Compliance
A functional grievance channel keeps complaints inside the firm, avoids Board escalation and saves the cost of legal defence, audit and reputational damage under the Digital Personal Data Protection Act.
Check your DPDP readiness — free More on the blogThe first step is to create a dedicated email address or portal that is actively monitored during business hours. The inbox must be publicised on the privacy notice and on any consent‑manager interface. Assign a specific team – typically the data protection officer and a support analyst – to receive, acknowledge and log each submission. An unattended mailbox does not satisfy the “readily available” requirement, so continuous oversight is essential.
The Rules prescribe a fixed number of days for a reply. Record the exact date and time each grievance enters the system; the countdown starts from that moment, not from when the issue is first seen internally. Configure the ticketing tool to flag the deadline and trigger reminders. This ensures the firm meets the statutory period and avoids penalties for late replies.
Maintain the log in a secure, auditable format such as a protected spreadsheet or a compliance management system. The record must be retrievable for inspection by the Data Protection Board or auditors. Keeping a clear audit trail demonstrates that the internal route was exhausted before any external escalation.
Conduct a short training session for the data protection officer, legal counsel and customer‑service staff on the grievance procedure, the statutory timeline and the importance of timely acknowledgment. Use real‑world examples to illustrate how a prompt, well‑documented reply can resolve the issue without involving the Board, thereby saving legal costs and potential fines.
If the grievance cannot be resolved within the prescribed period, the Data Principal may approach the Board, but only after the internal process is fully exhausted. Prepare a summary report that includes the original complaint, investigation notes, response sent and any follow‑up actions. This package must be ready to submit on demand, showing that the firm complied with Section 13 before seeking external remedy.
At the end of each year, analyse the grievance log for patterns – recurring issues, delayed responses or unaddressed queries. Use the findings to refine the inbox handling, update the privacy notice and adjust internal SOPs. Continuous improvement reduces repeat complaints, lowers the volume of Board referrals and cuts long‑term compliance costs. By following these steps – establishing a monitored inbox, counting the response period from receipt, documenting every action, training staff, limiting Board escalation and reviewing performance – a small business can meet the DPDP Act’s grievance requirement efficiently and avoid the financial impact of non‑compliance.
It must be a publicly disclosed, actively monitored point of contact such as a dedicated email address or portal. The channel should be listed in the privacy notice and staffed so that every submission is acknowledged and logged without delay.
The statutory period begins on the date the grievance is received in the monitored inbox, not when it is first noticed internally. The firm must record the receipt timestamp and count the days from that point to meet the prescribed deadline.
A unique ID, receipt date and time, principal’s details, assigned officer, investigation steps, evidence, final response and dispatch date. These records must be stored securely and be readily producible to the Data Protection Board or auditors.
No. Section 13 requires the principal to first use the fiduciary’s grievance mechanism. Only after the internal route is exhausted may the principal approach the Board, and the business must provide a full dossier of the internal handling.
Published 14 October 2026. Founder & CEO at VidhiSar. I have watched four companies pay for the same mistake, and it was never the mistake anyone expected. VidhiSar is software, not a law firm: every answer names the section it relies on so you can check it, and anything turning on your specific facts is worth putting to a professional. More about who builds this
Maintains the law explainers, calculators, templates and blog posts on vidhisar.in: checks them against the statute text and updates them when the law changes. Errors and changes in the law can be reported to legal@vidhisar.in.