Grievance Redressal (DPDP)
The Section 13 duty to answer Data Principal grievances within a published period of up to 90 days under Rule 14(3) of the DPDP Rules 2025.
Full Definition
Section 13 of the DPDP Act gives every Data Principal a right to a readily available means of grievance redressal against a Data Fiduciary. Rule 14 of the DPDP Rules 2025 (in force from 13 May 2027) operationalises this: the Fiduciary must appoint a Grievance Officer whose contact details are published on the website or app; must provide a specific intake channel; and must publish, and meet, a grievance response period of not more than 90 days under Rule 14(3). Many mature teams target 30 days as an internal SLA, well below the 90-day ceiling.
If grievance redressal at the Fiduciary fails or is unsatisfactory, the Data Principal may escalate to the Data Protection Board of India under Section 13(2). The Board's complaint intake is expected to open alongside the broader substantive commencement on 13 May 2027. For Data Fiduciaries, the operational baseline is: a published Grievance Officer contact, an intake form that captures the complainant and the complaint category, SLA-tracked routing (DSR, consent, data security, breach), decision workflow with reasoned refusals where appropriate, and an audit trail of every complaint and its outcome.
Related terms
Data Protection Officer
An individual appointed to oversee an organisation's data protection strategy, advise on compliance, and act as the point of contact for regulators and data subjects.
Right to Access
A data subject's right to obtain confirmation of whether their personal data is being processed and to receive a copy of it.
Right to Correct
The right of a data subject to have inaccurate or incomplete personal data about them corrected or completed.
Relevant regulations
Automate your privacy program
TruePrivacy handles DSRs, consent management, data mapping, and breach response — all in one platform.
Free 14-day trial · No credit card required · Setup in minutes