Section 5 — Notice

Section 6(1) requires consent to be "informed." Section 5 is where that word gets content — it's the notice obligation that makes informed consent possible in the first place, rather than a decorative label attached to whatever a consent screen happens to say. Read the two sections together: Section 6 sets the standard consent has to meet, and Section 5 is the mechanism that's supposed to get a Data Principal to that standard before she clicks anything.

Notice tied to every consent request — 5(1)

Every request made to a Data Principal under Section 6 for consent has to be accompanied or preceded by a notice from the Data Fiduciary. That notice must tell her three things: the personal data and the purpose for which it's proposed to be processed; the manner in which she can exercise her rights under Section 6(4) — withdrawal — and Section 13, the rights chapter; and the manner in which she can complain to the Board. The sequencing matters — "accompanied or preceded" rules out notice that arrives only after consent has already been captured. The Act's own illustration makes the point concrete: a bank running a video-based KYC identification process has to accompany or precede that specific consent request with notice describing the personal data involved and the purpose it's collected for — not a generic privacy policy referenced somewhere else in the app.

A separate rule for pre-existing consent — 5(2)

Consent given before the Act's relevant provisions commenced doesn't get grandfathered in silently. Where a Data Principal had already consented before commencement, the Data Fiduciary has to give her notice as soon as reasonably practicable, covering the same three elements — what data, what purpose, and how to exercise rights and complain. Until that catch-up notice goes out, sub-clause (b) allows the Data Fiduciary to keep processing on the strength of the original consent, but only until the Data Principal withdraws it. The Act's illustration is an e-commerce platform: a customer who consented before the Act's commencement has to be told, through email, in-app notification or another effective method, what data of hers is being processed and why — the retrofit notice isn't optional just because the relationship predates the Act.

Language access — 5(3)

The Data Principal must have the option to access the notice in English or any language listed in the Eighth Schedule to the Constitution. This isn't a nice-to-have localisation feature — it's a statutory requirement that a notice drafted only in English, for a Data Principal who'd reasonably read it in another Eighth Schedule language, doesn't fully satisfy Section 5 on its own once that option isn't actually offered.

Why this matters in practice

Most organisations already have some version of a privacy notice, but Section 5 asks a narrower question than "do we have a privacy policy": is a notice meeting these three content requirements actually presented at or before the moment of each specific consent request, in a language option the Data Principal can choose. A long-form privacy policy linked from a footer, written once and never resurfaced at the point of consent, tends to satisfy the spirit of transparency without satisfying Section 5's sequencing requirement — the notice has to reach the Data Principal exactly when she's being asked to consent, not somewhere she could theoretically go looking for it.

Illustration: a telemedicine app asks a new user to consent to processing her health data for consultations. If the app presents a bare "I agree to the Privacy Policy" checkbox with a link buried at the bottom of a signup screen, and the linked policy doesn't itself describe the specific data and purpose at that point, the app hasn't accompanied the consent request with the notice Section 5(1) requires — even though a policy technically exists somewhere on the site.

How Section 5 connects to the rest of the Act

Section 5 only applies to the consent route under Section 4(1)(a) — Section 7's legitimate uses don't require this same notice-before-consent sequencing, though several of them carry their own disclosure expectations. Section 6(3) separately requires the consent request itself to be in clear and plain language with DPO contact details, which sits alongside, not instead of, Section 5's notice content. Rule 3 of the DPDP Rules, 2025 fills in the prescribed manner Section 5 keeps deferring to — the itemised description of personal data and the specific goods-or-services description a compliant notice needs.