board imposes penalties up to Rs 50 crore for breaches of these specific duties. The Board evaluates the extent of systemic failures in notice presentation when determining the final penalty amount. Current consent management architecture requires detailed evaluation. Fragmented tools often fail to link a specific user consent event to the exact notice version presented. Organizations build queryable audit trails to prove what text the user saw. Auditors reviewing the environment look for evidence proving notice displays across all digital properties before the individual clicked accept.