Rule 14 · Rule 3
A privacy center for your Data Principals
Rule 14 asks you to publish how people make requests. The privacy center is where they make them, under your brand.
Sample workspace
Privacy center Example Finance
- DPR-1042 · AccessIn progress
- Loan updatesGiven
- Marketing emailsWithdrawn
- Your dataDownload by secure link
DPR-1042
- Access request submitted
- Identity verified
- Data ready to download through a secure link
Short answer
Rule 14 asks every Data Fiduciary to publish how Data Principals make requests and which identifier they need, and Rule 3 asks each notice to give the means, with a link, to withdraw consent and exercise rights. TruePrivacy's privacy center is a branded self-service portal where Data Principals submit requests, manage preferences, check request status and download their data through a secure link. It gives your notice links one place to point to.
What the privacy center does
Rule 14 asks you to publish how Data Principals make requests, and Rule 3 asks your notice to link to the means to withdraw consent and exercise rights. One portal can serve both, under your own brand. People can come back to it to check status or change their choices.
Access, correction, erasure, consent withdrawal and nomination requests, with identity verification before work starts.
People review and change their consent choices at any time, which supports withdrawal under s.6(4).
People see where their request stands.
People download their data through a secure link.
Branded to your organisation, with support for multiple brands and workspaces.
How to put the privacy center to work
- 01Brand the portal
Set it up under your brand, and run separate brands if you have them.
- 02Publish the route
Link the privacy center from your website, app and notices, and state the identifier a person needs (Rule 14).
- 03Take requests
Requests are verified and run against the clock in rights requests. Tasks then fan out to connected systems.
- 04Close the loop
People check status and, for access requests, download their data through a secure link. Every action is logged on the audit trail.
Mapped to the Act and Rules
| Duty | Section or rule | What TruePrivacy does |
|---|---|---|
| Publish how to make requests and the identifier needed | Rule 14 | A branded portal to publish and link to |
| Means, with a link, to withdraw consent and exercise rights | Rule 3 | Preference management and requests in one place |
| Withdraw consent as easily as it was given | s.6(4) | Preferences people change themselves |
| Summary of personal data and its processing | s.11 | Download through a secure link |
| Correction, completion, updating and erasure | s.12 | Correction and erasure requests submitted in the portal |
| Nomination | s.14 | Nomination requests |
What you still publish yourself
Rule 3 also asks your notice to show how to complain to the Board, and Rule 9 asks you to publish the business contact of the person who answers questions about processing, or of the DPO for an SDF. Write those into your notice and website. Run grievances through your grievance desk, with its published response period.
Identity verification runs before work starts on a request, so choose an identifier you already hold for each person and publish it (Rule 14). The request form template can help you draft what to ask for.
Works with
What is a privacy center?
A self-service portal where Data Principals submit requests, manage preferences, check request status and download their data. TruePrivacy's is branded to your organisation.
What does Rule 14 ask me to publish?
How Data Principals make requests and which identifier they need. A privacy center is one practical place to publish and take those requests.
Can people withdraw consent in the privacy center?
Yes. They can manage their preferences there, and consent withdrawal is one of the request types.
Your DPDP plan, starting today
Core obligations for data fiduciaries begin on 13 May 2027.
Core obligations begin