InfraVeritas360DPDPiq

DPDP Insights › The law › Section 5 · Rule 3

What it means in your sector

• Banking, financial services and insurance: Account opening, loan applications, insurance proposals, app sign-ups and branch forms each need a notice, separate from the long terms and conditions.
• IT, ITeS, BPO and GCC: Candidate portals, employee onboarding and your own website forms need notices. For client data, the client normally gives the notice.
• Central government: ministries and departments: Where you rely on Section 7(b) and the data was not collected by consent, a notice is not required by Section 5, but Rule 5 still asks you to give a contact for questions and rights.
• Healthcare and hospitals: Registration desks, appointment apps, lab forms and health-camp sign-ups need clear notices. Old patient databases need a notice too.

Questions where this section matters

• What should our privacy notice say, and where must people see it?
• Do we need consent for employee data?
• What about CCTV, visitor registers and biometric attendance?
• Can we send offers to past customers and leads?
• What about call recordings and customer service screens?
• Can we cross-sell insurance, cards or mutual funds to existing customers?
• What can our lending or banking app collect from a phone?
• How long can we keep candidate data?
• Townships, hospitals and schools run by the PSU: what applies?
• Do we need DPDP consent to treat a patient?
• We are linked to ABDM. How does its consent fit with DPDP?

Official text: Digital Personal Data Protection Act, 2023 and DPDP Rules, 2025 (MeitY). The DPDP Rules were notified on 13 November 2025. Consent Manager rules start on 13 November 2026. Most duties, including notice, security, breach reporting, retention, children's data and rights, start on 13 May 2027. A proposal discussed in early 2026 to bring this date forward had not been notified when this page was last reviewed.