Publish an actionable entry point
Rule 14 expects Data Fiduciaries and Consent Managers to publish the means by which rights may be exercised and the identifiers needed to locate the relevant account or relationship.
Ask only for information necessary to locate records and verify the requester. Requiring excessive identity data can create a new privacy and security risk.
Route the request by right and system
Access information, correction, erasure and grievance redressal do not follow the same operational path. Define the responsible team, source systems, processors, exceptions and evidence required for each.
Erasure needs particular care. The organisation should distinguish data that is no longer necessary from data another law requires it to retain, record the override and schedule deletion when that obligation ends.
- Create a case ID and acknowledgement.
- Verify identity proportionately.
- Search production systems and relevant processors.
- Record the response, exceptions and completion evidence.
Keep grievance handling from becoming a dead end
Section 13 gives the individual a grievance route before approaching the Board. Publish a contact point, set internal service levels and define escalation when the first-line team cannot resolve the matter.
Analyse recurring requests and grievances. They often reveal notice language, retention logic or product controls that should be fixed at source rather than handled repeatedly as individual cases.
Sources and editorial review
Prepared by DPDP Academy Editorial (Legal education and implementation guidance). Reviewed by DPDP Academy Source Review using the sources below on 2 August 2026. Statutory text, notified Rules and practical interpretation are kept distinct. Educational content, not legal advice.