Glossary · Grievance Redressal
What Is Grievance Redressal Under DPDPA?
Grievance redressal under the Digital Personal Data Protection Act, 2023 is a published path, not an unread inbox. Section 13 gives the Data Principal a readily available means of redress. Rule 14 sets how you publish it and the ninety-day ceiling. Remaining duties phase in on 13 May 2027.
Last reviewed: 17 September 2026
Definition
Section 13 of the Digital Personal Data Protection Act, 2023 gives every Data Principal the right to have readily available means of grievance redressal provided by the Data Fiduciary — and by a Consent Manager where one is used. Rule 14 requires the Fiduciary, and where applicable the Consent Manager, to publish prominently the means of making a rights request and any identifier needed to locate the person, to publish the grievance system, and to respond within a reasonable period not exceeding ninety days. Rule 14 also requires technical and organisational measures that make that clock real, and support for nomination. A buried email on a policy page is not the duty.
How this matters in practice
Most failures are unmeasured queues. Publish one URL or number, stamp every ticket, and time the ninety days. Route access, correction and erasure through the same desk so Rule 14 and Section 12 do not fork. Processor copies stay personal data — the answer must reach the LSP export, not only your CRM. Software is not a Rule 13 auditor and does not replace the published path.
Frequently asked questions
Is a privacy-policy email enough for Section 13?
No. Rule 14 wants the means published prominently, plus an identifier to locate the person, and a response within ninety days. A clause inside terms is not a readily available path. Instrument the queue so you can prove the clock.
Does every company need a Rule 13 audit because of grievances?
No. Rule 13 annual DPIA and independent audit start only after a Section 10 Significant Data Fiduciary notice. Grievance redressal still applies: publish the path, hit ninety days, keep the record. Those are not Rule 13.
Do we wait ninety days before the person can go to the Board?
You must respond within a reasonable period not exceeding ninety days. The Board is a later step after your system. Do not invent a cooling-off that makes the path harder than the original consent or notice channel.
Test one grievance this fortnight
Book 30 minutes to see whether a Rule 14 ticket is published, timed, and able to reach processor copies before 13 May 2027.
Book a demo
Free Gap Analysis
Disclaimer: Privigo is not a law firm. This page provides operational compliance guidance only. For institution-specific obligations, work with qualified Indian legal counsel.