Exhibitor vs Organizer: Section 5 Notice Obligations at 400+ Indian Trade Shows

Applies to	Trade show organizers, exhibition management companies, and exhibitors operating in India collecting visitor data at events.
Primary law	DPDPA 2023 · Section 5
Penalty ceiling	up to ₹150 crore
Enforcement status	Data Protection Board accepting complaints — 2026-08
Source	DPDPAReady Compliance Team

Section 5 Notice Requirements: What Trade Shows Get Wrong

Every year, Indian trade shows—from IGATEX to the Mumbai Auto Expo—collect visitor data through registration booths and exhibitor forms. But Section 5 of DPDPA requires a specific, itemised notice that most shows skip or get incomplete. This post compares what Section 5 mandates versus what typical trade show registration notices actually provide.

The Section 5 Notice Requirement in Plain Language

Section 5 of DPDPA states: “Before collecting personal data or at the time of collection, a Data Fiduciary shall provide or cause to be provided to the data principal an itemised notice containing the purpose for which personal data is being collected, the categories of personal data being collected, the Rights of the data principal available under this Act, the name and contact details of the Grievance Officer, and such other details as may be prescribed.”

For trade shows, this means both the organizer AND each exhibitor must provide an itemised notice whenever they collect visitor data—whether at the registration desk, at an exhibitor booth, or through a pre-event form.

Mandatory Section 5 Disclosure vs. Current Trade Show Practice

Section 5 Mandate	Compliant Trade Show Notice	What Most Shows Currently Do	Gap
Purpose of Processing	”We collect your name and email to (1) provide event badges, (2) send you exhibitor promotions during the event, and (3) send post-event surveys."	"We collect your details to improve your event experience.”	Too vague; doesn’t list specific purposes.
Data Categories	”We collect: personal data (name, email, phone, company, designation, city), and sensitive personal data (dietary preferences, accessibility needs if provided)."	"We collect your contact information.”	Omits sensitive data categories entirely.
Rights of Data Principals	”You have the right to (1) access your personal data, (2) correct inaccuracies, (3) withdraw consent anytime, and (4) request deletion 30 days after the event.”	Absent.	No mention of rights whatsoever.
Grievance Officer Details	Name: Priya Sharma, Email: grievance@tradeshowname.com, Phone: +91-98765-43210, Response time: 30 days, Address: 123 Business Park, Mumbai 400001.	”For issues, contact us at support@show.com” (generic helpline, not a named officer).	Grievance officer not identified; lacks contact details or response time.
Language per Eighth Schedule	Notice in English + local language (if show in Tamil Nadu, also Tamil; if Gujarat, also Gujarati).	English only.	Fails Eighth Schedule requirement.
Timing of Notice	Notice provided before or at the moment the registration form is presented.	Notice buried in event terms & conditions (read after registration).	Notice given too late or hidden.

Exhibitor vs. Organizer: Separate Section 5 Obligations

Organizers collect data for their own purposes (badge printing, post-event surveys, lead generation for future shows). Exhibitors collect data at their booths (to follow up with leads, build email lists for future outreach). Both are Data Fiduciaries and both must provide Section 5 notices separately.

Organizer Notice Example (Section 5 Compliant):

The Mumbai Trade Expo collects your name, email, phone, company, and designation to:

1. Print event badges.
2. Send you real-time event updates via email.
3. Invite you to future expos.
4. Measure event success through attendee surveys.

Your data is deleted 180 days after the event. You can request correction or erasure by emailing grievance@mumbaitradeexpo.com (Grievance Officer: Rajesh Mehta, response time: 30 days).

Exhibitor Notice Example (Section 5 Compliant):

ABC Corp (Exhibitor) collects your name, email, and phone to:

1. Send you product catalogs and pricing information.
2. Schedule a follow-up call within 7 days.

Your consent can be withdrawn anytime by replying STOP to our emails. Grievance Officer: Amit Patel, amit.grievance@abccorp.com, +91-9876543210, response time: 30 days.

Common Section 5 Compliance Failures at Indian Trade Shows

• Vague Purpose Statements — “We collect your data to enhance your experience” instead of listing specific, itemised purposes.
• Incomplete Data Categories — Listing only email and phone but omitting company, designation, dietary preferences, or accessibility needs.
• Missing Grievance Officer — Using a generic support email instead of naming a specific officer with a 30-day response commitment.
• No Rights Disclosure — Failing to inform visitors they can request erasure, access, or correction.
• Language Gaps — Providing notices in English only, even at shows held in non-English-speaking regions (violates Eighth Schedule).
• Timing Failures — Burying the notice in event T&Cs or providing it only via email after registration closes.
• No Consent Withdrawal Mechanism — Not explaining how to revoke consent or opt out of future communications.
• Exhibitor Notices Missing Entirely — Organizers assume a single organizer notice covers all data collection; exhibitors collect data with no Section 5 notice.

