Section 5 explained: this guide covers what it means, who it applies to, the step-by-step process, documents required, fees, due dates and penalties in India — so you can stay compliant with confidence and avoid costly mistakes.
Businesses already hold personal data collected before the Act started. Section 5(2) says what happens to that legacy consent. The Data Fiduciary must give the Data Principal a notice as soon as reasonably practicable, and it may keep processing until she withdraws consent. The section does not say the old consent lapses. To plan the notice rollout for your customer base, you can begin with a legal consultation.
Where a Data Principal gave consent before the date of commencement, the Data Fiduciary must as soon as reasonably practicable give her a notice covering the data and purpose, how to exercise her rights under section 6(4) and section 13, and how to complain to the Board. It may continue processing until and unless she withdraws consent (section 5(2)(b)). The notice must be available in English or any Eighth Schedule language (section 5(3)).
Section 5(2) at a glance
| Element | What the text says |
|---|---|
| Who it covers | Data Principals who gave consent "before the date of commencement of this Act" |
| Duty | Give a notice "as soon as it is reasonably practicable" (5(2)(a)) |
| Notice content | (i) personal data and purpose for which it has been processed; (ii) how to exercise rights under section 6(4) and section 13; (iii) how to complain to the Board |
| Manner | "In such manner and as may be prescribed" |
| Continued processing | The Data Fiduciary may continue until and unless the Data Principal withdraws consent (5(2)(b)) |
| Language | Option in English or an Eighth Schedule language (5(3)) |
Which consents are covered
Section 5(2) covers consent given "before the date of commencement of this Act". By section 1(2), "commencement" here means the coming into force of this provision, so the cut-off is the date section 5 came into force. Consent collected after that date falls under section 5(1) and section 6 in the ordinary way.
The text covers consent "for the processing of her personal data" and does not say the old consent must meet the standard of section 6(1). That standard applies to consent asked for after commencement. The Act does not say legacy consent is validated or invalidated by the new standard; it simply provides the notice duty and the continuation right.
The duty: notice "as soon as reasonably practicable"
The duty has no fixed number of days. It is "as soon as it is reasonably practicable", which is a standard that depends on the size of the data set, the contact details held and the channels available. A business with e-mail addresses for all users can move faster than one with only postal addresses. The Act's Illustration describes an e-commerce provider that must, as soon as practicable, inform the customer through e-mail, in-app notification or another effective method, describing the personal data and the purpose of its processing.
The notice differs slightly from the notice in section 5(1): it speaks of the personal data and the purpose "for which the same has been processed", reflecting that processing has already occurred. The Act leaves the manner of the notice to the rules, and section 40(2)(b) lists it. The DPDP Rules, 2025 (notified November 2025) prescribe the detail, and different provisions commence on different dates; check the Rules. This article does not state any period or format from them.
The right to continue processing
Section 5(2)(b) says the Data Fiduciary "may continue to process the personal data until and unless the Data Principal withdraws her consent". Three points arise.
- Continuation does not depend on the notice being sent first. The text places the two limbs side by side; they are not linked by a condition. But failing to give the notice is a breach of section 5(2)(a) and can attract a penalty under the Schedule (entry 7 for other provisions), so a business should not treat the continuation right as a reason to delay.
- Withdrawal ends the right. After withdrawal, section 6(6) requires the Data Fiduciary to cease and cause its Data Processors to cease processing within a reasonable time, unless processing without consent is required or authorised by law.
- The right is limited to processing for which consent was given. It does not extend to a new purpose. A new purpose needs a fresh request under section 6 with a section 5(1) notice.
What the notice does not say
The Act does not require the Data Fiduciary to ask for fresh consent for legacy data. It requires a notice. A business that rolls out a consent refresh campaign may do so, but the section does not demand it. The section also does not say what happens if the Data Principal cannot be reached. The standard is "reasonably practicable", and the business should document its efforts.
Interaction with other sections
- Section 6(4) and (5): withdrawal, at any time, with the consequences borne by the Data Principal.
- Section 8(7): erasure when the Data Principal withdraws consent or when it is reasonable to assume the specified purpose is no longer being served.
- Section 13: grievance redressal, which the notice must explain.
- Section 12: correction and erasure rights for data the Data Principal consented to before, since section 12(1) mentions data for which she "has previously given consent".
See also the articles on section 5(1) and (3) and on withdrawal of consent under section 6.
Practical examples
Example 1: e-commerce platform. A platform has ten years of customer accounts created before commencement. It should plan a notice to each account holder by e-mail or in-app message, describing the data, the purpose, the withdrawal route and the Board complaint route, and offer it in English or an Eighth Schedule language.
Example 2: clinic with old records. A clinic holds patient contact details collected under older consent forms. The clinic can keep processing for the original purpose until a patient withdraws, but it should send the notice when reasonably practicable and record how it reached each patient.
Example 3: new purpose for old data. A retailer wants to use old customer data for a new loyalty programme. Section 5(2)(b) does not cover that new purpose. It needs a fresh request for consent with a notice under section 5(1).
Common mistakes
- Waiting for a "deadline" that the Act does not state. The standard is reasonable practicability.
- Treating the continuation right as a reason not to send the notice.
- Using old consent for a new purpose.
Need help with existing customer data and DPDP notices?
If you hold a large base of pre-commencement consents, a short plan for the notice rollout, channels and records can make the "reasonably practicable" standard easy to defend. Talk to us through our legal consultation service and we will go through your data sets and contact channels.
Key takeaways
- Section 5(2) applies to consent given before the date of commencement.
- The Data Fiduciary must give a notice as soon as reasonably practicable.
- Processing may continue until and unless the Data Principal withdraws consent.
- The notice must be available in English or an Eighth Schedule language.
- New purposes need fresh consent with a section 5(1) notice.
Read next
- Section 5 of the DPDP Act, 2023: notice to Data Principal
- Section 6 of the DPDP Act, 2023: withdrawal of consent
- Section 1 of the DPDP Act, 2023: short title and commencement
- DPDP compliance checklist for businesses
Disclaimer: Based on the Digital Personal Data Protection Act, 2023 (official text as enacted, No. 22 of 2023) as on 30 September 2026. The DPDP Rules, 2025 were notified in November 2025 and different provisions commence on different dates; this article does not state rule-level detail. Verify the current position in the Rules and the commencement notifications before acting.