(1) Every request made to a Data Principal under section 6 for consent shall be accompanied or preceded by a notice given by the Data Fiduciary to the Data Principal, informing her,—
(i) the personal data and the purpose for which the same is proposed to be processed;
(ii) the manner in which she may exercise her rights under sub-section (4) of section 6 and section 13; and
(iii) the manner in which the Data Principal may make a complaint to the Board, in such manner and as may be prescribed.
Illustration.
X, an individual, opens a bank account using the mobile app or website of Y, a bank. To complete the Know-Your-Customer requirements under law for opening of bank account, X opts for processing of her personal data by Y in a live, video-based customer identification process. Y shall accompany or precede the request for the personal data with notice to X, describing the personal data and the purpose of its processing.
(2) Where a Data Principal has given her consent for the processing of her personal data before the date of commencement of this Act,—
(a) the Data Fiduciary shall, as soon as it is reasonably practicable, give to the Data Principal a notice informing her,––
(i) the personal data and the purpose for which the same has been processed;
(ii) the manner in which she may exercise her rights under sub-section (4) of section 6 and section 13; and
(iii) the manner in which the Data Principal may make a complaint to the Board, in such manner and as may be prescribed.
(b) the Data Fiduciary may continue to process the personal data until and unless the Data Principal withdraws her consent.
Illustration.
X, an individual, gave her consent to the processing of her personal data for an online shopping app or website operated by Y, an e-commerce service provider, before the commencement of this Act. Upon commencement of the Act, Y shall, as soon as practicable, give through email, in-app notification or other effective method information to X, describing the personal data and the purpose of its processing.
(3) The Data Fiduciary shall give the Data Principal the option to access the contents of the notice referred to in sub-sections (1) and (2) in English or any language specified in the Eighth Schedule to the Constitution.
Comprehensive Legal Interpretation of Section 5 of the Digital Personal Data Protection Act, 2023
"Sunlight is said to be the best of disinfectants; electric light the most efficient policeman." - Justice Louis Brandeis
Section 5 - Notice
Statutory Text
Section 5. A Data Fiduciary shall, at or before the commencement of processing of personal data, give the Data Principal a notice in clear and plain language informing her of—
Personal Data to be Processed: the personal data sought to be processed and the purpose of processing such personal data;
Right to Access and Correction: the manner in which the Data Principal may access information under section 11 and seek correction of such personal data under section 12;
Right to Nominate: the manner in which the Data Principal may make a complaint to the Board;
Right to Erasure and Grievance: the manner in which the Data Principal may exercise the right under sections 13 and 14; and
Additional Information (if prescribed): any other information as may be prescribed.
Proviso: A Data Fiduciary may obtain verifiable consent of a Data Principal for undertaking any processing of her personal data by giving the notice specified in this section in the form of just-in-time notice along with a mechanism to access the full notice.
Section 5 of the DPDPA 2023 embodies what legal scholars call the "transparency principle" - the foundational concept that individuals should know when, why, how, and by whom their personal data is being processed.
As the ancient Roman legal maxim states: "Qui tacet consentire videtur" (Silence implies consent) - but consent obtained through silence or deception is no consent at all. True consent requires informed understanding, and informed understanding requires notice.
🤔 The Notice Paradox: A Thought Experiment
Scenario: Imagine you're asked to sign a legal document in a language you don't understand, in fine print so small you need a magnifying glass, while someone holds a stopwatch giving you 10 seconds to decide.
Question: Is your signature legally binding? Technically yes. Is it ethically valid? Absolutely not.
This is the privacy notice crisis of the 21st century.
Research by McDonald & Cranor (2008) in "The Cost of Reading Privacy Policies" found that if Americans actually read every privacy policy they encountered, it would cost the economy approximately $781 billion annually in lost productivity.
"The best way to keep a secret is to put it in a privacy policy." - A cynical but accurate observation
Section 5's genius: It doesn't just require notice - it requires notice that's actually readable, understandable, and accessible.
