Section 14 - Right to nominate

Key point

Clause-by-clause commentary on the right to nominate, the meaning of death and incapacity, the scope of the nominee’s authority and the mechanism in Rule 14(4) of the DPDP Rules, 2025

1. What exactly does Section 14 give to a Data Principal?

Section 14 introduces a distinctive right within the DPDP framework.

It provides that a Data Principal may nominate another individual who, upon the death or incapacity of the Data Principal, may exercise the Data Principal's rights under the Act and Rules.

The provision therefore addresses a problem that conventional data-protection regimes do not always expressly resolve:

What happens to a person's ability to exercise data-protection rights when that person is no longer capable of exercising them personally?

The answer under Section 14 is not that the personal data becomes the property of the nominee.

Nor does the provision state that the nominee becomes the owner of the deceased person's data.

Instead, it creates a statutory mechanism through which another individual may exercise the Data Principal's rights in specified circumstances.

This distinction is fundamental.

The nominee receives a rights-exercise function, not necessarily proprietary control over the underlying personal data.

Section 14 is therefore best understood as a mechanism for continuity of data rights.

2. The expression “shall have the right to nominate”

The provision begins:

“A Data Principal shall have the right to nominate…”

The wording is mandatory in relation to the existence of the right.

The Data Principal is not required to nominate someone.

Rather, the Data Principal is given the choice to do so.

The provision consequently creates an optional mechanism of post-death or post-incapacity rights administration.

This is important because the statutory right belongs to the Data Principal.

The Data Fiduciary does not select the nominee.

The State does not select the nominee.

The Data Fiduciary's role is to provide the mechanism through which the nomination can be made and subsequently recognised.

3. “In such manner as may be prescribed”

The words “in such manner as may be prescribed” delegate the procedural details to subordinate legislation.

The Act itself does not prescribe:

• how the nomination is to be made;
• what information must be supplied;
• whether the nomination may be modified;
• what authentication mechanism must be used;
• how the Data Fiduciary verifies the nominee; or
• what process applies when the nominee seeks to exercise rights.

Those matters are addressed through the Rules.

Rule 14(4) provides that a Data Principal may nominate one or more individuals, in accordance with the Data Fiduciary's terms of service and applicable law, using the means and furnishing the particulars required by the Data Fiduciary for exercise of the right.

The Rules therefore operationalise a right whose existence is established by the Act.

This produces a familiar statutory structure:

Section 14 → right

Rule 14(4) → mechanism

The Data Fiduciary cannot therefore argue that because the Act leaves the manner to be prescribed, the right itself is discretionary. The delegation concerns the manner of exercise, not the existence of the right.

4. Who may be nominated?

Section 14 refers to:

“any other individual”

The expression is deliberately broad.

The statute does not restrict the nominee to:

• a spouse;
• parent;
• child;
• legal heir;
• executor;
• attorney;
• family member; or
• beneficiary.

The nominee therefore need not necessarily have a familial relationship with the Data Principal.

This is consistent with the nature of the right.

The purpose is to allow the Data Principal to determine who should exercise her statutory data rights if she subsequently cannot do so herself.

Rule 14(4) further permits nomination of one or more individuals.

That raises an interesting practical question: where more than one individual is nominated, the Data Fiduciary will need an administratively workable method of dealing with potentially conflicting requests.

The Rule does not, on its face, prescribe a detailed hierarchy among multiple nominees.

Consequently, the Data Fiduciary's terms of service and applicable law may become important at the operational stage.

5. Death and incapacity are separate triggering events

Section 14 uses the expression:

“in the event of death or incapacity”

The two conditions should not be treated as synonymous.

Death is a permanent event.

Incapacity may be temporary or continuing.

This distinction matters because the nominee's authority is triggered differently.

Upon death, the Data Principal can no longer personally exercise her rights.

Incapacity, by contrast, concerns the inability of the Data Principal to exercise those rights while she remains alive.

The Rules therefore need to provide a mechanism through which the Data Fiduciary can determine that the relevant triggering event has occurred.

The Act itself does not prescribe the evidentiary standard.

That creates an important compliance question for Data Fiduciaries:

How should a Data Fiduciary verify death or incapacity without collecting excessive additional personal data?

The answer cannot simply be to impose any verification requirement the organisation wishes. The verification mechanism must remain connected with the legitimate administration of the nomination right.

