DPDP reference
Rule 14: Rights of Data Principals
Last checked 6 Nov 2026
A Data Fiduciary or Consent Manager prominently publishes how to make a request, and the particulars, such as a username or other identifier, needed to identify the person (Rule 14(1)). The Data Principal then uses those means (Rule 14(2)).
It also publishes a period for answering grievances, not exceeding ninety days, and keeps measures to meet that period (Rule 14(3)). A Data Principal may nominate one or more individuals, using the means and particulars required (Rule 14(4)).
- Applies to
- Every Data Fiduciary and Consent Manager.
- Starts
- 13 May 2027 (Rule 1(4)).
- Penalty
- Up to ₹50 crore (s.33, Schedule item 7).
- Source
- G.S.R. 846(E), Digital Personal Data Protection Rules, 2025, rule 14; G.S.R. 892(E), corrigenda
Questions
Must the rights process be published?
Yes, prominently on the website or app, with the identifying particulars required (Rule 14(1)).
Is ninety days the limit for access requests too?
The Gazette text of Rule 14(3) sets ninety days for grievances. It does not separately state a period for access, correction or erasure requests.
Related
- Section 11: Right to access information about personal data
- Section 12: Right to correction and erasure of personal data
- Section 13: Right of grievance redressal
- Section 14: Right to nominate
Next
Not legal advice.