Right to Grievance Redressal

Section 13 of the DPDPA grants every Data Principal the right to have readily available means of grievance redressal provided by the Data Fiduciary in respect of any act or omission of the Data Fiduciary or Data Processor regarding the discharge of obligations or exercise of rights under the Act. This right is the primary enforcement mechanism available to Data Principals before escalation to the Data Protection Board. It ensures that organisations maintain accessible channels for addressing data protection concerns.

Rule 14 of the DPDP Rules operationalises the grievance redressal right with specific requirements: (a) the Data Fiduciary must publish the contact details of a designated person responsible for addressing grievances; (b) a web-based mechanism must be provided for submitting grievances; (c) the designated person must acknowledge receipt of the grievance; and (d) the Data Fiduciary must publish the time period, not exceeding 90 days, within which it will ordinarily respond to a grievance. The response must be in a structured format with clear reasons. Rule 14(3) caps the response period a Data Fiduciary may publish; it is not a statutory deadline for resolving the grievance. If the Data Fiduciary's response is unsatisfactory or no response is received within the published period, the Data Principal may escalate to the Data Protection Board.

Where the Data Principal is not satisfied with the Data Fiduciary's response, or receives no response within the prescribed period, they may file a complaint with the Data Protection Board of India. The Board then initiates an inquiry into the complaint, following principles of natural justice. The Board has the power to: (a) direct the Data Fiduciary to take remedial action; (b) impose penalties for non-compliance; and (c) refer matters for further investigation. This two-tier mechanism - first internal grievance, then Board complaint - is designed to resolve disputes at the lowest possible level while ensuring effective recourse.

Organisations must implement: (a) a dedicated web portal or form for grievance submission; (b) an internal process for triaging, investigating, and responding to grievances within the published period (capped at 90 days under Rule 14(3)); (c) a designated officer with sufficient authority and resources; (d) record-keeping of all grievances received and actions taken; and (e) a mechanism for communicating responses in a clear, structured format. The designated person should be senior enough to make binding decisions on behalf of the organisation. For Significant Data Fiduciaries, the Data Protection Officer may serve this role or supervise the grievance function.

The GDPR does not prescribe a mandatory internal grievance mechanism with fixed timelines. Instead, it provides for the right to lodge a complaint directly with a Supervisory Authority (Article 77) and the right to an effective judicial remedy (Article 79). The DPDPA's approach of mandating internal resolution before Board escalation may reduce the burden on the Board but places significant operational requirements on Data Fiduciaries. The 90-day cap under Rule 14(3) is a published response period, generous compared to the GDPR's one-month response period for data subject requests (extendable by two months). Unlike the GDPR's fixed statutory deadline, the DPDPA's 90-day figure is a self-published ceiling on the Data Fiduciary's ordinary response time, not a mandated resolution deadline.