Skip to main content
DPDP Compliance
Home/DPDP Rules/Rule 14 — Rights of Data Principals
DPDP Rules, 2025 · Rule 14 of 23

Rule 14: Rights of Data Principals

Rule 14 is the operational backbone of every individual's rights under the Act — how a request actually gets made, how quickly it must be answered, and how someone can act on another person's behalf.

Effective from 13 May 2027Reviewed September 2026
Previous: Rule 13 — Additional Obligations of Significant Data FiduciaryNext: Rule 15 — Transfer of Personal Data Outside the Territory of India
CommencementEffective from 13 May 2027
DPDP Rules, 2025 · Rule 14 of 23

Quick summary

In plain terms: Data Fiduciaries and Consent Managers must publish clear means for exercising rights and respond to grievances within a reasonable period not exceeding ninety days, and must let a Data Principal nominate someone else to exercise her rights for her.

What Rule 14 says

  • The Data Fiduciary (and Consent Manager, where applicable) must prominently publish the means of making a rights request and any particulars (like a username or identifier) needed to identify the Data Principal.
  • A Data Principal can make a rights request to the Data Fiduciary she previously gave consent to, using the published means and particulars.
  • Every Data Fiduciary and Consent Manager must prominently publish, and implement appropriate technical and organisational measures to meet, a grievance-redressal response period not exceeding ninety days.
  • A Data Principal may nominate one or more individuals to exercise her rights on her behalf, in accordance with the Data Fiduciary's terms of service and applicable law.
  • “Identifier” covers any sequence of characters a Data Fiduciary uses to identify a Data Principal — customer ID, acquisition form number, application reference number, enrolment ID, email, mobile number or licence number.

Breaking it down

Three things to hold onto here:

The 90-day figure is a ceiling, not a target. “A reasonable period not exceeding ninety days” means Data Fiduciaries should aim to respond faster where reasonably possible — ninety days is the outer limit the Rule tolerates, not a benchmark to comfortably use every time.

You have to tell people how to make a request, not just accept one when it arrives. Publishing the means of making a request, and any identifying particulars needed, has to happen upfront and prominently — the same “findable, not buried” standard that runs through several other rules.

Nomination is a real, usable right, not a footnote. A Data Principal can formally authorise someone else — a family member, for instance — to exercise her rights for her, within the Data Fiduciary's terms of service. This matters especially for elderly users or others who may need assistance navigating a rights request themselves.

Why this rule matters

Rights that exist on paper but have no clear, timely process to exercise them aren't meaningfully different from no rights at all. Rule 14 is what turns the Act's rights chapter into something a Data Principal can actually use.

Real-world example

Example: A user requesting her data be correctedA user notices her registered address is outdated on a delivery app and wants it corrected. The app has a clearly published “Manage My Data” section describing exactly how to submit a correction request and what identifying details (like her registered mobile number) are needed. She submits the request, and the app's grievance-redressal system — built to meet its published response-time commitment, well inside the 90-day ceiling — confirms the correction within a few days. Separately, her elderly father, a user of the same app, has formally nominated her to handle rights requests on his behalf, so she can also manage his account settings when needed.

Who needs to care about this rule

  • Customer support and trust & safety teams handling rights requests day to day.
  • Product teams designing the “manage my data” or privacy-settings experience.
  • Legal/compliance teams setting and monitoring the internal SLA against the 90-day ceiling.

Common questions

Does every rights request have to take up to 90 days?
No — ninety days is the maximum the Rule tolerates for grievance redressal, described as “a reasonable period not exceeding” that limit, not a standard turnaround target.
Can someone else exercise my rights on my behalf?
Yes — a Data Principal can nominate one or more individuals to exercise her rights for her, in line with the Data Fiduciary's terms of service and applicable law.
What information can a Data Fiduciary require to process a rights request?
It can require the particulars it has published as needed to identify the Data Principal — such as a username, customer ID, or other registered identifier.

Related rules

Rule 13 — Additional Obligations of Significant Data Fiduciary

Read the previous rule in sequence.

Read Rule 13

Rule 15 — Transfer of Personal Data Outside the Territory of India

Continue to the next rule in sequence.

Read Rule 15

Full DPDP Rules Guide

Back to the overview page, with the complete rule-by-rule guide and Schedules at a glance.

View all 23 rules

Data Principal Rights

The Act's full rights chapter — access, correction, erasure, grievance redressal and nomination.

Read about Data Principal rights