How to Handle Data Principal Requests (Rule 14)
People can ask to see their data, correct it, erase it, complain, or nominate someone to act for them (Sections 11 to 14). Rule 14 requires you to publish how to ask, what identifier you need, and to answer grievances within a reasonable period of at most 90 days. This DPDPA 2023 course page explains how to handle data principal in plain language.
'%2F%3E%3Ccircle%20cx%3D'650'%20cy%3D'15'%20r%3D'62'%20fill%3D'%2314b8a6'%20opacity%3D'.35'%2F%3E%3Ctext%20x%3D'28'%20y%3D'54'%20font-family%3D'Poppins%2CArial%2Csans-serif'%20font-size%3D'26'%20font-weight%3D'800'%20fill%3D'white'%3EDPDPA%202023%20COURSE%3C%2Ftext%3E%3C%2Fsvg%3E)
Advertisement
What you must publish (Rule 14) (how to handle data principal)
- The way to send a request (a web form or a dedicated email)
- The identifier you need to find the person, such as email, mobile number or customer ID
- The privacy contact from Rule 9, repeated in your replies
- How a person can appoint someone to act for them
The workflow (tap each step)
Tap or click a step to see exactly what to do.
Advertisement
What each right means in practice (how to handle data principal)
| Right | What you do |
|---|---|
| Access (Section 11) | Give a summary of the personal data you process, what you do with it, and the identities of other fiduciaries and processors you shared it with. |
| Correction, completion, updating (Section 12) | Fix inaccurate data, complete incomplete data, and update changed data. |
| Erasure (Section 12) | Delete data unless you must keep it for the stated purpose or by law. Tell processors to delete too. |
| Grievance (Section 13) | Have a visible grievance route. Answer in a reasonable time, never beyond 90 days. If unresolved, the person can go to the Board. |
| Nominate (Section 14) | Accept the nomination of a person to exercise rights if the principal dies or cannot act. |
Service levels you can adopt
| Step | Internal target | Legal limit |
|---|---|---|
| Acknowledge | 2 working days | Not fixed |
| Answer access, correction, erasure | 30 days | Reasonable time |
| Resolve a grievance | 30 days | Reasonable time, at most 90 days |
The 30-day and 2-day targets are good practice, not legal requirements.
Reply templates (how to handle data principal)
Access reply: Thank you for your request ref [ID]. Attached is a summary of the personal data we hold about you ([list]), why we use it ([purposes]), and who we share it with ([names]). If you need corrections or want to raise a grievance, contact [Privacy contact, email].
Refusal reply: We have reviewed your request ref [ID]. We cannot erase [data] because [law or purpose]. We have erased [other data]. You may raise a grievance with [contact]. If still unsatisfied, you may complain to the Data Protection Board of India.
Request log fields
Request ID, date received, name or identifier, type, identity verified (Y/N), systems searched, decision and reason, date replied, handler.
Related guides (how to handle data principal)
Educational material, not legal advice. Based on the DPDP Act, 2023 and the DPDP Rules, 2025 (Gazette notification of 13 November 2025). Always check the official text on the MeitY website.
Official sources for how to handle data principal: Digital Personal Data Protection Rules, 2025 (MeitY, PDF) and DPDP Rules 2025, English text (PDF). Always check the latest official notifications.