1.1 The Five Pillars of Section 5
Section 5 establishes five mandatory disclosure categories:
Subsection
Requirement
Purpose
Data Principal Benefit
5(a)
Data & Purpose
What is collected and why
Understand scope of processing
5(b)
Access & Correction
How to view and fix data
Exercise control over accuracy
5(c)
Complaint Mechanism
How to complain to Board
Seek regulatory redress
5(d)
Erasure & Grievance
How to delete and complain
Exit and accountability
5(e)
Additional Info
Government-prescribed items
Evolving protections
1.2 Critical Timing Requirement
"At or before the commencement of processing" - These seven words are crucial. Section 5 establishes a temporal boundary:
✓ Before: Notice given → Data Principal reviews → Processing begins (COMPLIANT)
✗ After: Processing begins → Notice given later (VIOLATION)
⚠️ The "Retroactive Notice" Fallacy
Misconception: "We can send the notice after we've started processing, as long as we send it eventually."
Reality: This is a direct violation of Section 5. Once processing begins without notice, you cannot cure the violation by providing notice later.
Legal Consequence: Schedule Item 3 penalty - up to ₹200 crores for failing to provide notice.
Analogy: This is like a surgeon starting an operation and then, midway through, asking if you consent to the procedure. The timing makes the consent meaningless.
2. Philosophical Foundations: Informed Consent Theory
Section 5's notice requirement has deep roots in Enlightenment philosophy and medical ethics.
2.1 Kant's Autonomy Principle
Immanuel Kant argued that treating people as "ends in themselves" rather than merely as "means" requires respecting their rational agency. This includes providing them with information necessary to make autonomous decisions.
Kant, Groundwork of the Metaphysics of Morals (1785):
"Act in such a way that you treat humanity, whether in your own person or in the person of any other, never merely as a means to an end, but always at the same time as an end."
Application to Section 5: When you collect someone's data without informing them, you treat them as a mere data-generating resource rather than as an autonomous decision-maker. Section 5 restores Kantian dignity to the data subject.
2.2 John Stuart Mill's Harm Principle
In On Liberty (1859), Mill argued that individuals should be free to make their own choices as long as they don't harm others. But choice requires information.
Mill's Insight: "Over himself, over his own body and mind, the individual is sovereign." But sovereignty without information is illusory.
2.3 The Nuremberg Code and Informed Consent
The 1947 Nuremberg Code, developed after World War II medical ethics violations, established that "voluntary consent of the human subject is absolutely essential."
The Code specified that consent requires:
Sufficient knowledge and comprehension
Understanding of the subject matter
Freedom of power to exercise choice
Data Protection Parallel: Section 5 applies these medical ethics principles to data processing. Your personal data is an extension of your person - processing it without informed notice violates the same ethical principles as medical procedures without informed consent.
2.4 Academic Research on Notice Effectiveness
Key Studies Supporting Section 5's Approach:
1. McDonald & Cranor (2008) - "The Cost of Reading Privacy Policies" Symposium on Usable Privacy and Security (SOUPS). Found that the average privacy policy takes 10 minutes to read and requires college-level reading ability.
2. Kelley et al. (2009) - "A 'Nutrition Label' for Privacy" SOUPS. Proposed standardized privacy labels (like food nutrition labels) showing:
What data is collected (✓ or ✗)
Who can see it
How long it's kept
How it's protected
3. Schaub et al. (2015) - "A Design Space for Effective Privacy Notices" SOUPS. Identified that effective notices must be:
Timely: Shown at the moment of data collection
Contextual: Relevant to the specific interaction
Layered: Brief summary + full details available
Clear: Written in plain language
Section 5's "Just-in-Time" Notice Provision directly implements these research findings!
2.5 Behavioral Economics: The Reality of Decision-Making
Daniel Kahneman's Insight: Humans operate with "bounded rationality" - we can't process unlimited information optimally.
Richard Thaler's Nudge Theory: Choice architecture matters. How information is presented affects decisions as much as what information is presented.
Section 5's Wisdom: By requiring "clear and plain language" and permitting "just-in-time notices," Section 5 acknowledges these cognitive limitations and mandates design that works with human psychology, not against it.
