Rule 14

Rights of Data Principals

Requires the means of making a rights request to be published, and caps the grievance response at ninety days.

Read this before you cite anything here

These pages are a plain-English restatement, written to help you find the right provision and understand what it asks of you. They are not the text of the statute, and nothing here should be quoted as though it were. Section and rule numbers are exact, and every page names its source.

What it says

(1): To enable Data Principals to exercise their rights, the Data Fiduciary and, where applicable, the Consent Manager must prominently publish on its website or app the means by which a request may be made, and the particulars of any identifier required to identify the Data Principal.
(2): The Data Principal may make a request using the published means and particulars.
(3): Every Data Fiduciary and Consent Manager must publish its grievance redressal system and the period within which it will respond, which must not exceed ninety days, and must implement appropriate technical and organisational measures to ensure the system is effective.
(4): A Data Principal may nominate one or more individuals in accordance with the terms of service.
(5): Defines identifier, including a customer identification number, application reference number, enrolment identifier, email address, mobile number or licence number.

In practice

Ninety days is a ceiling, not a target, and it is separate from the breach clocks in Rule 7. The one that catches firms out is sub-rule (1): the request route has to be published in advance, so a business that handles requests informally by email is non-compliant even if it answers every one of them quickly.

s.11Right to access information about personal dataGives the Data Principal the right to a summary of her data and the processing, and to know who it has been shared with.s.12Right to correction and erasure of personal dataGives the Data Principal the right to have her data corrected, completed, updated or erased.s.13Right of grievance redressalGives the Data Principal a right to readily available grievance redressal, and makes exhausting it a precondition to approaching the Board.s.14Right to nominateLets a Data Principal nominate someone to exercise her rights if she dies or becomes incapable of exercising them.Rule 9Contact information of the person answering questions about processingRequires the contact details of the DPO, or of a person who can answer processing questions, to be published prominently and repeated in every rights-request response.

The DPDP brief

One email a month. What moved in the Act, and what our scans found.

Rule 14 is not in force yet. If that date moves, or the Board says anything about how it will be read, you will get one email about it and nothing else.

I have read the notice below and I consent to Gevox using my email address to send me the DPDP brief.

Notice, given under Section 5 and Rule 3

What we collect: your email address, the date you subscribed, the page you subscribed from, and your IP address. Why: to send you the Gevox DPDP brief, roughly monthly. Nothing else. We do not sell or share this list. Withdrawing: every issue carries a one-click unsubscribe that needs no login and asks no questions. Your rights: you can ask for a copy of this data, have it corrected, or have it erased, and you can complain to our Grievance Officer at grievance@gevox.in or to the Data Protection Board of India.

Notice version 2026-09-07.1. We store this text as it appears here, against your consent, so both are provable later.Privacy policy

What it says

In practice

Read next