Section 13 · Rule 14(3)
Grievance redressal for DPDP fiduciaries
A Data Principal must use your grievance redressal before going to the Board. TruePrivacy gives that process a desk, a clock and a record.
Sample workspace
Grievance desk
- GRV-318Withdrawal not honouredDay 8 of 90
- GRV-311Erasure delayedDay 31 of 90 · escalated
- GRV-305Wrong address on recordResolved on day 6
GRV-311
- Category: erasure
- Escalated to DPO office
- Reply with contact details
Short answer
Section 8(10) of the DPDP Act requires an effective way to redress Data Principals' grievances, and s.13(3) says a Data Principal must exhaust it before approaching the Data Protection Board. Rule 14(3) asks each Data Fiduciary to publish its grievance response period, which shall not exceed 90 days. TruePrivacy runs a grievance desk with categories, SLA states and escalation, using the 90-day limit as the clock.
What the grievance desk does
Section 8(10) asks for an effective way to redress grievances, and s.13 gives Data Principals the right to use it. A desk with a clock makes that redressal visible to your team, and gives you a record of how each grievance was handled.
One place for grievances, sorted by category.
Each grievance carries an SLA state against the 90-day outer limit.
Escalate a grievance when it needs more senior attention.
Every action on a grievance is logged with before and after values, exportable as CSV.
How a grievance is handled
- 01Publish your process
Publish your grievance response period, at most 90 days, and the contact Rule 9 asks for on your website or app. Your notice must also show how to complain to the Board (Rule 3). See Rule 14 explained.
- 02Receive and categorise
Log each grievance with a category so related issues sit together.
- 03Work it against the clock
The SLA state shows where each grievance stands against the period; escalate when needed.
- 04Respond and record
Reply with your Rule 9 contact and close the grievance, keeping the trail. If the person is not satisfied, they can then approach the Board (s.13(3)).
Mapped to the Act and Rules
| Duty | Section or rule | What TruePrivacy does |
|---|---|---|
| An effective way to redress grievances | s.8(10) | Grievance desk with categories, SLA states and escalation |
| Right to grievance redressal, exhausted before approaching the Board | s.13, s.13(3) | A record of each grievance, its handling and its close |
| Publish a grievance response period of at most 90 days | Rule 14(3) | The 90-day limit as the clock on every grievance |
| DPO as the point of contact for grievances, for a Significant Data Fiduciary | s.10(2)(a) | Record the DPO and grievance contact in the SDF workspace |
| Means to complain to the Board, given in the notice | Rule 3 | You write the Board route into your notice text; see notices |
Before a grievance reaches the Board
No Board members have been appointed yet. Under s.13(3) a Data Principal must exhaust your redressal before approaching the Board, so your desk is the first stop either way. Set your published period with counsel; TruePrivacy's clock uses the 90-day outer limit, so aim to close sooner.
A grievance can follow a request that went wrong. Keep rights requests and grievances in the same workspace so your team sees both.
Works with
Access, correction, erasure, withdrawal and nomination requests on the same clock.
Privacy centerA branded portal where people submit requests and check status.
SDF: DPIA, DPO and data auditRecord the India-based DPO and grievance contact.
NoticesNotices that show people how to complain to the Board.
How long can I take to resolve a DPDP grievance?
Rule 14(3) asks you to publish your grievance response period, which shall not exceed 90 days, and to take measures to keep to it.
Can a Data Principal go straight to the Board?
No. Under s.13(3), a Data Principal must exhaust the Data Fiduciary's or Consent Manager's grievance redressal before approaching the Board.
Who handles grievances at a Significant Data Fiduciary?
The DPO, who is based in India and is the point of contact for grievances (s.10(2)(a)).
What should a grievance response include?
Rule 9 asks you to mention, in every response to a Data Principal, the business contact of the DPO (for an SDF) or of the person who can answer questions about processing.
Your DPDP plan, starting today
Core obligations for data fiduciaries begin on 13 May 2027.
Core obligations begin