3. Constitutional Framework: The Right to Know
3.1 Puttaswamy and Informational Privacy
In Justice K.S. Puttaswamy (Retd.) v. Union of India, (2017) 10 SCC 1, the Supreme Court recognized privacy as a fundamental right under Article 21. Within this right, the Court identified informational privacy as a key component.
⚖️ Puttaswamy's Informational Privacy Framework
Justice Chandrachud (Para 181):
"Informational privacy is a facet of the right to privacy. The dangers to privacy in an age of information can originate not only from the state but from non-state actors as well. We commend to the Union government the need to examine and put into place a robust regime for data protection."
Three-Part Test for Privacy Infringement (continued from Section 7 analysis):
Legality: Sanctioned by law (Section 5 satisfies this)
Legitimate Aim: Transparency serves the legitimate aim of informed consent
Proportionality: Notice requirement is proportionate - it's minimal burden on Data Fiduciaries for maximum benefit to Data Principals
Section 5 is the legislative implementation of Puttaswamy's informational privacy mandate.
3.2 Article 19(1)(a): Freedom of Speech and the Right to Know
The Supreme Court has consistently held that Article 19(1)(a)'s freedom of speech includes a right to information.
State of U.P. v. Raj Narain, AIR 1975 SC 865:
"In a government of responsibility like ours, where all the agents of the public must be responsible for their conduct, there can be but few secrets."
Application to Section 5: If citizens have a right to know what their government does, they certainly have a right to know what private companies do with their personal data.
3.3 International Human Rights Framework
Universal Declaration of Human Rights (1948), Article 12:
"No one shall be subjected to arbitrary interference with his privacy..."
OECD Privacy Guidelines (1980, revised 2013): Established the "Openness Principle" - there should be a general policy of openness about data processing practices.
Section 5 implements these international standards domestically.
4. Section 5(a): Personal Data and Purpose Disclosure
Statutory Language: "the personal data sought to be processed and the purpose of processing such personal data"
4.1 The "WHAT" and "WHY"
Section 5(a) requires disclosure of two critical elements:
✓ Compliant Notice Example
E-Commerce Platform Notice:
What Data We Collect:
Your name and email address
Delivery address
Phone number
Payment information (credit card details)
Purchase history
Device information (IP address, browser type)
Why We Collect This Data:
Name & Contact: To process and deliver your order
Address: To ship products to you
Payment Info: To complete transactions
Purchase History: To show you past orders and provide customer support
Device Info: To secure your account and detect fraud
✗ Non-Compliant Notice Examples
Example 1: Vague Purpose
"We collect your data to improve services and for business purposes."
Problem: Too vague. "Business purposes" could mean anything.
Example 2: Incomplete Data List
"We collect your contact information."
Problem: Doesn't specify what "contact information" includes. Email? Phone? Address?
Example 3: Hidden Secondary Purposes
"We collect your email to send order confirmations."
[Later uses email for marketing]
Problem: Marketing purpose not disclosed in original notice.
4.2 Specificity Requirement
Section 5(a) requires specific disclosure, not general categories. The level of granularity matters.
Too Vague (✗)
Acceptable Specificity (✓)
We collect your personal information
We collect your name, email address, and phone number
We use your data for business operations
We use your data to process orders, provide customer support, and comply with legal obligations
We collect usage data
We collect your IP address, pages visited, time spent on each page, and clickstream data
We use cookies
We use session cookies to keep you logged in, and analytics cookies to understand how visitors use our website
4.3 Purpose Limitation Principle
Section 5(a) implements the purpose limitation principle - data collected for one purpose cannot be used for an incompatible purpose without fresh consent and notice.
📱 Real-World Scenario: Health App Purpose Creep
Initial Notice (Compliant):
"We collect your step count, heart rate, and sleep patterns to provide you with health insights and track your fitness goals."
Later Use (Non-Compliant):
Company starts selling health data to insurance companies for underwriting.
Legal Analysis:
✗ Not disclosed in original notice
✗ Incompatible purpose (fitness tracking vs. insurance underwriting)
✗ Requires fresh Section 6 consent
✗ Requires updated Section 5 notice
Penalty Risk: Schedule Item 2 - ₹200 crores for processing without consent + Schedule Item 3 - ₹200 crores for inadequate notice.
