Rule 14 explained: this guide covers what it means, who it applies to, the step-by-step process, documents required, fees, due dates and penalties in India — so you can stay compliant with confidence and avoid costly mistakes.
Rule 14 sets out the practical route for a Data Principal to use her rights under the Act. The Data Fiduciary, and the Consent Manager where applicable, must publish how to make a request and what particulars are needed. The Data Principal makes the request to the Data Fiduciary to whom she gave consent, and may nominate someone to act.
Rule 14 is in the group that, under rule 1(4), comes into force eighteen months after the date of publication of the Gazette. The Data Fiduciary and, where applicable, the Consent Manager prominently publish the means for making a request and the particulars (such as a username or other identifier) needed to identify her. She makes the request to the Data Fiduciary to whom she previously gave consent, and may nominate one or more individuals in line with terms of service and applicable law. Sub-rule (3), on grievances, is covered separately.
Rule 14 and the Act
Rule 14 supports the Data Principal's rights under sections 11 to 15 of the Act: the right to access information, the right to correction and erasure, the right of grievance redressal, the right to nominate and the duties of a Data Principal. Sub-rule (3), the ninety-day grievance system, is in our article on rules 9 and 14(3); this article covers sub-rules (1), (2), (4) and (5).
Rule 1(4) places rule 14 in the group that comes into force "eighteen months after the date of publication of this Gazette". Counting from the Gazette date of 13 November 2025, eighteen months end in mid-May 2027; confirm the exact date of publication before relying on a date. See rules 1 and 2.
A rights-request page is customer-facing and has to match what the Rule says; a legal consultation can check yours against sub-rules (1), (2), (4) and (5).
Rule 14(1): publish the means and the particulars
"For enabling Data Principals to exercise their rights under the Act, the Data Fiduciary and, where applicable, the Consent Manager, shall prominently publish on its website or app, or both, as the case may be," two things:
- (a) "the details of the means using which a Data Principal may make a request for the exercise of such rights"; and
- (b) "the particulars, if any, such as the username or other identifier of such a Data Principal, which may be required to identify her under its terms of service".
The duty has three elements. Publication is "prominent" and on the website or app. The Data Fiduciary says how to make a request (a form, an email address, an in-app setting) and says what particulars it will ask for to identify the person, "if any". If it needs only a registered email, it says so. "Where applicable" brings in the Consent Manager, which also deals with Data Principals' requests on its platform.
The Rule does not prescribe the means. The Data Fiduciary chooses them and describes them, and the same means should be consistent with the description in the notice under rule 3, which must describe how she can exercise her rights.
Example (invented): StudyNest, an online tutoring site, publishes on its privacy page a link to a "My data requests" form and states that it will ask for the registered mobile number and the enrolment ID to identify the user.
Rule 14(2): whom she asks and how
"To exercise the rights of the Data Principal under the Act, she may make a request to the Data Fiduciary to whom she has previously given consent for processing of her personal data, using the means and furnishing the particulars required by such Data Fiduciary for the exercise of such rights."
| Element | Text |
|---|---|
| Who asks | The Data Principal |
| Whom | "the Data Fiduciary to whom she has previously given consent for processing of her personal data" |
| How | "using the means and furnishing the particulars required by such Data Fiduciary" |
Two points follow. The request goes to the Data Fiduciary to whom she gave consent; the text names no one else. And she follows the Data Fiduciary's published means and gives its required particulars, which link sub-rule (2) to sub-rule (1). The sub-rule is silent on a Data Principal whose data is processed on a ground other than consent (the Act's other grounds are in section 4); it speaks only of a Data Fiduciary "to whom she has previously given consent".
Rule 14(4): nomination
"To exercise the rights of the Data Principal under the Act, she may, in accordance with the terms of service of the Data Fiduciary and such law as may be applicable, nominate one or more individuals, using the means and furnishing the particulars required by such Data Fiduciary for the exercise of such right."
The Data Principal may nominate "one or more individuals". Three conditions: the nomination is in accordance with the Data Fiduciary's terms of service, in accordance with "such law as may be applicable", and made through the Data Fiduciary's means and particulars. The Act's right to nominate is in section 14. The Rules do not say what the nominee may do beyond "to exercise the rights", and do not set out the events (death or incapacity) in which a nominee acts; those are in the Act's section, not in rule 14.
Rule 14(5): "identifier"
"In this rule, the expression 'identifier' shall mean any sequence of characters issued by the Data Fiduciary to identify the Data Principal and includes a customer identification file number, customer acquisition form number, application reference number, enrolment ID, email address, mobile number or licence number that enables such identification."
The definition has two parts: a general one ("any sequence of characters issued by the Data Fiduciary to identify the Data Principal") and a list of inclusions. It is broad: an email address or mobile number counts as an identifier if it "enables such identification". Note that "issued by the Data Fiduciary" sits in the opening words, while the list includes an email address and mobile number, which the Data Principal usually supplies. The Rule does not reconcile the two and the list is quoted as printed.
Putting it together
A request flow built for rule 14 would have: a prominent page (sub-rule (1)); a clear statement of the identifier needed (1)(b), (5); a means that a Data Principal who gave consent can use (2); an option to nominate (4); and a grievance route with a published response period (sub-rule (3)). Rule 14 states no penalty; see the Schedule to the Act. For older overview reading, see rights of a Data Principal, sections 11 to 14.
Need help building a rights-request page?
A rights page works when the means, the identifier and the nomination option all match the published terms. Speak to our legal team to draft the wording and align it with your notice.
Key takeaways
- Rule 14 starts eighteen months after the date of publication of the Gazette (rule 1(4)).
- The Data Fiduciary and, where applicable, the Consent Manager prominently publish the means to make a request and the particulars (such as an identifier) needed.
- The Data Principal asks the Data Fiduciary to whom she has previously given consent.
- She may nominate one or more individuals, in accordance with terms of service and applicable law.
- "Identifier" is any sequence of characters issued to identify her, including email address and mobile number.
- Later amendments and notifications should be checked.
Read next
- Rules 9 and 14(3): contact information and the ninety-day grievance system
- Rule 3: notice by a Data Fiduciary to a Data Principal
- Section 14 of the DPDP Act: right to nominate
- Rights of a Data Principal, sections 11 to 14
Disclaimer: Based on the Digital Personal Data Protection Rules, 2025 as notified in the Gazette of India on 13 November 2025 (G.S.R. 846(E)), as consulted on 2 October 2026. The Rules come into force in three stages under rule 1; later amendments, notifications and anything published by the Data Protection Board of India should be checked. This article is general information, not legal advice; check the official text before acting.