6. What does “incapacity” mean?

Section 14(2) supplies an express definition:

“inability to exercise the rights of the Data Principal … due to unsoundness of mind or infirmity of body.”

The definition therefore has two elements:

• first, there must be an inability to exercise rights;

secondly, that inability must arise because of unsoundness of mind or infirmity of body.

This is narrower than the ordinary meaning of incapacity.

A person may, for example, be travelling, busy, technologically inexperienced or temporarily unable to access a particular device. Those circumstances do not necessarily constitute “incapacity” under Section 14.

The statutory definition requires the inability to exercise the rights to arise from the specified physical or mental condition.

This matters because a Data Fiduciary should not treat every request from a nominee as sufficient merely because the nominee asserts that the Data Principal is unavailable.

The statutory trigger must be established.

7. “Inability to exercise the rights” is the operative test

An especially important feature of Section 14(2) is that incapacity is not defined simply by reference to a medical condition.

The definition focuses on the consequence of the condition:

inability to exercise the rights of the Data Principal.

Thus, the legal question is not merely:

“Does the person have an infirmity?”

It is:

“Has the infirmity resulted in an inability to exercise the rights available under the Act and Rules?”

This distinction prevents an overly broad interpretation.

A physical disability does not necessarily mean that a person is incapable of exercising data rights.

Likewise, the mere existence of a mental-health condition cannot automatically mean that the individual lacks the ability to exercise those rights.

The statutory concept is functional:

condition → resulting inability → inability to exercise statutory rights.

8. Section 14 is not a succession provision

The provision should also be distinguished from succession law.

Illustration

Suppose A nominates B under Section 14. A subsequently dies. B may be able to exercise A's rights under the DPDP framework in accordance with Section 14 and Rule 14.

That does not necessarily mean B:

• inherits A's digital assets;
• becomes the owner of A's accounts;
• acquires contractual rights against every service provider;
• inherits intellectual property;
• becomes the beneficiary of A's bank account; or
• acquires ownership of all data concerning A.

The statutory mechanism is much narrower.

It concerns the exercise of data-protection rights.

This is why the provision should not be confused with a testamentary nomination or a succession nomination.

9. Section 14 and the nature of Data Principal rights

Section 14 becomes particularly interesting when read with Sections 11 to 13.

The Act gives Data Principals rights including:

• access to information about personal data;
• correction and erasure;
• grievance redressal; and
• nomination.

Section 14 is therefore both a right in itself and a mechanism for preserving the exercise of other rights after a triggering event.

For example:

1. A Data Principal nominates B.
2. The Data Principal later becomes incapacitated.
3. B seeks access to the relevant information under the Act.
4. B may exercise the relevant right subject to the Act and Rules.

The nominee therefore becomes a procedural bridge between the Data Principal and the Data Fiduciary.

10. Rule 14(4) and one or more nominees

Rule 14(4) provides the operational mechanism for nomination and states that the Data Principal may nominate one or more individuals.

This expands the statutory phrase “any other individual” into a mechanism capable of accommodating multiple nominees.

But this also creates practical questions.

Illustration

Suppose A nominates B and C. B requests erasure. C requests retention. What should the Data Fiduciary do?

The Rules, as presently drafted, do not appear to provide a complete conflict-resolution mechanism for competing nominees.

The issue may therefore have to be resolved through the terms of service, applicable law, evidence concerning the Data Principal's instructions and, where necessary, the appropriate legal process.

This illustrates a broader point about delegated legislation.

The Rules can operationalise the statutory right, but they cannot fundamentally redefine the right created by Section 14.

11. Why Section 14 is significant in a digital economy

Traditional legal systems have developed sophisticated mechanisms for dealing with property after death.

Digital data creates a different problem.

A person's digital existence is distributed across:

• email accounts;
• social-media platforms;
• cloud storage;
• financial services;
• healthcare systems;
• online marketplaces;
• subscription services;
• professional platforms; and
• government portals.

A deceased person's family may have a legitimate need to determine what happens to personal information associated with those services.

Section 14 provides a statutory mechanism specifically directed at data-protection rights.

Its significance therefore lies not merely in creating another individual right.

It recognises that:

privacy rights may require a mechanism of continuity when the individual who ordinarily exercises them can no longer do so.

12. Corresponding Rules and Schedules

No Schedule of the DPDP Rules, 2025 applies directly to Section 14. The operative mechanism is Rule 14, which prescribes the manner in which a Data Principal, or a nominee on the triggering event, may exercise the rights conferred by the Act.