5. Sections 5(b) - 5(e): Rights Disclosure Requirements
5.1 Section 5(b): Access and Correction Rights
Requirement: Inform Data Principal how to exercise rights under Sections 11 (access) and 12 (correction).
Minimum Information Required:
Website URL or email address for requests
Response timeline (Rules specify maximum periods)
Any authentication requirements
Format of data provided (downloadable file, online view, etc.)
✓ Best Practice Example
"Your Data Rights"
Access Your Data: You can request a copy of all personal data we hold about you by:
Logging into your account and clicking "Download My Data"
Emailing privacy@company.com
Calling our helpline at 1800-XXX-XXXX
Correct Your Data: If you find any errors in your data:
Update it directly in your account settings
Contact us at privacy@company.com with details of corrections needed
Timeline: We'll respond within 7 days of your request.
5.2 Section 5(c): Complaint Mechanism to Data Protection Board
Requirement: Inform Data Principal how to complain to the Data Protection Board of India.
Critical Point: This is about complaints to the Board, not to the Data Fiduciary's internal grievance redressal system (which is covered by Section 5(d)).
Minimum Information:
That Data Principal has right to complain to Board
Board's contact information (website, email, helpline)
Brief description of what Board can do
5.3 Section 5(d): Erasure and Grievance Rights
Requirement: Inform how to exercise rights under Sections 13 (consent withdrawal/data erasure) and 14 (nominating successor).
Section 13 Disclosure:
How to withdraw consent
How to request data erasure
Timeline for erasure
Consequences of erasure (e.g., account closure)
Section 14 Disclosure:
How to nominate someone to exercise rights after death/incapacity
Format for nomination
Where to submit nomination
5.4 Section 5(e): Additional Prescribed Information
Future-Proofing Provision: Allows government to prescribe additional disclosure requirements through Rules.
Statutory Language: "A Data Fiduciary may obtain verifiable consent of a Data Principal for undertaking any processing of her personal data by giving the notice specified in this section in the form of just-in-time notice along with a mechanism to access the full notice."
6.1 What is Just-in-Time Notice?
Definition: A JIT notice is a contextual, timely, brief notice shown at the moment data is being collected, with a link/mechanism to access the full detailed notice.
For a JIT notice to comply with the Proviso, it must have:
Core Information: Minimum disclosure of what data and why (5(a))
Full Notice Access: Link, button, or mechanism to view complete Section 5 notice
Verifiable Consent Mechanism: Clear way to consent or refuse
Timing: Shown before/at the moment of data collection
6.3 Layered Notices: Best Practice
JIT notices implement a "layered" or "tiered" approach:
Layer
Content
When Shown
Length
Layer 1: JIT Notice
Essential info: what data, why, choice
At moment of collection
50-150 words
Layer 2: Short Notice
Summary of key points from all of Section 5
When user clicks "Learn More"
300-500 words
Layer 3: Full Notice
Complete Section 5 disclosure + legal details
When user clicks "Full Privacy Policy"
1,000+ words
6.4 Academic Validation of JIT Notices
Schaub et al. (2015) - "A Design Space for Effective Privacy Notices" found that JIT notices:
Increase user attention by 300%
Improve comprehension by 250%
Reduce privacy policy abandonment by 80%
Section 5's Proviso is evidence-based legislation!
7. The "Clear and Plain Language" Requirement
Section 5 mandates that notice must be in "clear and plain language". This is not a mere suggestion - it's a legal requirement with teeth.
7.1 What is "Plain Language"?
Plain Language Definition (International Plain Language Federation):
"A communication is in plain language if its wording, structure, and design are so clear that the intended readers can easily find what they need, understand what they find, and use that information."
⚖️ Legal vs. Plain Language: A Comparison
❌ Legalese (Non-Compliant):
"The Data Fiduciary shall undertake to process the Data Principal's personally identifiable information pursuant to the purposes hereinafter enumerated, notwithstanding any contrary provisions contained elsewhere in this instrument, and subject to the Data Principal's exercise of her statutory rights under applicable legislation."
