Compliance
Failing to publish a working grievance contact breaches Section 8(10) of the DPDP Act and can push a data principal straight to the Board, exposing a business to regulatory scrutiny and possible penalties.
Check your DPDP readiness — free More on the blogThe first task is to decide who will act as the point of contact. For a Significant Data Fiduciary the law requires a Data Protection Officer who must be resident in India. For all other fiduciaries a designated individual is sufficient, but the person must have the authority and knowledge to answer queries about data processing. Typically the role is assigned to a senior compliance officer or legal counsel, and the appointment is recorded in a board resolution.
Once the responsible person is named, the business must prepare a public contact entry. This includes the name, official designation, business email address, telephone number and, where appropriate, a physical address. The details must be accurate, regularly monitored and displayed on the organisation’s website and privacy notice. A simple template can be used, but it should be signed off by the appointed officer to confirm correctness.
The next step is to make the contact visible to data principals. The information should appear on every page that collects personal data, in the privacy policy and on any mobile app’s help section. It must be presented in a clear, readable format and not hidden behind generic support forms. After publishing, the business should take a screenshot or archive the page as evidence of compliance.
Before the Rules prescribe a specific period, the organisation should establish its own internal SLA for acknowledging and resolving grievances. A common practice is to acknowledge receipt within 24 hours and aim for resolution within the maximum period later defined by the Rules. These timelines are documented in an internal grievance‑handling SOP and communicated to the appointed contact.
All employees who may receive data‑related queries need basic training on the grievance process, the importance of the statutory timeline and escalation routes. Conduct a mock grievance exercise quarterly to verify that the contact details are functional, that acknowledgements are sent promptly and that the resolution workflow works end‑to‑end.
The DPDP Act allows the Board to request evidence of compliance. The business must keep a file containing the board resolution appointing the contact, the published contact details, the SOP, the grievance log and copies of all communications with data principals. Records should be retained for at least the period prescribed by the Rules and be readily accessible for audit.
Changes in personnel, contact information or organisational structure require an immediate update of the published details. An annual compliance review should verify that the contact remains resident (for a DPO), that the contact channels are still monitored and that the internal timelines align with any amendments to the Rules. The review outcome is recorded in the compliance register.
If a data principal is not satisfied after the internal process, they may approach the Data Protection Board. The business should therefore keep a ready‑to‑share dossier containing the original grievance, the acknowledgement, the investigation notes and the final response. Having this packet prepared reduces the risk of further penalties and demonstrates good faith compliance.
The law requires the fiduciary to retain all grievance‑related documents for the period specified in the Rules, which is typically several years. Keeping the records longer is prudent, as the Board may request them at any time during an investigation.
No. The provision demands a working contact that can answer data‑protection queries. A generic inbox with no dedicated staff or a placeholder address is considered a breach of Section 8(10) and can lead to regulatory action.
The organisation must promptly update the published contact details and notify the Board of the change. Until a new DPO is appointed and the information is refreshed, the fiduciary remains non‑compliant.
Yes, an internal SLA demonstrates proactive compliance. However, once the Rules prescribe a specific period, the fiduciary must adjust its timelines to meet that statutory deadline, otherwise the response may be deemed untimely.
Published 17 October 2026. Founder & CEO at VidhiSar. I have watched four companies pay for the same mistake, and it was never the mistake anyone expected. VidhiSar is software, not a law firm: every answer names the section it relies on so you can check it, and anything turning on your specific facts is worth putting to a professional. More about who builds this
Maintains the law explainers, calculators, templates and blog posts on vidhisar.in: checks them against the statute text and updates them when the law changes. Errors and changes in the law can be reported to legal@vidhisar.in.