Every business holds personal data it collected before the DPDP Act had any force. One short provision, Section 5(2), governs all of it. This note explains what it requires, what it leaves unanswered, and what to do about it before the Act bites.
The rule
From 13 May 2027, a business that asks for consent to process personal data must first give a notice describing the data, the purpose, how the individual can withdraw consent and exercise her rights, and how she can complain to the Board.
For data collected before that date on the basis of consent, Section 5(2) says two things. The business must give the same notice “as soon as it is reasonably practicable”. And it may keep processing the data until the individual withdraws consent. The Act’s own example is an online shopping app that must email or notify its existing users after commencement, telling them what data it holds and why. The notice must meet the Rule 3 standard: standalone, itemised, with a working link for withdrawal and complaints.
Three things the rule does not say
Which date counts. The Act commenced in parts: the Board in November 2025, Consent Managers in November 2026, the obligations on businesses in May 2027. Section 5(2) refers to consent given “before the commencement of this Act”. The only reading that works is that it means the date the consent rules themselves start, 13 May 2027. So data you collect under your current terms between now and then is also legacy data, and the notice obligation applies to it. The safe course is to treat any consent obtained before your consent process meets the new standard as a legacy consent, whatever the date.
What counts as consent. The Act requires consent to be free, specific, informed, unconditional and unambiguous, given by a clear affirmative action. Almost no consent obtained under the old law meets that test: it was bundled into terms of service, or implied by continued use. If Section 5(2) required the new standard, it would cover nothing. The better reading, supported by the Act’s own shopping-app example, is that it means consent as understood when it was given. But the right to withdraw applies to that old consent from day one, and once withdrawn it cannot be obtained again in the old bundled form. A legacy consent is something you can keep, not something you can renew.
How long you have. There is no deadline for the notice. “Reasonably practicable” will be judged by the channels you have. If you have your users’ email addresses or an app they open, a notice that can go out in a day will not look practicable in six months. If you hold paper-era records with no live channel, you are in a different position and should write down why.
[1] Digital Personal Data Protection Act, 2023 (“the Act”), s. 5(1).
[2] Act, s. 5(2)(a) and (b).
[3] Act, s. 5(2), Illustration.
[4] Digital Personal Data Protection Rules, 2025 (“the Rules”), r. 3.
[5] Act, s. 6(1).
The alternative: data provided voluntarily
The Act allows processing without consent where the individual voluntarily provided the data to you for a specified purpose and did not object to its use for that purpose. It is tempting to reclassify all legacy data under this head and skip the notice. The words prevent it. The data must have been given voluntarily, by the individual, to you, for a stated purpose. Purchased lists, scraped data, data given to another company in your group, and data collected for one purpose and now used for another do not qualify. Where data does qualify, no notice is needed. But security, erasure and the individual’s rights of access and correction apply regardless. Do the classification dataset by dataset and write it down. A blanket claim will not survive the first inquiry into a marketing database.
Dormant accounts
The Rules make erasure mechanical for large platforms: e-commerce and social media services with two crore or more registered Indian users, and gaming services with fifty lakh or more. If a user has not engaged for three years, counted from 13 May 2027 or her last interaction, whichever is later, her data must be erased, with at least forty-eight hours’ warning to her. Dormant legacy accounts are the obvious case. The forty-eight-hour warning is itself a communication that can carry the Section 5(2) notice.
Employees
Most employee data does not rest on consent at all. The Act permits processing for employment purposes and for protecting the employer from loss without consent. Do not ask employees for fresh consent: consent in an employment relationship is hard to call free and unconditional, and a consent that fails that test is worse than none. Where you genuinely rely on consent, for example an optional wellness programme, the Section 5(2) notice applies.
Withdrawal
Withdrawal must be as easy as giving consent, and you must stop processing within a reasonable time after it. From November 2026 an individual can withdraw through a registered Consent Manager, and you must act on it. Every legacy dataset you keep under Section 5(2) must be connected to a withdrawal mechanism that actually reaches it. A dataset you can notify but not withdraw from is not compliant.
[6] Act, s. 7(a), read with s. 4(1)(b).
[7] Act, ss. 8(5), 8(7), 11 and 12.
[8] Act, s. 8(7); Rules, r. 8 and Third Schedule.
[9] Act, s. 7(i).
Until May 2027
The old law still applies. Section 43A of the IT Act gives civil compensation for negligent handling of sensitive personal data, and it stays in force until the DPDP provision replacing it commences. No DPDP penalty can be imposed before May 2027, but a civil claim can be brought now, and a claimant can point to the DPDP Rules as the emerging standard of reasonable practice. The transition is not a period without exposure.
What to do
Inventory every dataset by source, date, purpose and channel to the individual. Classify each as legacy consent under Section 5(2), voluntary provision, employment, or none of these, in which case erase it or re-collect it properly before May 2027. For the legacy-consent class, send a Rule 3-standard notice through the live channel and log it. Do not bundle the notice with a request to accept new terms; a notice that doubles as a re-consent under terms that fail the new test achieves nothing and creates a record of the failure. Connect every dataset to withdrawal. Apply the three-year erasure rule if you are above the thresholds, and a written retention policy if you are not.
The open questions
Which commencement date Section 5(2) refers to has not been tested; the reading above is the one that makes the provision work. Whether you can use a legacy consent for a new purpose: on the text, no. The old consent covers the old purpose; a new purpose needs new consent that meets the new standard. And how the Board will treat a business that never sent the notice: as a breach of the notice rule, or as processing without any lawful basis. Both attract the same ₹50 crore ceiling, but the second means the processing itself was unlawful. A business that sent the notice, logged it and enabled withdrawal is outside both arguments.
This note is published for general information. It states the position as understood on the date shown and is not legal advice. It does not create a lawyer–client relationship and is not an invitation to engage the firm.
[10] Act, s. 6(4) and (6).
[11] Act, s. 6(7); Rules, r. 4 (in force 13 November 2026).
[12] Information Technology Act, 2000, s. 43A; Act, s. 44.
[13] Act, s. 33 and the Schedule (residual ceiling for breach of any other provision).
