Section 5 of the DPDP Act 2023 requires a data fiduciary to give the Data Principal a clear notice, before or at the time of seeking consent, that itemises the personal data being collected, the purpose of processing, how the Data Principal can exercise their rights, and how to complain to the Data Protection Board. The notice must be available in English and the languages listed in the Eighth Schedule to the Constitution. This gap checker walks through those itemised requirements and shows you exactly which elements your current privacy notice is missing.
Does your privacy notice actually meet the DPDP Section 5 requirements? Answer a few questions and see the specific itemised gaps you need to fix.
Section 5 of the DPDP Act 2023 makes the notice a precondition for valid consent. Before or at the time consent is requested, the Data Principal must be told, in clear and plain language, the itemised personal data being collected, the purpose of processing, the manner of exercising their rights, and the manner of making a complaint to the Data Protection Board. Crucially, the notice must be offered in English and the languages set out in the Eighth Schedule to the Constitution of India.
The word that trips companies up is itemised. A single sweeping sentence such as we collect data to improve our services does not meet the standard. Section 5 expects specificity — which categories of data, for which purposes — so that the consent the Data Principal gives is genuinely informed rather than a formality buried in a wall of text.
Consent under the DPDP Act is only as strong as the notice it rests on. If the notice fails to itemise data or purposes, or omits the withdrawal and complaint routes, the consent gathered against it can be challenged, which cascades into every downstream processing activity that relied on it. A weak notice is therefore not a cosmetic issue — it is a structural crack in your legal basis for processing.
Niti Bharat builds and reviews DPDP-grade privacy notices as part of its fixed-price compliance engagements, itemising data and purposes, wiring in the rights and complaint routes, and handling multilingual delivery. Fixing the notice now closes the most common single point of failure Indian companies carry into the expected May 2027 enforcement window.
A Section 5-ready privacy notice template with itemised data and purpose sections, rights and withdrawal wording, and the DPB complaint clause built in.
One real DPDP development explained in plain English, one practical how-to, one number from our own assessment data. Nothing else — no daily noise, no sales pitch.
No spam. Unsubscribe with one click, anytime.
