Data Principal rights and the 90-day limit: why the 90 days is for grievances

6 days ago

5 min read

This explainer is also published on dpdpa.support. Every section, rule and date was checked against the official text on 4 Oct 2026.

It is easy to read the 90 days in the DPDP Rules, 2025 as a deadline for every data request. The text is narrower. Rule 14(3) sets a ninety-day outer limit for responding to grievances under your grievance redressal system. Below: the rights a person has under the Digital Personal Data Protection Act, 2023, what you must publish, and where the 90 days applies.

The rights in the Act

A Data Principal is the person the data is about; a Data Fiduciary is the person or business that decides why and how it is processed. Chapter III of the Act gives the Data Principal four rights against the Data Fiduciary, alongside the right to withdraw consent in Section 6(4):

Access (Section 11). A summary of the personal data being processed and the processing activities; the identities of all other Data Fiduciaries and Data Processors you have shared it with, with a description of what was shared; and any other information the Rules prescribe. Section 11(2) takes some sharing out of the second and third items: sharing with another Data Fiduciary authorised by law to obtain the data, on its written request. The request must be for preventing, detecting or investigating offences or cyber incidents, or for prosecuting or punishing offences.
Correction and erasure (Section 12). Correction of inaccurate or misleading data, completion of incomplete data, and updating. Erasure on request, unless retention is necessary for the specified purpose or for compliance with law (Section 12(3)).
Grievance redressal (Section 13). Readily available means of grievance redressal for any act or omission about your obligations or her rights.
Nomination (Section 14). She may nominate another individual to exercise her rights if she dies or becomes incapacitated. Rule 14(4) lets her nominate one or more individuals, using the means you specify.

Sections 11(1) and 12(1) attach the access and correction rights to data for which she has previously given consent, including data she provided voluntarily for a specified purpose under Section 7(a).

What you must publish: Rule 14 and Rule 9

Rule 14(1) requires you to prominently publish on your website or app:

the means by which a person can make a request to exercise her rights; and
any particulars needed to identify her under your terms of service, such as a username or other identifier.

Rule 14(5) defines an identifier as any sequence of characters you issued to identify her, such as a customer identification file number, application reference number, enrolment ID, email address or mobile number.

Rule 9 requires you to prominently publish the business contact information of your Data Protection Officer, if you have one, or of a person who can answer questions about the processing. Rule 9 also requires that contact to be mentioned in every response you send to a communication about her rights. Section 8(9) is the Act’s parent duty.

The 90 days: what Rule 14(3) says

Rule 14(3) requires every Data Fiduciary and Consent Manager to prominently publish the period, under its grievance redressal system, for responding to the grievances of Data Principals. That period must be “a reasonable period not exceeding ninety days”. You must also implement appropriate technical and organisational measures so the system actually responds within it. The published English text of Rule 14(3) does not contain the words “the period”; reading it with Section 13(2), which requires a response to grievances within the prescribed period, is what makes it a grievance-response period.

In practice:

You choose and publish your own response period. Ninety days is the maximum, not the default.
The period is for responding to grievances (Section 13(2)).
The text of Sections 11 and 12 and Rule 14 sets no separate day count for answering an access, correction or erasure request.

How a rights request becomes a grievance

The two are connected. Section 13(1) covers grievances about any act or omission regarding the performance of your obligations or “the exercise of her rights”. If you ignore, delay or wrongly refuse an access or erasure request, the person can raise that as a grievance. From then on, your published grievance period, capped at ninety days, applies to your response.

Section 13(3) requires her to exhaust your grievance redressal before approaching the Board. After that, a complaint to the Board is one of the triggers for a Board inquiry under Section 27(1)(b); see how a Board inquiry and penalty work.

So the practical question is how long you take to answer the original request. If you apply a 90-day target to every request type, record it as your own policy choice, not as a statutory deadline for rights requests.

Duties on the other side

Section 15 places duties on Data Principals too. Among them, she must not register a false or frivolous grievance or complaint (Section 15(d)), and must give only verifiably authentic information when asking for correction or erasure (Section 15(e)). The Schedule sets a ceiling of ₹10,000 for breach of these duties (item 5). Section 28(12) lets the Board warn or impose costs on a complainant it considers false or frivolous.

These duties do not let you dismiss requests by default. They support identity checks and a record of why a request was refused.

Building the process

One intake route, published. A form or address that meets Rule 14(1), naming the identifiers you need.
A log from day one. Date received, right exercised, identity check, owner, target date and outcome.
A published grievance period. State it under Rule 14(3), at ninety days or less, and track it separately.
The contact in every reply. Each response to a rights communication names the Rule 9 contact.
Recorded refusals. If you refuse erasure because retention is necessary for the purpose or required by law (Section 12(3)), write down which.

Start date

None of this applies before 13 May 2027. Sections 11 to 15 start on 13 May 2027 (clause (c) of G.S.R. 843(E)), and so do Rules 9 and 14 (Rule 1(4)). A rights process takes time to test, so build it before then.

Sources

Every section, rule and date above was checked against the official text on 4 Oct 2026.

Digital Personal Data Protection Act, 2023 (No. 22 of 2023)

Section 6(4): Right to withdraw consent
Section 7(a): Voluntarily provided data, for which rights also apply
Section 8(9): Publish a contact for questions about processing
Section 11: Right of access, including (1)(b) and the (2) exception
Section 12: Correction, completion, updating and erasure; (3) retention exception
Section 13: Grievance redressal: (1) scope, (2) response period, (3) exhaust before the Board
Section 14: Nomination
Section 15: Duties of Data Principals, including (d) and (e)
Section 27(1)(b): Board inquiry on a Data Principal's complaint
Section 28(12): Warning or costs for a false or frivolous complaint
The Schedule, item 5: Up to ₹10,000 for breach of Section 15 duties

DPDP Rules, 2025 (G.S.R. 846(E), 13 November 2025)

Rule 1(4): Rules 9 and 14 in force eighteen months from publication
Rule 9: Publish the contact, and name it in every response to a rights communication
Rule 14: Publish how to make requests (1); requests (2); grievance period not exceeding ninety days (3); nomination (4); identifier (5)

Notifications

G.S.R. 843(E), clause (c): Sections 11 to 15 in force eighteen months from 13 November 2025

A request form, and a tracker that counts down

How-to 07 gives you a rights request form to publish and a tracker that logs each request the day it arrives and counts down to a target date (90 days after receipt, a policy choice rather than a statutory deadline for rights requests).

The how-to walkthroughs and the editable Word and Excel files are in the DPDPA Compliance Toolkit program on this site. The version of this article that we keep up to date is on dpdpa.support.

Drafting aid, not legal advice.