Rule 14
Handle Data Principal requests well inside 90 days
DPDP gives Data Principals rights to information, correction, erasure, nomination and grievance redressal. This guide sets up a process that closes requests well before any outer limit.
Short answer
The DPDP Rules do not set a separate statutory deadline for each rights request. Rule 14(3) caps the period you publish for responding to grievances at 90 days. A request you leave unanswered can become a grievance, so publish your grievance period, set an internal target for requests well inside 90 days, and run every request through intake, identity check, fulfilment and a recorded response (s.11 to s.14, Rule 14).
What the law sets, and what it leaves to you
The Act gives Data Principals the right to information about their personal data (s.11), to correction, completion, updating and erasure (s.12), to grievance redressal (s.13), and to nominate someone to exercise their rights on death or incapacity (s.14). They can also withdraw consent at any time (s.6(4)). The rights page covers each one.
Rule 14 requires you to publish how to make a request and what identifier you need. Rule 14(3) requires each Data Fiduciary to publish its period for responding to grievances, which shall not exceed 90 days, and to put measures in place to keep to it.
There is no separate number of days for answering a request. In practice the grievance limit is the outer edge: a Data Principal who gets no answer can raise a grievance, and must exhaust your grievance process before approaching the Board (s.13(3)).
Set your clock
| Setting | What to decide | Sample (Example Finance) |
|---|---|---|
| Internal target for requests | A working target well inside the grievance period | 15 days for access and correction |
| Published grievance period | Your period for responding to grievances, at most 90 days (Rule 14(3)) | Published as 30 days |
| Identity check | The identifier you ask for, as published (Rule 14) | Registered mobile number plus a one-time code |
| Escalation points | When a stalled request moves to a manager, then to the privacy lead | Day 10 to team lead, day 20 to privacy lead |
| Withdrawal of consent | How fast processing stops; s.6(6) says within a reasonable time | Marketing stops within 2 working days |
The sample column shows one possible setup for a fictional company. Choose your own periods with counsel.
From intake to closure
- 01Take the request in
Accept requests through the channels you published (Rule 14), such as a web form, the app or email. Log each one with an ID, for example DPR-1042 (sample), and the date received.
- 02Acknowledge
Confirm receipt, the ID and your target date. Include the contact who can answer questions about processing (Rule 9).
- 03Verify identity
Check the identifier you published before you disclose or change anything. Ask only for what you need to match the person to their records.
- 04Find the data
Search every system that may hold the person's data, including support tools, analytics and file shares. Use your records of processing so no system is missed.
- 05Fulfil
For access, give a summary of the personal data and processing, and the identities of other fiduciaries and processors you shared it with (s.11). For correction or erasure, act under s.12 and have processors erase too (s.8(7)). For withdrawal, stop processing within a reasonable time (s.6(6)); for nomination, record the nominee (s.14).
- 06Respond and close
Reply in plain language with what you did, anything you could not do and why, and how to raise a grievance. Record the response date.
Hard cases
- Data shared with others. A person can ask which other fiduciaries and processors received their data (s.11), so keep a sharing log per purpose.
- Backups. Note how erased data is handled in backups and when the backup copy expires, and say so in your response.
- Legal retention. s.8(7) requires erasure unless a law requires you to keep the data. Name the law when you decline part of an erasure request.
- Logs. Rule 6 and Rule 8(3) require some logs and data to be kept for at least one year. Keep them, and use them only for their stated purpose.
- Parents and guardians. For a child, or a person with disability who has a lawful guardian, the Data Principal includes the parent or lawful guardian, so verify that relationship.
- Nominees. When a nominee acts on death or incapacity, verify both the nominee and the event (s.14).
Request handling checklist
- Request method and identifier published (Rule 14)
- Grievance period published, 90 days or less (Rule 14(3))
- Internal target set well inside the grievance period
- Rule 9 contact included in every response
- Identity check defined for each channel
- System list for searches kept current
- Processor erasure instructions in contracts (s.8(7))
- Every request and response logged with dates
Under s.13(3), a Data Principal must exhaust your grievance process before approaching the Board, and the Board has no members yet. A clear internal process matters all the more.
How TruePrivacy helps
People submit and track requests through a branded privacy center, and download their data through a secure link. Data Principal requests covers access, correction, erasure, consent withdrawal and nomination, verifies identity before work starts, fans tasks out to connected systems, and keeps an audit trail.
Rule 14(3) caps your published grievance response period at 90 days. TruePrivacy runs every rights request and grievance against that outer limit, so you can close them sooner; the grievance desk adds categories, SLA states and escalation. Related template: the DSR request form.
Does DPDP give 90 days to answer a data request?
Not as such. Rule 14(3) caps your published grievance response period at 90 days. There is no separate statutory deadline per request, so set your own target well inside that limit.
What must we publish about rights?
How a Data Principal makes a request and the identifier you need (Rule 14), your grievance response period of no more than 90 days, and the contact who answers questions about processing (Rule 9).
Can we refuse an erasure request?
You must erase when consent is withdrawn or the purpose is no longer served, unless a law requires you to keep the data (s.8(7)). Explain any partial refusal and name the law.
When can a person go to the Data Protection Board?
Only after exhausting your grievance redressal process (s.13(3)). The Board has no members yet.
Your DPDP plan, starting today
Core obligations for data fiduciaries begin on 13 May 2027.
Core obligations begin