Glossary
What is grievance redressal under DPDP?
Grievance redressal is the Data Fiduciary's own complaint process. A Data Principal must use it before approaching the Data Protection Board.
Definition
Grievance redressal is the Data Fiduciary's duty under s.8(10) of the DPDP Act, 2023 to have an effective way to resolve Data Principals' grievances, and the Data Principal's right under s.13. Under s.13(3), a Data Principal must exhaust the Data Fiduciary's or Consent Manager's grievance redressal before approaching the Board. Rule 14(3) caps the published grievance response period at 90 days.
What it means
Each Data Fiduciary and Consent Manager publishes its grievance response period, which must not exceed 90 days, and puts measures in place to keep to it (Rule 14(3)). The 90 days is an outer limit; you can publish a shorter period.
Because a Data Principal must exhaust this step before approaching the Data Protection Board (s.13(3)), your grievance desk is where a complaint is heard first. See Rule 14.
Where it appears in the Act and Rules
| Provision | What it says |
|---|---|
| s.8(10) | An effective grievance redressal mechanism |
| s.8(9), Rule 9 | Publish the contact of the DPO or the person who answers questions about processing |
| s.10(2)(a) | For an SDF, the DPO is the point of contact for grievances |
| s.13 | Right to grievance redressal |
| s.13(3) | Exhaust it before approaching the Board |
| Rule 3 | The notice gives the means to complain to the Board |
| Rule 14(3) | Published grievance response period of not more than 90 days |
Common misconceptions
- “Data Principals can go straight to the Board.” Not before exhausting the Data Fiduciary's process (s.13(3)).
- “90 days is the target.” It is the outer limit for the period you publish.
- “The Board can hear complaints today.” No Board members have been appointed yet, as of 4 November 2026.
Related terms
The Board established under s.18; no members appointed yet.
Data Protection OfficerThe India-based officer a Significant Data Fiduciary appoints (s.10(2)(a)).
Data Principal rightsAccess, correction, erasure, grievance redressal and nomination (ss.11 to 14).
Consent ManagerA Board-registered single point of contact for managing consent (s.2, Rule 4).
In TruePrivacy
The grievance desk has categories, SLA states and escalation, with the DPDP 90-day limit as the clock. Grievances and rights requests both run against that outer limit, so you can close them sooner.
Can a Data Principal complain to the Board directly?
Not first. s.13(3) requires them to exhaust the Data Fiduciary's or Consent Manager's grievance redressal before approaching the Board.
How long can a Data Fiduciary take to resolve a grievance?
Rule 14(3) requires each Data Fiduciary and Consent Manager to publish its grievance response period, which shall not exceed 90 days, and to keep to it.
Who handles grievances in a Significant Data Fiduciary?
The DPO is the point of contact for grievances under s.10(2)(a).
Your DPDP plan, starting today
Core obligations for data fiduciaries begin on 13 May 2027.
Core obligations begin