Data Principal Rights Under the DPDP Act: A Rule 14 Playbook, and What Vodafone's €30,000 Access-Request Fine Teaches Indian SMEs

A customer emails your support inbox: "Please tell me what data you hold about me, and then delete it." Today that message probably lands in a shared Gmail folder and waits. From 13 May 2027, it becomes a legal request under the Digital Personal Data Protection Act, 2023, and how you handle it will be judged against Rule 14 of the DPDP Rules, 2025. Handling data principal rights requests is one of the least glamorous parts of DPDP compliance, and one of the easiest to get wrong. Here is what the law asks, what a recent European fine shows, and a setup an Indian SME can build in the six months left.

The data principal rights the DPDP Act gives your customers

The Act sets out four rights that a data principal (the individual whose data you hold) can exercise against a data fiduciary (you):

• Access (Section 11). A summary of the personal data you process and the processing activities, plus the identities of other fiduciaries and processors you have shared it with.
• Correction and erasure (Section 12). The right to have data corrected, completed, updated or erased. On an erasure request you must erase the data unless keeping it is necessary for the specified purpose or to comply with a law.
• Grievance redressal (Section 13). "Readily available means" to raise a complaint, with a response within the prescribed period.
• Nomination (Section 14). The right to nominate another individual to exercise these rights if the person dies or becomes incapable.

Section 13(3) says the data principal must exhaust your grievance process before approaching the Data Protection Board. Your internal process is the first stop. If it fails, the complaint reaches the Board with that failure on record.

What Rule 14 of the DPDP Rules adds

Rule 14 turns those rights into operational duties. In plain terms, it requires you to:

1. Prominently publish how to make a request on your website or app, along with any particulars you need to identify the person, such as a username or customer ID.
2. Accept requests through those means. The rule defines "identifier" broadly: a customer file number, application reference number, enrolment ID, email address, mobile number or licence number all count.
3. Publish your grievance redressal system and respond within a reasonable period not exceeding ninety days, backed by "appropriate technical and organisational measures" so you can actually meet that timeline.
4. Allow nomination of one or more individuals, in line with your terms of service and applicable law.

Rule 9, read with Section 8(9) of the Act, adds that you must publish the business contact details of your Data Protection Officer or another person who can answer questions about your processing. If you have not named that person yet, our Data Protection Officer services page explains the options.

Rule 14 sits in the group of provisions that come into force eighteen months after the Rules were notified in November 2025, which puts the date at 13 May 2027. Ninety days sounds generous until requests sit in a shared inbox with no owner and customer data is spread across a CRM, a billing tool and three spreadsheets.

A warning from Greece: Vodafone's €30,000 access-request fine

In a decision dated 11 February 2026 and published by the European Data Protection Board in June, the Hellenic Data Protection Authority fined Vodafone-Panafon €30,000 under the GDPR.

None of the findings involve a hack. The authority found that the company:

• failed to give a customer access to recordings of their own calls;
• did not respect the right to restriction of processing;
• put obstacles in the way of the customer exercising the access right; and
• gave contradictory information about how the access request would be handled.

The regulator also ordered better staff training, with a report back within six months.

The amount is small. The pattern is the lesson: inconsistent answers, a process full of friction, and call recordings nobody treated as requestable personal data. Indian SMEs share these risks, especially with call recordings, chat logs and scanned KYC documents.

GDPR fines do not translate directly into DPDP penalties. Still, the DPDP Schedule allows penalties of up to ₹50 crore for breaches of obligations not separately listed, and a documented, working rights process is strong evidence of good faith.

Building a data principal rights workflow before May 2027

This works for most companies with 20 to 500 staff, and needs no expensive software to start.

1. Create one published front door. Add a "Your privacy rights" page linked from your footer and app settings. Give a dedicated email address or web form, list the identifiers you accept, and explain the steps. Make sure your support team gives the same answer.

2. Map where personal data lives. You cannot give a summary of data you cannot find. List every system holding customer or employee data, including call recordings, support tickets, marketing tools and vendor platforms. A privacy impact assessment is a natural place to build this map.

3. Assign an owner and a clock. Every request gets a ticket, an owner and a due date. Set an internal target of 30 days, well inside the 90-day ceiling, so escalations still have room.

4. Verify identity proportionately. A request from the registered email or mobile number is often enough. Demanding Aadhaar copies for a simple access request creates new risk.

5. Write down your erasure exceptions. Section 12(3) lets you keep data needed for the specified purpose or a legal requirement, such as GST invoices or KYC records under financial regulations. Tell the person what you kept and why.

6. Push requests to your processors. If a payroll vendor or cloud CRM holds the data, your contract should oblige them to help you correct or erase it on time.

7. Train the front line. A thirty-minute session for support and sales teams on spotting a rights request beats a policy nobody reads.

Consent Managers and what comes next

The Consent Manager registration framework becomes operational on 13 November 2026, and Rule 14 places the same publishing duty on Consent Managers. Some customers may eventually route requests through a registered Consent Manager instead of your form. The request still lands on your desk, and the clock still runs.

Six months is enough if you start now. The companies that struggle will be the ones building their data map, front door and owner on the day the first request arrives.

For a structured view of where you stand across all DPDP obligations, our DPDP Act compliance service covers rights handling alongside notice, consent and breach readiness.

This article is general guidance and not legal advice. Please consult a qualified professional for advice on your specific situation.

Want a quick read on your readiness? Start with our free DPDP compliance checklist, or talk to our team about setting up a rights-request process that will hold up in 2027.