An uncomfortable experiment: open any app you installed this year and try to answer three questions from what it showed you at sign-up — exactly what personal data did it collect, for exactly what purposes, and where precisely would you complain if it misused that data? You agreed to something; you just couldn't say what. That experience is precisely what Section 5 exists to end.

This episode covers the only compliance artefact every customer personally encounters. The statutory core: notice accompanying or preceding every consent request — never disclosure as an afterthought to a granted permission. The three mandatory contents, sharpened by Rule 3: an itemised description of the data ("we collect your information" fails; "name, mobile number, delivery address, order history" passes), itemised and specific purposes, and the accountability machinery — including the requirement that startles first-time readers: telling your own customers how to escalate against you to the Data Protection Board, the statute recruiting every notice in the country as civic education.

Then the distinctly Indian layer: availability across English and the twenty-two Eighth Schedule languages, and why your notice programme is a translation programme — professional translation of one short document, not machine translation of a sprawling policy. The Rule 3 standalone standard that ends the buried-privacy-policy era. The look-back obligation almost nobody has planned for: existing users, with consents collected under the old regime, must receive the new-style notice too. The five drafting failures I see weekly — the genre notice, the kitchen-sink purpose, the buried notice, the frozen notice, and the GDPR-template notice missing the complaints machinery entirely. What good looks like: the layered design. And the closing reframe: the notice as the one moment your data practices speak directly to a customer — compliance spend converting to brand equity for companies that treat it as craft.

DPDP Daily takes India's Digital Personal Data Protection Act, 2023 and the DPDP Rules, 2025 out of the statute book and into real life — for compliance officers, lawyers, founders, small business owners and citizens. One practical episode every day, no jargon.

I'm Harmeet Singh Kapoor, author of the DPDP Act Compliance Handbook: From Law to Ground Reality.

Keywords: Section 5 DPDP, privacy notice, DPDP notice requirements, Rule 3, itemised notice, Eighth Schedule languages, plain language notice, notice drafting, consent notice India, DPDP compliance.

Connect with me:
💼 LinkedIn: https://www.linkedin.com/in/hskapoor/
📄 Facebook: https://www.facebook.com/satarkintelligence
▶️ YouTube: https://www.youtube.com/@DPDPdaily
🎙️ Apple Podcasts: https://podcasts.apple.com/us/podcast/dpdp-daily/id6793257111
𝕏 X: https://x.com/TheOtherKapoor

One practical DPDP insight every morning on LinkedIn, Facebook and X — and the DPDP Act Compliance Handbook: From Law to Ground Reality coming soon.

This episode is educational commentary, not legal advice. The DPDP framework is in phased implementation and positions described may evolve through notifications, Board publications and judicial interpretation. For decisions affecting your organisation or your rights, consult a qualified professional with your specific facts.

Every data protection law on earth answers one question before all others: when is it lawful to process someone's personal data at all? Europe's answer runs six lanes wide — consent, contract, legal obligation, vital interests, public tasks, and the flexible catch-all called legitimate interests that carries most of the commercial internet. India looked at that six-lane highway and built two lanes: consent, or a closed list of legitimate uses. Nothing in between. That choice is the single most consequential design decision in the entire statute.

Arc 2 opens here — the Act, section by section — and it begins at the foundation stone. What "lawful purpose" actually means, and why its modesty surprises people: the law doesn't police ambition; it polices authorisation. The two doors every processing activity must pass through. The absences that define the architecture: no contract basis, no legitimate-interest balancing test — and the fair account of why India refused the ground the rest of the world relies on, choosing a closed list Parliament controls over an open standard companies interpret and regulators chase.

Then the consequences. Why consent becomes the workhorse, and consent engineering the load-bearing wall of Indian data operations. Why the product manager's instinct — "we need it to run the feature" — maps to nothing automatic here, and where the gap between "we need it" and "we have a basis for it" will surprise compliance programmes. The four-column basis-mapping exercise that converts Section 4 into a working document, and why the rows ending in shrugs are violations-in-waiting. Plus the honest note on interpretation: how the Board's early orders will calibrate the system, and the compliance-safe posture until they do.

