--- title: "Rule 14: Rights of Data Principals" url: https://dpdp.myndsolution.com/wiki/rules/rule-14-rights-of-data-principals/ description: "Rule 14 of the Digital Personal Data Protection Rules, 2025 (Rights of Data Principals). Official text verbatim, comes into force on 13 may 2027, with the…" kind: rule updated: 2026-09-09 official_source: https://egazette.gov.in/WriteReadData/2025/267650.pdf text_type: official-text-plus-interpretation publisher: MYND Integrated Solutions license: Official Government of India texts are reproduced verbatim (public domain / open government data). Interpretation is CC BY 4.0, MYND Integrated Solutions. disclaimer: Not legal advice. Official text prevails over any interpretation. html_version: https://dpdp.myndsolution.com/wiki/rules/rule-14-rights-of-data-principals/ --- # Rule 14: Rights of Data Principals *The Digital Personal Data Protection Rules, 2025, G.S.R. 846(E) dated 13 November 2025. Comes into force on 13 May 2027.* ## Official text - **(1)** For enabling Data Principals to exercise their rights under the Act, the Data Fiduciary and, where applicable, the Consent Manager, shall prominently publish on its website or app, or both, as the case may be, — - **(a)** the details of the means using which a Data Principal may make a request for the exercise of such rights; and - **(b)** the particulars, if any, such as the username or other identifier of such a Data Principal, which may be required to identify her under its terms of service. - **(2)** To exercise the rights of the Data Principal under the Act, she may make a request to the Data Fiduciary to whom she has previously given consent for processing of her personal data, using the means and furnishing the particulars required by such Data Fiduciary for the exercise of such rights. - **(3)** Every Data Fiduciary and Consent Manager shall prominently publish on its website or app, or both, as the case may be, within a reasonable period not exceeding ninety days under its grievance redressal system for responding to the grievances of Data Principals and shall, for ensuring the effectiveness of the system in responding within such period, implement appropriate technical and organisational measures. - **(4)** To exercise the rights of the Data Principal under the Act, she may, in accordance with the terms of service of the Data Fiduciary and such law as may be applicable, nominate one or more individuals, using the means and furnishing the particulars required by such Data Fiduciary for the exercise of such right. - **(5)** In this rule, the expression “identifier” shall mean any sequence of characters issued by the Data Fiduciary to identify the Data Principal and includes a customer identification file number, customer acquisition form number, application reference number, enrolment ID, email address, mobile number or licence number that enables such identification. ## Made under - [s. 11 Right to access information about personal data](https://dpdp.myndsolution.com/wiki/act/section-11-right-to-access-information-about-personal-data/) - [s. 12 Right to correction and erasure of personal data](https://dpdp.myndsolution.com/wiki/act/section-12-right-to-correction-and-erasure-of-personal-data/) - [s. 13 Right of grievance redressal](https://dpdp.myndsolution.com/wiki/act/section-13-right-of-grievance-redressal/) - [s. 14 Right to nominate](https://dpdp.myndsolution.com/wiki/act/section-14-right-to-nominate/) ## Interpretation in plain English (not legal advice) > This is a plain-English interpretation of the official text, prepared by the DPDP Wiki editorial team. It is not the law and not legal advice, and it may be incomplete or wrong. Always rely on the official text of the Act, the Rules and the notifications, and take advice from a qualified professional for your situation. A Data Fiduciary (the entity deciding how and why personal data is processed) and a Consent Manager (an entity that manages consent on behalf of individuals) must clearly publish instructions on their website or app. These instructions must explain how a Data Principal (the individual to whom the data belongs) can exercise their rights under the law. They must also list any specific details needed to identify the individual, such as a username or other identifier. An identifier can be any sequence of characters issued by the Data Fiduciary, such as an email address, mobile number, or customer ID. To exercise their rights, a Data Principal can submit a request to a Data Fiduciary to whom they previously gave consent. The individual must use the specific methods and provide the identifying details required by that Data Fiduciary. Additionally, a Data Principal has the right to nominate one or more individuals to exercise these rights on their behalf, following the Data Fiduciary's terms of service and applicable laws. Data Fiduciaries and Consent Managers must also prominently publish details about their grievance redressal system on their website or app. This system must respond to the grievances of Data Principals within a reasonable period, which cannot exceed ninety days. To guarantee that grievances are handled within this ninety-day limit, these entities must put appropriate technical and organizational measures in place. ### Key points - Data Fiduciaries and Consent Managers must prominently publish how Data Principals can exercise their rights and what identifying details are required. (1) - Data Principals can exercise their rights by making a request using the methods and details required by the Data Fiduciary. (2) - A grievance redressal system must be published and must respond to grievances within a reasonable period not exceeding ninety days. (3) - Data Fiduciaries and Consent Managers must implement technical and organizational measures to ensure grievances are answered within the ninety-day limit. (3) - Data Principals can nominate one or more individuals to exercise their rights, subject to the Data Fiduciary's terms and applicable law. (4) - An identifier includes any sequence of characters issued to identify the Data Principal, such as an email, mobile number, or customer ID. (5) ### Common misreadings - People might assume a Data Fiduciary has an unlimited amount of time to respond to a grievance, but the rule explicitly caps the response time at a reasonable period not exceeding ninety days. - People might think a Data Principal can only nominate a single person to exercise their rights, but the text allows the nomination of one or more individuals. *Interpretation prepared 2026-09-09 from the official text only; the official text prevails.* --- Cite as: DPDP Rules, 2025, r. 14. Official source: https://egazette.gov.in/WriteReadData/2025/267650.pdf