DPDP Act · Section 13 · Rule 14
DPDP grievance redressal: how the process works
A Data Principal may raise a grievance when a Data Fiduciary or Consent Manager acts or fails to act in relation to personal data or the exercise of rights under the DPDP Act. The law expects a readily available route and a process that can provide a considered response.
01 · The right
A grievance route should be easy to find and use
Section 13 of the DPDP Act gives a Data Principal the right to readily available means of grievance redressal from a Data Fiduciary or Consent Manager. It covers an act or omission concerning that organisation’s obligations about the person’s personal data or their exercise of rights under the Act and Rules.
This is the organisation’s internal redressal process. A grievance may relate, for example, to an unanswered access request, an inaccurate record that has not been addressed, an unexplained refusal, or a concern about how a request was handled.
Rule 14 requires Data Fiduciaries and Consent Managers to prominently publish their grievance response period. It must be reasonable and cannot exceed 90 days. They must also use appropriate technical and organisational measures to support responses within that period.
Sources: section 13 of the DPDP Act and Rule 14 of the DPDP Rules, 2025.
02 · A practical route
What to do when you want to raise a concern
A clear, factual message helps the organisation locate the issue and understand what resolution you are seeking.
Use its published contact channel
Check the organisation’s website or app for its rights request and grievance instructions. A service provider may process information for another organisation, so the Data Fiduciary may be the right first contact.
Include enough context to investigate
Describe the relevant request or processing, when you contacted the organisation, any case number and what you believe remains unresolved.
Save the response and dates
Keep a copy of what you sent, acknowledgement, supporting correspondence and the final response. These help explain the steps already taken if you need to escalate.
03 · Response period
Up to 90 days is a ceiling, not a target
Rule 14 says the published period for responding to a grievance must be reasonable and no longer than 90 days. The appropriate response time may be shorter depending on the organisation’s published process and the circumstances.
When raising a grievance, check the response period the organisation publishes. If you do not receive a response within that period, keep evidence of your attempts and use the next available route described by the organisation or the Act.
The 90-day maximum in Rule 14 is specifically about responding to grievances. It should not be treated as a universal deadline for every type of rights request.
04 · Further redress
The Board route follows the process set out in the Act
Section 13(3) says a Data Principal must exhaust the opportunity to redress a grievance under that section before approaching the Data Protection Board.
Start with the Data Fiduciary or Consent Manager
Raise the issue through the organisation’s published process and allow it to respond within its stated period, subject to the Act and Rules.
Keep your evidence together
Retain the original request, acknowledgements, relevant replies and dates. The Board’s own process and jurisdiction are governed by the Act, Rules and directions it publishes.
Read sections 13 and 27 of the Act and check official Board information for current filing procedures.
05 · Commencement
When are the grievance provisions scheduled to apply?
Sections 11 to 14 of the Act and Rule 14 are scheduled to commence eighteen months after the notification dated 13 November 2025.
See the official commencement notification and the notified Rules.
Questions people ask
DPDP grievance FAQs
What counts as a DPDP grievance?
A concern about an act or omission by a Data Fiduciary or Consent Manager in performing obligations related to your personal data or your rights under the Act and Rules.
How long can an organisation take to respond?
Rule 14 requires the organisation to publish a reasonable response period that does not exceed 90 days. The organisation’s stated period may be shorter.
Can I approach the Board before contacting the organisation?
For grievance redressal under section 13, the Act says you must exhaust the opportunity to raise the grievance with the Data Fiduciary or Consent Manager before approaching the Board. The Act also provides other Board functions and complaint routes; review the provisions that apply to your situation.
Build a clear process for rights requests
Learn how an organisation can make its request and grievance channels easy to find and follow.