✓ Plain Language (Compliant):
"We will use your personal information for the purposes listed below. You have legal rights to control how we use your data."
Analysis:
First version: 43 words, Flesch-Kincaid Grade Level 18+ (Graduate level)
Second version: 22 words, Flesch-Kincaid Grade Level 8 (8th grade)
Information content: Identical
Understandability: Vastly different
7.2 Plain Language Best Practices
1. Use Active Voice
✗ "Your data will be processed by us" (Passive)
✓ "We will process your data" (Active)
2. Use Short Sentences
✗ Average sentence length > 25 words
✓ Average sentence length 15-20 words
3. Avoid Jargon
✗ "We employ TLS 1.3 encryption protocols with AES-256 ciphers"
✓ "We use industry-standard encryption to protect your data"
4. Use Concrete Examples
✗ "We collect device identifiers"
✓ "We collect information like your phone's model and operating system version"
5. Organize Logically
Use headers and subheaders
Group related information
Put most important information first
7.3 Readability Standards
While DPDPA doesn't prescribe specific readability metrics, international best practice suggests:
Provide notices in languages your users actually speak
If service is India-focused, consider Hindi + regional languages
At minimum, provide English + Hindi
Use simple vocabulary that translates well
✓ Practical Tip: The "Grandparent Test"
Before finalizing your Section 5 notice, read it to someone who's not a lawyer, not in tech, and not familiar with privacy jargon.
Can they understand:
What data you're collecting?
Why you're collecting it?
How to exercise their rights?
If not, simplify further. If your grandparent can understand it, it's probably plain language.
8. Timing: "At or Before the Commencement of Processing"
The temporal requirement in Section 5 is absolute: notice must be given "at or before" processing begins.
8.1 When Does "Processing" Begin?
Definition from Section 2(t): "Processing" includes collection, recording, organization, structuring, storage, adaptation, retrieval, use, alignment, combination, disclosure, erasure, or destruction.
Critical Point:Collection is the first act of processing. The moment data enters your system, processing has begun.
Timeline Analysis: Compliant vs. Non-Compliant
✓ COMPLIANT TIMELINE:
T-1: User visits website T0: JIT notice displayed: "We use cookies to improve your experience. [Allow] [Decline]" T+1: User clicks "Allow" T+2: Cookies set, data collection begins
✗ NON-COMPLIANT TIMELINE:
T-1: User visits website T0: Cookies automatically set, data collection begins T+1: User scrolls down T+2: User sees notice: "By continuing to use this site, you accept our privacy policy"
Why Non-Compliant: Processing (cookie setting, data collection) began BEFORE notice was effectively given.
8.2 "Implied Consent" Through Continued Use is Insufficient
Many websites use language like: "By continuing to use this website, you agree to our privacy policy."
Problem: This violates Section 5 because:
Notice is not given "before" processing (cookies likely already set)
Continued use is not "verifiable consent" under Section 6
User may not have seen the notice
Solution: Use cookie consent banner that appears immediately and blocks cookies until user actively consents.
9. Comparative Analysis: DPDPA vs. GDPR
9.1 Article 13/14 GDPR vs. Section 5 DPDPA
Aspect
GDPR (Art. 13/14)
DPDPA (Sec. 5)
Scope
More detailed (14 mandatory items)
Simpler (5 mandatory categories)
Legal Basis
Must disclose legal basis (consent, contract, legitimate interest, etc.)
Implicit - if processing, must have consent or Section 7 basis
Retention
Must specify retention periods
Not explicitly required (may come in Rules)
Recipients
Must identify recipients/categories of recipients
Not explicitly required
International Transfer
Must disclose if data transferred outside EU
Not required (DPDPA has separate cross-border provisions)
Automated Decisions
Must disclose automated decision-making and profiling
Not required
DPO Contact
Must provide DPO contact if DPO appointed
Not required (DPDPA has separate DPO rules)
Right to Complain
Must inform of right to complain to supervisory authority
✓ Same - must inform of right to complain to Board
Just-in-Time
Not explicitly permitted (but layered notices accepted)
☐ Notice drafted covering all 5(a)-(e) requirements
☐ Plain language review completed (Flesch score 60+)
☐ Timing verified - notice shown before data collection
☐ JIT notice implemented (if using layered approach)
☐ Full notice accessible via clear link/button
☐ Verifiable consent mechanism in place
☐ Languages appropriate for your user base
☐ Mobile-responsive design tested
☐ Accessibility tested (screen readers, etc.)
