s.5 · Rule 3 · s.6
Notice
A notice under Section 5 is the document that must accompany or precede every request for consent, stating the personal data and the purpose, how to exercise rights, and how to complain to the Board.
Rule 3 turns Section 5 into a checklist. The notice must be understandable on its own, without reference to any other document. It must itemise the personal data being collected, state the specified purpose with a description of the goods, services or uses it enables, and give the specific link or means to withdraw consent, exercise rights and complain to the Board.
A privacy policy written before the Act rarely meets this. It tends to describe categories in general terms, bundle purposes, and omit the withdrawal route and the Board. The Gevox scanner checks a site’s published notice for the DPDP concepts Rule 3 requires; 8 of 20 advisor websites had no compliant notice.
Section 5(2) required a notice to existing Data Principals as soon as practicable after the Act commenced, for data collected before it. That obligation is easy to miss.
Questions people ask
- Is our privacy policy the notice?
- It can be, if it does what Rule 3 requires: itemised data, a specified purpose, the withdrawal route, the rights route and the Board complaint route, all understandable on its own. Most pre-2025 policies do not.
- Does the notice have to be in the visitor’s language?
- Section 5(3) gives the Data Principal the option to access the notice in English or any language in the Eighth Schedule to the Constitution.
- Do we need a notice for data we already hold?
- Yes. Section 5(2) required one as soon as reasonably practicable after commencement.
Related terms
The DPDP brief
One email a month. What moved in the Act, and what our scans found.
Every claim cited to its section, the same way these pages are. No product news, no roundups of other people’s blogs.