Rule 14, rights of Data Principals

(1) The Data Fiduciary and Consent Manager must prominently publish on its website or app: (a) the means by which a Data Principal may make a request to exercise her rights; and (b) the particulars, if any, such as a username or other identifier, needed to identify her.

(2) She exercises rights by making a request to the Data Fiduciary to whom she has previously given consent, using the published means and particulars.

(3) The Data Fiduciary and Consent Manager must publish the period within which they will respond to grievances, being a reasonable period not exceeding ninety days, and must implement appropriate technical and organisational measures to meet it. (Verify the ninety-day figure against the Gazette; some commentary reports different numbers.)

(4) She may nominate one or more individuals under Act s.14, in accordance with the terms of service and applicable law.

(5) "Identifier" means any sequence of characters issued by the Data Fiduciary to identify her, such as a customer ID, enrolment ID, email address, mobile number or licence number.

Read Rule 14(2) against Act s.11(1) and s.12(1). Both are worded around processing where she has previously given consent, including s.7(a) consent. Rights machinery under DPDP is narrower than a GDPR DSAR programme, and advice should not over-build it.