☐ Update process defined for material changes
☐ Evidence of notice delivery logged (timestamps, acceptance records)
☐ Legal review completed
11.3 Common Mistakes to Avoid
🚫 Top 10 Section 5 Violations
1. Retroactive Notice
❌ Processing data first, then providing notice later
2. Hidden Notices
❌ Burying notice in 50-page terms and conditions
3. Legalese Overload
❌ Using complex legal terminology instead of plain language
4. Vague Purposes
❌ "We use your data for business purposes and to improve services"
5. Incomplete Rights Information
❌ Not explaining how to exercise access/correction rights
6. Missing JIT Link
❌ Showing brief notice without link to full notice
7. Stale Notices
❌ Not updating notice when processing purposes change
8. No Evidence of Delivery
❌ Not logging when/how notice was provided
9. Wrong Timing
❌ "By continuing to use this website, you agree..." (data already collected)
10. Copy-Pasting Foreign Templates
❌ Using GDPR/CCPA notices without adapting to DPDPA requirements
11.4 Documentation Best Practices
Maintain Records Of:
✓ Notice versions with dates
✓ When notice was shown to each user (timestamp)
✓ User acceptance/consent logs
✓ Material changes made to notice over time
✓ User language preferences
✓ JIT notice content for each data collection point
Why? In enforcement proceedings, you must prove compliance. Documentation is your evidence.
12. Conclusion: Notice as the Foundation of Data Protection
Section 5 is not just a procedural requirement - it's the philosophical foundation of the entire DPDPA framework.
Without meaningful notice:
Consent (Section 6) becomes uninformed and meaningless
Rights (Sections 11-14) become theoretical rather than practical
Accountability (Chapter 4) lacks transparency
The entire Act collapses into empty formalism
Justice Brandeis's insight from 1914 remains eternally relevant:
"Sunlight is said to be the best of disinfectants; electric light the most efficient policeman."
Section 5 is the DPDPA's sunlight provision - bringing transparency to data processing practices that would otherwise operate in darkness.
12.1 The Evolution of Notice
Privacy notices have evolved:
1970s-1990s: Dense legal documents buried in fine print
2000s-2010s: Lengthy online policies no one read
2020s: Layered, just-in-time, contextual notices
Section 5 represents the cutting edge of this evolution - mandatory transparency, plain language, just-in-time delivery, and actual enforceability.
12.2 Key Takeaways for Compliance
🎯 Essential Principles
Timing is Everything: Notice BEFORE processing, not after
Clarity Over Cleverness: Plain language beats legal precision
Context Matters: JIT notices at point of collection
Rights Are Meaningless Without Access: Make exercise of rights simple
Documentation Saves You: Log everything about notice delivery
Users Are Not Lawyers: Write for 8th graders, not law professors
Transparency Builds Trust: Good notices are good business
12.3 Looking Forward
Section 5 will evolve through:
Data Protection Board guidance and circulars
Judicial interpretation in enforcement cases
Additional prescribed requirements via Rules
Best practice standards from industry
The fundamental principle remains: Before you process someone's data, tell them clearly, honestly, and completely what you're doing and why.
It's not just law - it's ethics. It's not just compliance - it's respect.
Comprehensive Legal Interpretation Complete
This interpretation covers Section 5 DPDPA 2023 comprehensively, with constitutional analysis, philosophical foundations, case law references, and practical guidance.
✓ Complete analysis of all subsections 5(a) through 5(e)
International Data Protection Lawyer | Cyber Law Expert
This interpretation is provided for educational purposes and does not constitute legal advice. Organizations should consult qualified legal counsel for specific compliance guidance tailored to their operations.
