Skip to main content

The 3rd and main DPDP commencement date is computed as 13 May 2027, which is interpretation until officially confirmed.

dpdprules.org
Data breached?
☰

Sources last verified on 23 September 2026. Methodology

DPDP Rules 2025 · Rule 14

Rights of Data Principals

Status
Not yet in force
Commencement
13 May 2027 · computed date, presented as interpretation until officially confirmed (how it is computed)
Source
Digital Personal Data Protection Rules, 2025 (English section of Gazette No. 760) · G.S.R. 846(E) · Gazette page 29
Last verified
26 August 2026

What Rule 14 says, in plain English

Plain English

Not yet in force; the computed date is 13 May 2027, which is interpretation until officially confirmed. The summary below is what the provision says, not what is in force today. Status last checked 28 September 2026 against the MeitY library and India Code.

For Data Principals to exercise their rights, a Data Fiduciary and, where applicable, a Consent Manager must publish on its website or app the means for making requests and identifying particulars required. Sub rule (3) requires every Data Fiduciary and Consent Manager to prominently publish on its website or app, and to implement technical and organisational measures for responding effectively under its grievance redressal system, and it names 90 days, in a sentence printed with no object for the word publish, so what the 90 days caps is not stated on its face. A Data Principal may nominate one or more individuals under applicable terms of service and law.

How 13 May 2027 is computed, and why it could be 1 day later

Publication date 13 November 2025 printed on Gazette issue No. 760, plus eighteen months. The eGazette portal lists this document with a code embedding 14112025 and the Government's own PIB release states 14 November 2025, which would move the computed date by 1 day; the printed masthead date is used, and the interpretation label carries that uncertainty. The corrigendum wording change does not affect this computation.

Official text of Rule 14

Official requirement · verbatim

Rule 14. Rights of Data Principals.(1) For enabling Data Principals to exercise their rights under the Act, the Data Fiduciary and, where applicable, the Consent Manager, shall prominently publish on its website or app, or both, as the case may be, — (a) the details of the means using which a Data Principal may make a request for the exercise of such rights; and (b) the particulars, if any, such as the username or other identifier of such a Data Principal, which may be required to identify her under its terms of service. (2) To exercise the rights of the Data Principal under the Act, she may make a request to the Data Fiduciary to whom she has previously given consent for processing of her personal data, using the means and furnishing the particulars required by such Data Fiduciary for the exercise of such rights. (3) Every Data Fiduciary and Consent Manager shall prominently publish on its website or app, or both, as the case may be, within a reasonable period not exceeding ninety days under its grievance redressal system for responding to the grievances of Data Principals and shall, for ensuring the effectiveness of the system in responding within such period, implement appropriate technical and organisational measures. (4) To exercise the rights of the Data Principal under the Act, she may, in accordance with the terms of service of the Data Fiduciary and such law as may be applicable, nominate one or more individuals, using the means and furnishing the particulars required by such Data Fiduciary for the exercise of such right. (5) In this rule, the expression “identifier” shall mean any sequence of characters issued by the Data Fiduciary to identify the Data Principal and includes a customer identification file number, customer acquisition form number, application reference number, enrolment ID, email address, mobile number or licence number that enables such identification.

Commencement basis · Rules 3, 5 to 16, 22 and 23

“Rules 3, 5 to 16, 22 and 23 shall come into force eighteen months after the date of publication in the Official Gazette.”

Wording as corrected by corrigenda G.S.R. 892(E).

Sources cited on this page

  1. [1]
    Digital Personal Data Protection Rules, 2025 (English section of Gazette No. 760) (G.S.R. 846(E)), r. 14, p. 29. Published 13 November 2025. Official source ↗ Also on MeitY (byte identical) ↗ · Official requirement · Verified 26 August 2026Not yet in force; the computed date is 13 May 2027, which is interpretation until officially confirmedRule 14 begins on Gazette page 29 and concludes on page 30. Anomaly as printed: sub-rule (3) on page 30 carries no object for the verb "publish", so what the words "not exceeding ninety days" cap is not stated on the face of the text, and it is reproduced exactly as printed. Corrigenda G.S.R. 892(E) correct pages 24, 29, 32, 34 and 38 only, so page 30 stands as printed.
  2. [2]
    The Digital Personal Data Protection Act, 2023 (Gazette print hosted by MeitY) (Act No. 22 of 2023), s. 40, (2)(o), p. 18. Published 11 August 2023. Official source ↗ · Interpretation, requires judgment · Verified 26 August 2026In force since 13 November 2025This site reads the words "not exceeding ninety days" in sub-rule (3) as capping the response period the Data Fiduciary must publish, because section 40(2)(o), Gazette page 18, describes the thing to be prescribed as "the period within which the Data Fiduciary shall respond to any grievances under sub-section (2) of section 13", and the same sub-rule requires measures for responding "within such period". The competing reading, that the 90 days limits the publishing itself, is not foreclosed by anything printed. That reading is this site's and not a statement the printed rule makes.
  3. [3]
    Digital Personal Data Protection Rules, 2025 (English section of Gazette No. 760) (G.S.R. 846(E)), r. 1, (4), p. 24. Published 13 November 2025. Official source ↗ Also on MeitY (byte identical) ↗ · Printed text, since corrected by G.S.R. 892(E); quoted as published · Verified 16 August 2026In force since 13 November 2025
    Rules 3, 5 to 16, 22 and 23 shall come into force eighteen months after the date of publication of this Gazette.
    As printed. Corrigenda G.S.R. 892(E) item (i)(b) corrects the closing words to read in the Official Gazette; the computation is unaffected.
  4. [4]
    Digital Personal Data Protection Rules, 2025 (G.S.R. 846(E)), p. 1. Published 13 November 2025. Official source ↗ Also on MeitY (byte identical) ↗ · Interpretation, requires judgment · Verified 16 August 2026Document status: published; text subject to corrigendum G.S.R. 892(E)The calendar date 13 May 2027 is computed from the printed publication date and is presented as interpretation until officially confirmed.