Grievance Redressal Mechanism (R.14)

Rule 14 operationalises the Data Principal's right to grievance redressal under Section 13 of the DPDPA. Data Fiduciaries must: 1. Designate a responsible person to address grievances related to personal data processing 2. Provide a web-based mechanism for Data Principals to submit grievances 3. Publish the time period, not exceeding 90 days, within which the Data Fiduciary will ordinarily respond to a grievance 4. Provide responses in a structured format with reasons The mechanism must be accessible, user-friendly, and capable of handling grievances at scale. Rule 14(3) caps the period that a Data Fiduciary may publish as its expected response time; it does not fix a deadline by which every grievance must be resolved.

The grievance process should follow these steps: 1. Submission: Data Principal submits grievance through the web-based mechanism 2. Acknowledgment: The Data Fiduciary acknowledges receipt (recommended within 48 hours) 3. Assessment: The designated officer assesses the grievance and determines the appropriate resolution 4. Investigation: If needed, the officer investigates the complaint, gathering relevant information 5. Response: The officer responds within the published period (capped at 90 days under Rule 14(3)), providing a structured response with reasons 6. Communication: The response is communicated to the Data Principal through the web-based mechanism If the Data Principal is unsatisfied with the response, they may escalate by filing a complaint with the Data Protection Board.

Organisations should: • Build or procure a web-based grievance portal with case tracking • Appoint a designated grievance officer with appropriate authority • Publish a response period, not exceeding 90 days, and define internal escalation procedures and SLAs within that window • Maintain records of all grievances received, actions taken, and responses provided • Train the grievance handling team on Data Principal rights and DPDPA obligations • Integrate the grievance mechanism with existing customer support infrastructure • Provide the grievance mechanism link in privacy notices and consent forms • Monitor grievance trends to identify systemic issues in data processing practices