Rule 9 — DPDP Rules, 2025
Every Data Fiduciary shall publish the business contact information of a person who is able to answer, on behalf of the Data Fiduciary, questions from a Data Principal about the processing of her personal data, including the exercise of her rights under Chapter III.
Source: Digital Personal Data Protection Rules, 2025. Official text available at truconsent.io/resources/dpdp-rules.pdf.
Rule 9 is one sentence, but it rules out the two most common approaches organisations currently use for data rights requests: a generic privacy inbox that gets no responses, and a FAQ page that tells users to 'contact us through the website'. Rule 9 requires publishing business contact information for a person — identifiable, reachable, capable of answering questions. This does not have to be a DPO (only Significant Data Fiduciaries need a DPO under Section 10) — it can be a privacy officer, a data controller, or any named individual with the relevant responsibilities.
Current: 'For data-related queries, email us at [email protected].' Rule 9 compliant: Published name or role title of the responsible person (or team with a specific contact), business contact information (email or postal), and a clear statement that they can answer questions about personal data processing and rights. The contact must actually respond — an unanswered inbox is not a compliant mechanism.
Rule 9's contact channel is also the entry point for Section 13's mandatory grievance mechanism. A Data Principal who cannot find the Rule 9 contact information, or who contacts that person and gets no response, has grounds for a Board complaint under Section 13(2)(b). The two obligations are operationally linked.