(1) Before requesting a Data Principal for consent, every Data Fiduciary shall give to the Data Principal a notice in clear and plain language, providing— (a) the personal data and the purpose for which the same is sought to be processed; (b) the manner in which she may exercise the rights under Chapter III; and (c) the manner in which the Data Principal may make a complaint to the Board, in such manner as may be prescribed. (2) Where personal data has been collected before the commencement of this Act, and the Data Fiduciary intends to continue processing such personal data or seeks fresh consent, the Data Fiduciary shall, as soon as it is reasonably practicable, give to the Data Principal a notice as specified in sub-section (1).
Source: Digital Personal Data Protection Act, 2023. Official text available at truconsent.io/resources/dpdp-act.pdf.
Section 5 sets three hard requirements for every consent notice: it must state what personal data is being collected, state the purpose, and tell the Data Principal how to exercise their rights and complain to the Board. The notice must be in clear and plain language — legal boilerplate that requires a law degree to parse is not compliant. Section 5(2) creates a legacy data obligation: if you collected personal data before commencement and want to continue processing it, you must issue a compliant notice and, if required, seek fresh consent.
Non-compliant: 'By using this service you agree to our Privacy Policy.' The Data Principal has no idea what data is collected or for what purpose without reading a separate document. Compliant: 'We will collect your mobile number and email address to send you order confirmations and delivery updates. You can withdraw this consent at any time from your account settings or by contacting [email protected]. To raise a complaint with the Data Protection Board, visit [Board URL].'
Clear and plain language means plain language in the language the Data Principal understands. For consumer-facing platforms reaching across India, this practically means the notice must be available in the Eighth Schedule language the user has set as their preference. truConsent's Consent Engine generates notices in all 22 scheduled languages.
An e-commerce platform that collected user mobile numbers and email addresses before the Act commenced must issue a Section 5 notice to those users when Phase 2 commences and, if its original consent did not meet Section 6's requirements, seek fresh consent. The Third Schedule's retention periods under Rule 8 begin counting from the notice date for legacy data.