Sekurzen Logo
DPDP chapter9 / 14

Chapter 9: Grievance Redressal Mechanism

Complaint handling and resolution

chapter · 2 min read · Updated 14-Feb-2026 · 9 of 14

Executive Summary

  • •If something goes wrong, the user shouldn't have to sue you immediately. You must provide a clear, easy way for them to complain to YOU first.

Institutional Impact

  • •Contact: Prominently publish the business contact information of the DPO, where applicable, or another person able to answer processing questions.
  • •Response period: Publish a reasonable grievance-response period that does not exceed 90 days and implement measures to meet it.
  • •No Ghosting: Ignoring complaints is a fast track to getting reported to the Data Protection Board.

Data Principal Rights

  • •First Step: You must complain to the company first. If they ignore you or give a bad answer, THEN you go to the Board.
  • •Easy Access: The contact information and grievance process should be prominent and usable; rule 9 also requires the contact to appear in responses to rights communications.

Practical application

What this looks like in practice

Use these examples to distinguish a defensible process from a common mistake.

Right

  • ✓A privacy notice names a grievance contact and the organization tracks the complaint through a documented resolution process.

Incorrect

  • ×A company provides no usable grievance channel or leaves complaints unanswered beyond its stated response timeline.

Official Reference & Scope

  • •Section 13: Grievance Redressal
  • •Rule 9: Contact information for processing questions
  • •Rule 14(3): Published grievance-response period

Specifies requirements for handling Data Principal complaints and grievances.

  • Grievance officer: Appointment and responsibilities
  • Complaint submission: How Data Principals can file complaints
  • Resolution timeline: Timeframes for addressing grievances
  • Escalation: Process for unresolved complaints

The notified Rules do not set a universal 72-hour acknowledgement and 30-day resolution period. Rule 14(3) requires the organization to publish a reasonable period not exceeding 90 days.

Primary sources: section 13 of the DPDP Act and rules 9 and 14(3) of the DPDP Rules.

Back to list
Chapter 8: Manner of Nominating Another IndividualNext: Chapter 10: Data Breach Notification