Grievance Redressal
The process through which a Data Principal complains to a Data Fiduciary or Consent Manager and gets a response.
Grievance redressal is the process by which a person with a complaint about how their data is handled can raise it with the organisation and get a reply. It must be the first step before going to the Data Protection Board.
Meaning of Grievance Redressal
Every Data Fiduciary and Consent Manager must have a readily available way to resolve complaints. A Data Principal should normally use it before approaching the Data Protection Board. The Rules set the time within which fiduciaries must respond.
Section 13(1) gives a Data Principal the right to readily available means of grievance redressal from a Data Fiduciary or Consent Manager, for any act or omission regarding its obligations in relation to her personal data, or the exercise of her rights. The wording is broad. A complaint can be about a missing notice, a refused erasure request, a data breach, unwanted marketing or a processor's conduct.
The organisation must respond within a prescribed period. Rule 14 requires every Data Fiduciary and Consent Manager to prominently publish, and implement measures to meet, a response period of no more than ninety days. That is an outer limit. Section 8(9) also requires publication of the business contact information of a Data Protection Officer or another person who can answer questions, and Section 8(10) requires an effective grievance mechanism.
Grievance redressal is a gate to the Board. Section 13(3) says a Data Principal must exhaust the opportunity of redressing her grievance under this section before approaching the Board. Sections 15(d) and 28(12) back this up from the other side: the Data Principal must not file false or frivolous complaints, and the Board may warn or impose costs where it finds that she did.
The channel should be easy to use, and the reply should be reasoned. It is different from a rights request itself, though the same desk often handles both: a request to erase data is the exercise of a right, and an unhappy response to it is a grievance. A Significant Data Fiduciary or regulated entity may also run parallel sector systems, such as an RBI ombudsman route for banks, and should map how these fit together.
Examples of Grievance Redressal
A user emails the privacy contact about a data issue and receives a written reply with action taken within the time the Rules require.
A small app publishes a privacy email, assigns the founder as contact, and promises a reply in 15 days. When a user complains of unwanted promotional messages, the start-up stops them, confirms in writing and logs the cause.
A customer complains that her data was shared with a marketing partner. The bank's privacy team investigates, ends the arrangement, and also informs her of any separate sector route available under RBI rules.
A patient complains that reception staff discussed her records in a waiting area. The hospital apologises, retrains staff, and tells her what it changed, which helps close the complaint without escalation.
Why Grievance Redressal matters
A working grievance process is the cheapest form of risk control. Most complaints are resolved when someone competent reads them, fixes the issue and explains. Complaints that are ignored are the ones that reach the Board, where an inquiry can examine the fiduciary's wider practices and impose penalties of up to ₹50 crore for general breaches, with higher ceilings if security or children's duties are involved.
For individuals, the process is the practical way to get things done without lawyers. For business, the complaint log is also a source of insight about confusing notices, broken forms and unhappy customers, so a well-run desk improves the product as well as compliance.
How it works in practice
- 1Name an owner, such as the DPO or a privacy officer, and publish the contact details on the website and in the app, as Section 8(9) and Rule 9 expect.
- 2Provide more than one way to complain, such as an in-app form and an email address, and give a reference number on receipt so the person can follow up.
- 3Set service levels well within ninety days, for example acknowledgement in 48 hours and resolution within 30 days for ordinary cases, and publish the period you commit to as Rule 14 requires.
- 4Triage complaints by type: rights request, security concern, marketing or children's data. Send serious ones such as suspected breaches to the incident team at once.
- 5Reply in writing with the decision and reasons, tell the person she may approach the Board if unsatisfied, and record outcomes to spot repeated issues.
Where it appears in the DPDP Act and Rules
Common mistakes to avoid
Listing only a postal address or a generic support number. The means must be readily available and easy to find.
Treating ninety days as the normal turnaround. It is a ceiling, and slow replies attract complaints.
Closing complaints with a template reply that does not address the issue, which may push the person to the Board.
Failing to link the grievance desk with the incident-response and rights teams.
Compliance tips
Test the channel yourself every quarter by submitting a dummy complaint and timing the response.
Track categories of complaint and report them to senior management each quarter.
Train front-line staff so that a complaint made on social media or by phone still reaches the privacy desk.
Common questions about Grievance Redressal
Can I go straight to the Data Protection Board?
Normally no. Section 13(3) requires a Data Principal to exhaust the fiduciary's or Consent Manager's grievance redressal opportunity first. If the response is unsatisfactory or does not come within the published period, she may then approach the Board.
How long does a company have to answer a data complaint?
Rule 14 requires fiduciaries and Consent Managers to publish a response period that does not exceed ninety days. That is the outer limit, so a company should usually answer sooner and must stick to the period it publishes.
What if I make a false complaint?
Section 15(d) makes it a duty of the Data Principal not to register a false or frivolous grievance or complaint. The Board can warn or impose costs on a complainant under Section 28(12), and breach of the duties can attract a penalty of up to ₹10,000.