Section 13: Right of Grievance Redressal
Section 13 requires every Data Fiduciary and Consent Manager to run a working, responsive grievance process — and makes using it a required first step before a Data Principal can take a complaint to the Board.
Quick summary
What Section 13 says
- Sub-section (1) — a Data Principal has the right to have readily available means of grievance redressal from a Data Fiduciary or Consent Manager, for any act or omission regarding the performance of its obligations in relation to her personal data, or the exercise of her rights under the Act and rules.
- Sub-section (2) — the Data Fiduciary or Consent Manager shall respond to any grievance referred to in sub-section (1) within a prescribed period, for all or any class of Data Fiduciaries.
- Sub-section (3) — a Data Principal shall exhaust the opportunity of redressing her grievance under this section before approaching the Board.
Breaking it down
- 1Sub-s. (1)
Raise it
The Data Principal raises the grievance with the Data Fiduciary or Consent Manager.
- 2Sub-s. (2)
Get a reply
The Fiduciary or Consent Manager responds within the prescribed period.
- 3Sub-s. (3)
Escalate
Only after exhausting this route can she approach the Board.
“Readily available” is the operative standard, not just “available.” Sub-section (1) doesn't just require a grievance channel to exist somewhere — it needs to be genuinely accessible and easy to find, covering both the Fiduciary's own obligations and the Data Principal's rights under the Act generally, not narrowly limited to one specific request type.
Response times will be fixed by the Rules, and can vary by class of Fiduciary. Sub-section (2) leaves the actual timeframe to be prescribed, and explicitly allows it to differ across classes of Data Fiduciaries — a small business and a Significant Data Fiduciary may end up with different expected turnaround times.
This is a mandatory first step, not an optional courtesy channel. Sub-section (3)'s exhaustion requirement means the Board is designed as an escalation path, not the first port of call — a Data Principal who goes straight to the Board without first raising the issue with the Fiduciary or Consent Manager hasn't yet satisfied this precondition.
Why this section matters
Section 13 is what stands between the Board being flooded with every individual dispute, and Data Principals actually getting timely resolution. By requiring Fiduciaries to run a real internal grievance process and requiring Data Principals to use it first, the Act pushes most disputes toward direct, faster resolution and reserves the Board for genuinely unresolved cases.
Real-world example
Nimbus Cloud Storage, responding to a data-rights complaint
A user emails Nimbus Cloud Storage's support address saying an erasure request from weeks ago was never actioned.
- Nimbus's obligation — under sub-section (1), the complaint needs to reach an actual grievance-handling process, not disappear into a general support queue with no defined resolution path.
- Meeting the response-time requirement — Nimbus responds within the period prescribed for its class of Data Fiduciary under sub-section (2), confirming either that the erasure has now been completed or explaining a lawful basis for retention.
- If the user remains unsatisfied — only after going through Nimbus's own grievance process can the user escalate to the Board under sub-section (3) — going to the Board first, without raising it with Nimbus, wouldn't yet satisfy this requirement.
Who needs to care about this section
- Customer support and trust teams — need a defined, trackable grievance process specifically for data-rights and DPDP-related complaints, distinct from general customer service.
- Data Principals — need to raise issues with the Fiduciary or Consent Manager directly first; going straight to the Board skips a required step.
- Consent Managers — carry the same grievance-redressal obligation as Data Fiduciaries under this section, not a lighter-touch version.
Common questions
Can a Data Principal complain directly to the Data Protection Board without contacting us first?
Is there a fixed number of days we have to respond to a grievance?
Does this grievance right cover only erasure and correction requests?
Related sections
Section 14 — Right to Nominate
Continue to the next section in sequence.
Read Section 14Section 12 — Right to Correction and Erasure of Personal Data
Go back to the previous section.
Read Section 12Chapter III — Rights and Duties of Data Principal
See every section in this chapter together.
View the chapterFull DPDP Act Guide
Back to the overview page, with the complete section-by-section guide.
View all 44 sectionsGrievance Redressal
The fuller walkthrough of how grievance redressal works in practice, and what happens if it doesn't resolve the issue.
Read about grievance redressal