Rule 14, exercising Data Principal rights
In short
Rule 14 sets the mechanics by which a Data Principal exercises her rights. Every Data Fiduciary and, where applicable, every Consent Manager must prominently publish on its website or app the means by which a request may be made, and the particulars, if any, needed to identify the requester under its terms of service.
01What must be published and observed
| Sub rule | Requirement |
|---|---|
| 14(1) | Prominently publish the details of the means by which a request may be made, and the particulars such as a username or other identifier that may be required to identify the Data Principal under the terms of service |
| 14(2) | A Data Principal may make a request to a Data Fiduciary to whom she has previously given consent, using the means and particulars that Data Fiduciary requires |
| 14(3) | Prominently publish the period, not exceeding ninety days, within which grievances will be responded to under the grievance redressal system, and implement appropriate technical and organisational measures to ensure effectiveness within that period |
| 14(4) | A Data Principal may nominate one or more individuals, in accordance with the terms of service and applicable law, using the means and particulars required |
02What counts as an identifier
Rule 14(5) defines identifier as any sequence of characters issued by the Data Fiduciary to identify the Data Principal. The rule gives examples: a customer identification file number, a customer acquisition form number, an application reference number, an enrolment ID, an email address, a mobile number or a licence number.
Two consequences follow. Requiring an identifier the Data Fiduciary never issued to the requester is not supported by the rule. And publishing the required particulars in advance is part of the obligation, not a matter of internal process, because the Data Principal cannot be expected to guess them.
03The ninety day ceiling
Ninety days is a ceiling on the published period, not a target. The Data Fiduciary sets and publishes a reasonable period within that ceiling and must implement measures to meet it. A published period of ninety days with no measures behind it satisfies neither half of the sub rule.
04Common questions
How long is there to respond to a grievance?
Rule 14(3) requires the period to be published and not to exceed ninety days, with appropriate technical and organisational measures implemented to respond within it.
Can a Data Fiduciary require identity documents?
The rule allows it to require the particulars, such as a username or other identifier, needed to identify the Data Principal under its terms of service, and those particulars have to be published in advance.
Who can a Data Principal make a request to?
A Data Fiduciary to whom she has previously given consent for processing of her personal data.
Ask an AI assistant about this page
Each button opens the assistant with the prompt below already written.
Answers are generated by third party systems and are not published or verified by this site. Check anything load bearing against the gazette text.