DPDP Daily takes India's Digital Personal Data Protection Act, 2023 and the DPDP Rules, 2025 out of the statute book and into real life — for compliance officers, lawyers, founders, small business owners and citizens. One practical episode every day, no jargon.

I'm Harmeet Singh Kapoor, author of the DPDP Act Compliance Handbook: From Law to Ground Reality.

Keywords: Section 4 DPDP, lawful basis, consent, legitimate uses, legitimate interest India, GDPR comparison, lawful purpose, DPDP Act section by section, data processing grounds, DPDP compliance.

Connect with me:
💼 LinkedIn: https://www.linkedin.com/in/hskapoor/
📄 Facebook: https://www.facebook.com/satarkintelligence
▶️ YouTube: https://www.youtube.com/@DPDPdaily
🎙️ Apple Podcasts: https://podcasts.apple.com/us/podcast/dpdp-daily/id6793257111
𝕏 X: https://x.com/TheOtherKapoor

One practical DPDP insight every morning on LinkedIn, Facebook and X — and the DPDP Act Compliance Handbook: From Law to Ground Reality coming soon.

This episode is educational commentary, not legal advice. The DPDP framework is in phased implementation and positions described may evolve through notifications, Board publications and judicial interpretation. For decisions affecting your organisation or your rights, consult a qualified professional with your specific facts.

Twelve episodes of foundations — the countdown, the constitutional history, the cast of characters, the exemptions, the penalties, the regulator, the state's wide lane. Today, theory faces you. Nine questions about your own organisation, each answerable in a minute, each revealing something the foundations arc taught — and by the end, you'll hold what organisations pay consultants lakhs to produce and still don't get straight: an honest picture of your starting line.

The nine, scored green, amber or red as things are — not as they're planned: Do we actually know which of our data is digital personal data under this Act? For each data relationship, do we know which character we're playing? Could we produce a current record of what we hold, where, why and with whom it's shared? Can we name the lawful basis behind each processing activity? If a customer demanded access, correction or erasure tomorrow, could we execute? If data leaked tonight, do named people know their roles on the two clocks? Does every vendor touching our data operate under a proper contract? Is there one named human accountable for DPDP compliance? And if the Board asked us to demonstrate our efforts, what could we physically produce today?

Then the tally guidance for each profile — and a worked example from advisory work: a two-hundred-person consumer services firm scoring two green, four amber, three red, why that profile is roughly the median serious Indian mid-market company in 2026, and how its first three moves wrote themselves. Why progress in compliance is rarely dramatic — it's ambers eating reds, quarter after quarter. Plus the habit that turns thirty minutes into a governance instrument: date the scorecard, re-score quarterly, file it in the evidence trail.

The foundations are laid. Tomorrow, a new arc opens: the Act itself, section by section — beginning with Section 4, the two lawful bases, and the story of why India deliberately refused the "legitimate interest" ground the rest of the world relies on.

DPDP Daily takes India's Digital Personal Data Protection Act, 2023 and the DPDP Rules, 2025 out of the statute book and into real life — for compliance officers, lawyers, founders, small business owners and citizens. One practical episode every day, no jargon.

I'm Harmeet Singh Kapoor, author of the DPDP Act Compliance Handbook: From Law to Ground Reality.

Keywords: DPDP self-assessment, DPDP gap assessment, compliance checklist, data mapping, RoPA, lawful basis, breach readiness, vendor contracts, DPDP compliance owner, data protection audit India.

Connect with me:
💼 LinkedIn: https://www.linkedin.com/in/hskapoor/
📄 Facebook: https://www.facebook.com/satarkintelligence
▶️ YouTube: https://www.youtube.com/@DPDPdaily
🎙️ Apple Podcasts: https://podcasts.apple.com/us/podcast/dpdp-daily/id6793257111
𝕏 X: https://x.com/TheOtherKapoor

One practical DPDP insight every morning on LinkedIn, Facebook and X — and the DPDP Act Compliance Handbook: From Law to Ground Reality coming soon.

This episode is educational commentary, not legal advice. The DPDP framework is in phased implementation and positions described may evolve through notifications, Board publications and judicial interpretation. For decisions affecting your organisation or your rights, consult a qualified professional with your specific facts.