Do I need fresh consent for data collected before the Act?

Verified August 2026

No. Where consent was given before the Act commenced, section 5(2) requires the Data Fiduciary to give the Data Principal a notice as soon as it is reasonably practicable. Fresh consent is not required. Processing may continue until the Data Principal withdraws consent.

This is one of the most commonly misstated points in published guidance. Vendor guides advise a re-consent campaign across the existing Data Principal base. The Act does not require one.

What the notice must contain

Section 5(2) requires the same information as a notice under section 5(1). It must state the personal data and the purpose for which it is being processed. It must tell the Data Principal how to exercise her rights under section 6(4) and section 13. It must tell her how to make a complaint to the Data Protection Board.

Section 5(3) applies here too, so the Data Principal must be given the option of English or any Eighth Schedule language. See the page on notice languages.

What happens after the notice

Section 5(2) allows processing to continue until and unless the Data Principal withdraws consent. The notice does not reset the consent and does not ask for it again. It informs the Data Principal of what is held and of how to stop it.

Why the distinction matters

A re-consent campaign is expensive and it loses customers who do not respond. A Data Fiduciary that runs one because it misread the Act loses money on the campaign. It also erases records it could have kept. The correct step is a notice, sent once, as soon as it is reasonably practicable.

When the duty starts

Section 5 starts on 13 May 2027. The phrase before the commencement of this Act in section 5(2) is read against section 1(2), which lets different provisions commence on different dates and says a reference to commencement means the coming into force of that provision.

The complaint route named in the notice points to a Board that has no members and whose adjudication powers also start in May 2027. See the position on the Board.