Section 5
Notice
Every consent request must carry, or be preceded by, a notice stating the data, the purpose, how to exercise rights and how to complain to the Board.
Read this before you cite anything here
These pages are a plain-English restatement, written to help you find the right provision and understand what it asks of you. They are not the text of the statute, and nothing here should be quoted as though it were. Section and rule numbers are exact, and every page names its source.
What it says
- (1)
- Every request for consent under s.6 must be accompanied or preceded by a notice telling the Data Principal what personal data is collected and for what purpose, how she may exercise her rights under s.6(4) and s.13, and how she may complain to the Board.
- (2)
- Where consent was obtained before the Act commenced, the Data Fiduciary must give a notice carrying equivalent information as soon as reasonably practicable. Processing may continue until consent is withdrawn.
- (3)
- The Data Principal must have the option of accessing the notice in English or in any language listed in the Eighth Schedule to the Constitution.
In practice
A privacy policy is not a notice. Rule 3 requires the notice to stand on its own and to itemise the data collected, which a policy written to cover every processing activity at once cannot do. Sub-section (2) also catches every consent already sitting in a database from before commencement: those users need a fresh notice, not a grandfather clause.
Read next
The DPDP brief
One email a month. What moved in the Act, and what our scans found.
Section 5 is live. One email a month on what moved in the Act, every claim cited to its section, the same way this page is.