The Act gives Data Principals rights. Rule 14 is what makes those rights operational — a published channel, a defined identifier, a capped grievance timeline, and support for someone acting on her behalf.
14. Rights of Data Principals. — (1) For enabling Data Principals to exercise their rights under the Act, the Data Fiduciary and, where applicable, the Consent Manager, shall prominently publish on its website or app, or both, as the case may be, — (a) the details of the means using which a Data Principal may make a request for the exercise of such rights; and (b) the particulars, if any, such as the username or other identifier of such a Data Principal, which may be required to identify her under its terms of service.
(2) To exercise the rights of the Data Principal under the Act, she may make a request to the Data Fiduciary to whom she has previously given consent for processing of her personal data, using the means and furnishing the particulars required by such Data Fiduciary for the exercise of such rights.
(3) Every Data Fiduciary and Consent Manager shall prominently publish on its website or app, or both, as the case may be, within a reasonable period not exceeding ninety days under its grievance redressal system for responding to the grievances of Data Principals and shall, for ensuring the effectiveness of the system in responding within such period, implement appropriate technical and organisational measures.
(4) To exercise the rights of the Data Principal under the Act, she may, in accordance with the terms of service of the Data Fiduciary and such law as may be applicable, nominate one or more individuals, using the means and furnishing the particulars required by such Data Fiduciary for the exercise of such right.
(5) In this rule, the expression "identifier" shall mean any sequence of characters issued by the Data Fiduciary to identify the Data Principal and includes a customer identification file number, customer acquisition form number, application reference number, enrolment ID, email address, mobile number or licence number that enables such identification.
Sections 11 through 14 of the Act give a Data Principal the right to access information about how her data is processed, the right to correction and erasure, the right to grievance redressal, and the right to nominate someone to act for her. Rule 14 doesn't add new rights — it prescribes how a Data Fiduciary and, where applicable, a Consent Manager have to make those existing rights actually exercisable in practice. A right that exists in the statute but has no defined channel, no published identifier requirements and no response deadline is not a right a Data Principal can reliably use.
Every Data Fiduciary and Consent Manager must prominently publish, on its website or app or both: the details of the means by which a Data Principal may request the exercise of her rights, and the particulars — such as a username or other identifier — that may be required to identify her under its terms of service. "Prominently" is doing real work here; a mechanism that technically exists but is buried several clicks into a privacy policy's fine print doesn't meet the standard a plain reading of Rule 14(1) sets.
To exercise her rights, a Data Principal makes a request to the Data Fiduciary she previously gave consent to for processing her personal data, using the published means and furnishing the particulars that Fiduciary requires. This keeps the request routed to the entity actually holding the relevant consent record, rather than any Data Fiduciary in general.
Every Data Fiduciary and Consent Manager must prominently publish its grievance redressal system, and must respond to grievances within a reasonable period not exceeding ninety days — implementing whatever technical and organisational measures are needed to actually meet that timeline. Ninety days is a ceiling, not a target to run out the clock against, and the rule expects the underlying process to be built to perform within it, not just to have a policy document that states it.
A Data Principal may, in accordance with a Data Fiduciary's terms of service and any applicable law, nominate one or more individuals to exercise her rights on her behalf — using the same published means and furnishing the same required particulars. This is the operational counterpart to the right to nominate under Section 14 of the Act, which exists specifically for situations of the Data Principal's death or incapacity.
Rule 14(5) defines "identifier" broadly: any sequence of characters the Data Fiduciary issues to identify the Data Principal, including a customer identification file number, customer acquisition form number, application reference number, enrolment ID, email address, mobile number, or licence number that enables identification. The definition is functional, not tied to any one type of credential — whatever a given Data Fiduciary actually uses to recognise its own Data Principals qualifies.
The recurring failure mode isn't refusing rights requests outright — it's a single generic support inbox handling access requests, correction requests, erasure requests and general complaints together, with no defined process, no service-level tracking, and no record of whether the 90-day cap was actually met for any given request. A channel that can't show where a request went, what identifier verification it required, and when it was resolved doesn't meet Rule 14(1) and 14(3) even if some team member eventually replies.
Illustration: a subscription app publishes a single "Contact Us" form for everything from billing questions to data-rights requests, with no stated timeline. A user asks for her account data to be erased; the request sits in the same queue as billing tickets for six weeks with no acknowledgment. Even if erasure eventually happens, the app can't demonstrate it met Rule 14(3)'s response-timeline expectation, because there was never a defined grievance-redressal system distinguishing rights requests from ordinary support traffic in the first place.
Rule 14 is the operational layer under Sections 11 to 14 of the Act — the rights to access, correction and erasure, grievance redressal, and nomination. It also interacts with Rule 9's requirement to publish a Data Protection Officer's or equivalent contact's business information, since that same published surface is often where a Data Principal first locates the rights-request channel Rule 14(1) requires. And it connects to Rule 8's retention timelines: erasure requests under Section 12 have to reach data that hasn't already been deleted or retained past its permitted purpose, so the two obligations are meant to work together, not independently.
30 minutes to pressure-test your rights-request process against Rule 14 — no obligation.
Book a Consultation