Grievance Redressal Mechanism (R.14)

Rule 14 operationalises the Data Principal's right to grievance redressal under Section 13 of the DPDPA. Data Fiduciaries must: 1. Designate a responsible person to address grievances related to personal data processing 2. Provide a web-based mechanism for Data Principals to submit grievances 3. Resolve grievances within a maximum of 90 days from the date of receipt 4. Provide responses in a structured format with reasons The mechanism must be accessible, user-friendly, and capable of handling grievances at scale.

The grievance process should follow these steps: 1. Submission: Data Principal submits grievance through the web-based mechanism 2. Acknowledgment: The Data Fiduciary acknowledges receipt (recommended within 48 hours) 3. Assessment: The designated officer assesses the grievance and determines the appropriate resolution 4. Investigation: If needed, the officer investigates the complaint, gathering relevant information 5. Resolution: The officer resolves the grievance within 90 days, providing a structured response with reasons 6. Communication: The resolution is communicated to the Data Principal through the web-based mechanism If the Data Principal is unsatisfied with the response, they may escalate by filing a complaint with the Data Protection Board.

Organisations should: • Build or procure a web-based grievance portal with case tracking • Appoint a designated grievance officer with appropriate authority • Define escalation procedures and SLAs within the 90-day window • Maintain records of all grievances received, actions taken, and resolutions provided • Train the grievance handling team on Data Principal rights and DPDPA obligations • Integrate the grievance mechanism with existing customer support infrastructure • Provide the grievance mechanism link in privacy notices and consent forms • Monitor grievance trends to identify systemic issues in data processing practices