# DPDP Rules 2025, Rule 14: rights requests and grievances

> Canonical page: https://mksd0398.github.io/dpdp-act-skill/rules/rule-14-rights-of-data-principals/
> Not legal advice. Educational compliance reference only; no lawyer-client relationship arises from its use and the author is not a lawyer. Verify statutory text against the Gazette of India and consult qualified Indian legal counsel before acting.

Digital Personal Data Protection Rules, 2025. Secondary-sourced from the PIB release and cross-checked sources; verify against the notified Gazette text before external use.

## Rule 14, rights of Data Principals

**(1)** The Data Fiduciary and Consent Manager must **prominently publish on its website or app**:
  (a) the **means** by which a Data Principal may make a request to exercise her rights; and
  (b) the **particulars**, if any, such as a username or other identifier, needed to identify her.

**(2)** She exercises rights by making a request to the Data Fiduciary **to whom she has previously
given consent**, using the published means and particulars.

**(3)** The Data Fiduciary and Consent Manager must **publish the period within which they will
respond to grievances**, being a **reasonable period not exceeding ninety days**, and must
implement appropriate technical and organisational measures to meet it. *(Verify the ninety-day
figure against the Gazette; some commentary reports different numbers.)*

**(4)** She may **nominate one or more individuals** under Act s.14, in accordance with the terms of
service and applicable law.

**(5)** "Identifier" means any sequence of characters issued by the Data Fiduciary to identify her,
such as a customer ID, enrolment ID, email address, mobile number or licence number.

**Read Rule 14(2) against Act s.11(1) and s.12(1).** Both are worded around processing where she
has previously given consent, including s.7(a) consent. Rights machinery under DPDP is narrower
than a GDPR DSAR programme, and advice should not over-build it.