Before or at the time of collecting personal data, or processing it for any purpose, the DATA FIDUCIARY under the Digital Personal Data Protection Act, 2023 must:

Section 5 of the DPDP Act, 2023 obliges a data fiduciary to give a NOTICE to the data principal, in clear and plain language, before or at the time of collection (and where the purpose changes, before further processing), specifying the purpose of processing, the categories/items of personal data and sources, the rights of the data principal including consent withdrawal and grievance redressal, and the manner of exercising those rights. This prior-notice requirement is the foundation of informed consent. Without valid notice, consent under Section 6 is vitiated. Notice-conscious processing is therefore a core fiduciary duty.