Rule 9 — Contact Information of Person to Answer Questions About Processing

Section 8(9) of the Act requires a Data Fiduciary to publish the business contact information of a Data Protection Officer, where one is required, or another person able to answer questions about processing — "in such manner as may be prescribed." Rule 9 is that manner, and despite being one of the shorter rules in the set, it's specific enough to rule out two patterns that are common today: a static mention buried in a privacy policy, and a generic support inbox with nobody accountable behind it.

What Rule 9 actually requires

Every Data Fiduciary has to prominently publish, on its website or app, the business contact information of its Data Protection Officer — where the Act requires one — or of another person able to answer the Data Principal's questions about the processing of her personal data. That same contact information also has to appear in every response to a communication seeking to exercise rights under the Act. Two things are doing work in that sentence: "prominently," which rules out contact details technically present but effectively hidden three clicks deep in a privacy policy's final paragraph, and "every response," which means the requirement doesn't stop at a static webpage — it has to show up again, consistently, in the actual reply a Data Principal receives.

What doesn't satisfy it

A generic, unowned inbox that nobody is accountable for doesn't meet this standard, even if mail sent to it eventually gets read. Neither does a response that just says "refer to our privacy policy" instead of restating the contact information directly, nor a support agent replying without the authority or subject-matter knowledge to actually answer a processing question, nor a bot reply standing in for the accountable human Rule 9 requires. The rule is worded around a person able to answer — not a channel that eventually routes to one.

Why this matters in practice

Rule 9 functions as an accountability control more than a disclosure formality. A regulator testing compliance here isn't checking whether a name appears somewhere on a website — it's checking whether that named contact actually shows up, competently, when a real rights request comes in. The common gap is organisations that list a Data Protection Officer prominently on their website, satisfying the publication half of the rule, but then answer actual access or erasure requests from a no-reply or generic support address that never mentions that officer at all. The identity exists on paper and disappears the moment it would actually matter.

Illustration: an edtech platform publishes its Data Protection Officer's name and email on a "Privacy" page in its footer — technically prominent, technically compliant with the publication half of Rule 9. A parent emails a request to access her child's data through the platform's general support address instead, because that's the only contact channel the response emails ever reference. If the reply comes back from that generic address without restating the DPO's contact information, the platform has failed the "every response" half of Rule 9, regardless of how visible the footer link was.

How Rule 9 connects to the rest of the Rules and the Act

Rule 9 gives operational form to Section 8(9), and it sits directly alongside Rule 14's requirement that Data Fiduciaries publish the means by which Data Principals can exercise their rights and maintain a working grievance-redressal system under Section 8(10) — Rule 9's named contact is who actually has to be reachable through that system. It also connects to Section 10(2)(a), which requires a Significant Data Fiduciary specifically to appoint a Data Protection Officer — for every other Data Fiduciary, Rule 9's "another person able to answer" language is what fills that role instead.