Section 5 Compliance Checklist for Trade Show Organizers

1. Draft a specific Purpose statement. List all intended uses: badge printing, event marketing, exhibitor lead generation, post-event surveys, future event invitations. Avoid “improve your experience”—be explicit.
2. Enumerate Data Categories clearly. Separate personal data (name, email, phone, designation, company, city) from sensitive data (dietary restrictions, accessibility needs, medical information).
3. Add a Rights Statement. Include: “You have the right to access, correct, and delete your personal data. Submit requests to grievance@showname.com within 30 days.”
4. Name a Grievance Officer with full contact details. Include: name, email, phone, office address, and a 30-day response commitment. Do not use a generic support email.
5. Provide notice in Eighth Schedule Languages. If the show is held in a state, translate the notice into that state’s official language (Tamil, Telugu, Kannada, Marathi, Hindi, etc.). English + local language is mandatory.
6. Time the Notice correctly. Display or provide the notice before the registration form is filled out. Do not bury it in fine print or T&Cs; place it prominently.
7. Make Consent Withdrawal easy. Provide a clear, accessible mechanism (email, phone number, web form, SMS) for visitors to revoke consent anytime.
8. Audit and guide Exhibitor Notices. Require all exhibitors to provide Section 5-compliant notices at their booths. Include a Section 5 notice template in the exhibitor kit and make it a booth license condition.

Scenario: Trade Show Audit – Section 5 Compliance in Action

National Gem & Jewelry Expo, Delhi—August 2026

The organizer collects visitor data via registration booths (paper forms) and email pre-registration (online). A Section 5 compliance audit was conducted post-event.

Organizer Notice: ✓ Compliant

• Purpose: Badge printing, follow-up surveys, future event invitations (clear and itemised).
• Data Categories: Name, email, phone, company, designation, state.
• Rights disclosure: Includes access, correction, erasure, and consent withdrawal.
• Grievance Officer: Named (Rajesh Kumar), email (grievance@gemdelhiexpo.com), phone (+91-11-XXXX-XXXX), office address, and 30-day response time.
• Language: English + Hindi (appropriate for Delhi event).
• Timing: Notice displayed on registration booth signage before forms were handed out.

Exhibitor Notices (Random Sample of 10 booths): ✗ Non-Compliant (8 out of 10 failed)

• Most booths lacked any written notice; visitors verbally agreed to “share contact details.”
• No mention of Grievance Officer, data deletion timeline, or rights.
• One exhibitor’s booth notice said only “contact information collected” (too vague for Section 5).
• None provided notice in Hindi, despite the Delhi location and local audience.
• Three exhibitors collected visitor data via QR code scan with no notice displayed.

Compliance Gap: The organizer complied with Section 5; the organizer faces zero penalty. However, 80% of exhibitors failed to provide itemised notices. Each non-compliant exhibitor faces potential penalties up to ₹150 crore under Section 33.

Post-Audit Corrective Action:

• Organizer created a Section 5-compliant notice template in English and Hindi.
• Made exhibitor Section 5 compliance mandatory for future events; notices required to be displayed at every booth before data collection.
• Added “Section 5 Notice Compliance Checklist” to exhibitor kit with examples and compliance wording.
• Provided a Grievance Officer contact (organizer’s name and email) for issues arising from either organizer or exhibitor data collection.

Frequently Asked Questions

Q: Do both the organizer and exhibitors need to provide Section 5 notices?

A: Yes. Section 5 applies to every Data Fiduciary that collects personal data. If the organizer collects visitor data and an exhibitor also collects data at their booth, both must provide separate, itemised notices. A single umbrella notice from the organizer does not satisfy an exhibitor’s Section 5 obligation. Each entity collecting data must disclose its own purposes, categories, and grievance officer.

Q: Can we provide the Section 5 notice only in English at trade shows held outside India’s Hindi belt?

A: No. Section 5 requires the notice to be in the language of the data principal. The Eighth Schedule of the Indian Constitution lists official state languages. A show in Tamil Nadu must provide notice in Tamil; a show in Gujarat must provide in Gujarati; a show in Karnataka must provide in Kannada. English-only notices violate Section 5, even if English is widely understood. Bilingual notices (English + local language) are the minimum standard.

Q: What happens if a trade show organizer fails to provide a Section 5 notice before collecting visitor data?

A: The organizer is liable under Section 33 of DPDPA and faces penalties up to ₹150 crore. If the organizer collected data from, say, 5,000 visitors without a Section 5 notice, the aggregate liability could be substantial. Exhibitors who also failed to provide notices face separate penalties. Liability is not shared; each Data Fiduciary (organizer and each exhibitor) bears its own penalty risk.

Q: Can we use a privacy policy or event T&Cs instead of a Section 5 notice?

A: No. A privacy policy and terms & conditions are general documents that do not meet Section 5’s specific requirement for an itemised notice with purpose, data categories, rights, and Grievance Officer contact before or at the time of collection. Section 5 requires the notice to be provided separately and at the moment of data collection (or before). Both documents may be needed, but the itemised Section 5 notice must come first and must be standalone and prominent.

Q: How do we handle Section 5 notices for multi-day trade shows with different exhibitors each day?

A: Each exhibitor must provide their own Section 5 notice on the day(s) they are present. The organizer’s notice should explain that exhibitor notices will vary and direct visitors to read each exhibitor’s notice at their booth. The organizer’s notice should list only the organizer’s own data purposes and categories (badge printing, surveys, future event invitations). Exhibitor-specific purposes (lead follow-up, catalog sends, product demos) belong in exhibitor notices. This clarity prevents confusion and ensures Section 5 compliance for each Data Fiduciary.