# Section 5 DPDP Act 2023: Notice (full text)

> Canonical page: https://mksd0398.github.io/dpdp-act-skill/act/section-5/
> Not legal advice. Educational compliance reference only; no lawyer-client relationship arises from its use and the author is not a lawyer. Verify statutory text against the Gazette of India and consult qualified Indian legal counsel before acting.

**CHAPTER II: OBLIGATIONS OF DATA FIDUCIARY.** The Digital Personal Data Protection Act, 2023 (Act 22 of 2023), section 5. Verbatim from the Gazette of India.

Summary (maintainers', not statutory text): Itemised notice with/before consent request; retrospective notice for pre-Act consent; English or Eighth Schedule language

## Section 5. Notice

(1) Every request made to a Data Principal under section 6 for consent shall be accompanied or
preceded by a notice given by the Data Fiduciary to the Data Principal, informing her,—
  (i) the personal data and the purpose for which the same is proposed to be processed;
  (ii) the manner in which she may exercise her rights under sub-section (4) of section 6 and
  section 13; and
  (iii) the manner in which the Data Principal may make a complaint to the Board,
in such manner and as may be prescribed.

> **Illustration.** X, an individual, opens a bank account using the mobile app or website of Y,
> a bank. To complete the Know-Your-Customer requirements under law for opening of bank account,
> X opts for processing of her personal data by Y in a live, video-based customer identification
> process. Y shall accompany or precede the request for the personal data with notice to X,
> describing the personal data and the purpose of its processing.

(2) Where a Data Principal has given her consent for the processing of her personal data before
the date of commencement of this Act,—
  (a) the Data Fiduciary shall, as soon as it is reasonably practicable, give to the Data
  Principal a notice informing her,—
    (i) the personal data and the purpose for which the same has been processed;
    (ii) the manner in which she may exercise her rights under sub-section (4) of section 6 and
    section 13; and
    (iii) the manner in which the Data Principal may make a complaint to the Board,
  in such manner and as may be prescribed.
  (b) the Data Fiduciary may continue to process the personal data until and unless the Data
  Principal withdraws her consent.

> **Illustration.** X, an individual, gave her consent to the processing of her personal data for
> an online shopping app or website operated by Y, an e-commerce service provider, before the
> commencement of this Act. Upon commencement of the Act, Y shall, as soon as practicable, give
> through email, in-app notification or other effective method information to X, describing the
> personal data and the purpose of its processing.

(3) The Data Fiduciary shall give the Data Principal the option to access the contents of the
notice referred to in sub-sections (1) and (2) in English or any language specified in the Eighth
Schedule to the Constitution.