Rule 14 — DPDP Rules, 2025
(1) A Data Principal may exercise her rights under Chapter III by submitting a request to the Data Fiduciary through a published channel. (2) Every Data Fiduciary shall— (a) publish the contact information specified under Rule 9; (b) acknowledge receipt of a request from a Data Principal within such period as may be specified; (c) respond to the request within such period as may be specified; (d) accept and process requests made on behalf of the Data Principal by an authorised representative. (3) A Data Fiduciary may verify the identity of the Data Principal before processing a request.
Source: Digital Personal Data Protection Rules, 2025. Official text available at truconsent.io/resources/dpdp-rules.pdf.
Rule 14 makes Chapter III rights operational by prescribing four requirements: a published channel (linked to Rule 9), acknowledgement within a specified period, resolution within a specified period, and a mechanism to accept requests from authorised representatives (including nominees under Section 14). The Board will specify the exact timelines — but Data Fiduciaries should design systems capable of acknowledging within 24 hours and resolving within 30 days (common benchmarks from comparable frameworks). Rule 14(3)'s identity verification is permitted, not optional — use it to prevent Section 15(b) impersonation.
When a Data Principal submits an erasure request, the Data Fiduciary must acknowledge receipt within the prescribed period. Acknowledgement means more than an auto-reply — it should confirm that the request has been received, will be processed, and give a reference number the Data Principal can use if they need to follow up. Silence on receipt is a Rule 14 violation.
A Data Principal's lawyer submits an access request on their behalf. Under Rule 14(2)(d), the Data Fiduciary must have a mechanism to accept and process this request. This requires verifying that the representative is authorised — by checking a power of attorney or a nomination registration from Section 14. A blanket refusal to deal with representatives is non-compliant.
Rule 14(3) allows identity verification before processing a request — this is the Section 15(b) impersonation protection. However, the verification process cannot be so burdensome that it effectively prevents the exercise of rights. A verification step that takes three weeks or requires notarised documents will be treated by the Board as an effective denial of rights.