Rule 14
Rule 14 data principal requests
Rule 14 sets how people exercise their rights under the Act and caps how long you can take to answer grievances. Here is what to publish and how to run the work.
Short answer
Rule 14 of the DPDP Rules, 2025 requires each Data Fiduciary to publish how Data Principals can make requests to exercise their rights and which identifier they need to give. Rule 14(3) requires each Data Fiduciary and Consent Manager to publish a period for responding to grievances that does not exceed 90 days, and to keep to it. Rule 14 also covers nomination, and it starts on 13 May 2027.
What Rule 14 asks you to publish
- How Data Principals make requests to exercise their rights under the Act.
- Which identifier they must give so you can find their data.
- Your period for responding to grievances, which cannot exceed 90 days.
- How nomination works.
Under Rule 9, also publish the business contact of your DPO or of the person who answers questions about processing, and mention it in every response to a Data Principal.
Publish all of this on your website or app where people will look for it, such as your privacy notice or account settings.
The requests you will receive
| Request | Source | What it involves |
|---|---|---|
| Access to information | s.11 | A summary of the personal data and its processing, and who else it was shared with |
| Correction, completion, updating | s.12 | Fixing or completing the data, which also supports accuracy under s.8(3) |
| Erasure | s.12, s.8(7) | Erasing the data, and having processors erase it, unless a law requires retention |
| Consent withdrawal | s.6(4), s.6(6) | Stopping processing within a reasonable time, and having processors stop |
| Nomination | s.14, Rule 14 | Recording a person to act on the Data Principal's death or incapacity |
| Grievance | s.8(10), s.13 | Answering within your published period of no more than 90 days |
The rights of the Data Principal page explains each right in full.
What the 90 days covers
Rule 14(3) caps the grievance response period at 90 days. It is not a separate deadline for each access or erasure request. The cap applies to Consent Managers as well as Data Fiduciaries.
Publish a response period for rights work as well, and aim to finish well inside 90 days. A slow answer can turn into a grievance, and a Data Principal who has exhausted your grievance redressal can approach the Board (s.13(3)).
Running a request from intake to close
- 01Intake
Accept requests through the routes you published, and log the date received.
- 02Verify identity
Match the requester to the published identifier before you search or disclose anything.
- 03Find the data
Search each system, and each processor, that holds the person's data.
- 04Act
Provide, correct, erase or record, as the request needs.
- 05Respond
Reply in plain language and include your contact person (Rule 9).
- 06Close and record
Keep a record of what you did and when, for audit and for any grievance.
The 90-day handling guide adds roles and service levels.
Example Lending, request DPR-1042 (sample): erasure; received 3 June 2027; identity verified 4 June; two processors told to erase; closed 18 June; reply named the contact person under Rule 9.
Decide and publish your service levels
- A response period for access, correction and erasure, set by you and well inside 90 days.
- A grievance response period of no more than 90 days, with measures to keep to it (Rule 14(3)).
- When your clock starts, stated in what you publish.
- Who owns each step, including work that needs a processor's help.
When you cannot do what is asked
Erasure can be declined where a law requires you to keep the data (s.8(7)). Tell the person why, name the requirement, and record it.
If you cannot verify identity against the published identifier, say what is missing rather than closing the request silently. The request form template helps you collect what you need up front.
How TruePrivacy helps
Rule 14(3) caps your published grievance response period at 90 days. TruePrivacy runs every rights request and grievance against that outer limit, so you can close them sooner.
The privacy center takes requests and shows their status. Data Principal requests verify identity before work starts and fan tasks out to connected systems, with email templates and an audit trail, and the grievance desk adds categories, SLA states and escalation.
Is 90 days the deadline for access and erasure requests?
The 90-day figure in Rule 14(3) caps the published grievance response period. Publish your own period for rights work and aim to finish well inside 90 days.
How long can a grievance take under DPDP?
No longer than the period you publish, which cannot exceed 90 days (Rule 14(3)).
What identifier can we ask for?
Rule 14 requires you to publish which identifier a Data Principal must give. Ask only for what you need to find and verify their data.
Can we refuse an erasure request?
You may keep data where a law requires retention (s.8(7)). Explain why to the person and record it.
When does Rule 14 start?
On 13 May 2027 (Rule 1).
Keep reading
- Rights of the data principal under DPDP Sections 11 to 14
- Handle Data Principal requests well inside 90 days Rule 14
- Data principal requests (DSR) under DPDP Sections 11–14 · Rule 14
- Grievance redressal for DPDP fiduciaries Section 13 · Rule 14(3)
- Data principal request form template Template
- A privacy center for your Data Principals Rule 14 · Rule 3
Your DPDP plan, starting today
Core obligations for data fiduciaries begin on 13 May 2027.
Core obligations begin