Legal Register
RULE-9 Tranche 3 (13 May 2027) — Core Operating Cliff
Status: scheduled, not yet operative
Rule 9: Website/app and every rights communication response
Use accountable reachable contact in specimens.
Subordinate Trigger
Website/app and every rights communication response
Applies to: Data Fiduciary
Rule Prescriptions
Prominent business contact of DPO if applicable or responsible person.
Exceptions & Provisos
DPO not universally mandated.
Official Gazette Text (Verbatim Rules Publication)
Ministry of Electronics and Information Technology, Digital Personal Data Protection Rules, 2025.
9. Contact information of person to answer questions about processing.— Every Data Fiduciary shall
prominently publish on its website or app, and mention in every response to a communication for the
exercise of the rights of a Data Principal under the Act, the business contact information of the Data
Protection Officer, if applicable, or a person who is able to answer on behalf of the Data Fiduciary the
questions of the Data Principal about the processing of her personal data.
Mapped Operational Controls (1)
Enterprise obligations in the Control Master Matrix implementing this subordinate rule.