Compliance
A functional grievance redressal system keeps complaints inside the business, avoiding costly Board referrals and penalties, and ensures the response time set by the Rules is met.
Check your DPDP readiness — free More on the blogSection 13 of the Digital Personal Data Protection Act obliges every data fiduciary or consent manager to provide a readily available way for a data principal to lodge a grievance about any act or omission in meeting its duties. The grievance must be answered within the time limit fixed by the Rules, counted from the day the complaint is received. Before a data principal can approach the Data Protection Board, they must first use this internal mechanism.
The provision creates a two‑step path: first the internal channel, then the Board. If the internal route works, the matter never reaches the Board, saving the business the cost of legal defence, possible fines and reputational damage. The cost of compliance is therefore the effort to set up and monitor a genuine, responsive channel rather than the expense of a Board proceeding.
Many firms publish an email address or phone number that no one checks, assuming that satisfies the law. The Act requires a "readily available" means, which means the channel must be actively monitored and capable of handling complaints promptly. Treating the response period as a guideline rather than a mandatory deadline also creates risk, because the clock starts when the grievance is received, not when it is first noticed internally. Another mistake is confusing the grievance route with the Section 8 requirement to disclose a contact for general queries about processing. Section 13 deals specifically with complaints about the fiduciary's obligations, so the two mechanisms should be separate and clearly described to avoid confusion and duplicate effort.
Because the data principal must exhaust the internal grievance process before approaching the Board, a well‑run channel acts as a shield. Prompt acknowledgement, transparent timelines and a documented resolution process demonstrate good faith, reducing the likelihood that a complainant will seek Board intervention. This not only saves potential penalties but also preserves customer trust. Implementing a simple ticketing system, training staff on the statutory timelines, and regularly reviewing the grievance log can turn the legal obligation into a cost‑effective quality control tool. When complaints are resolved early, the business avoids the higher expense of Board hearings, investigations and any subsequent enforcement action.
The DPDP Act does not merely ask for a contact detail; it demands an operational grievance mechanism that responds within a fixed period. Failing to meet this requirement forces the matter to the Data Protection Board, where costs rise sharply. Investing in a functional channel therefore pays for itself by keeping disputes internal and limiting exposure to regulatory sanctions.
The law requires a readily available means for data principals to lodge complaints about a fiduciary's obligations, and a response must be given within the period set by the Rules, starting from the date the grievance is received.
No. Section 13 applies regardless of whether processing was based on consent, because the right attaches to the performance of the fiduciary's obligations, not to the legal ground for processing.
By resolving complaints before they reach the Data Protection Board, a business avoids the higher costs of Board proceedings, potential fines and reputational harm, making the internal channel a cost‑saving measure.
Missing the prescribed response period breaches Section 13, exposing the fiduciary to enforcement action by the Board, which can include penalties and orders that increase the overall cost of non‑compliance.
Published 29 September 2026. Founder & CEO at VidhiSar. I have watched four companies pay for the same mistake, and it was never the mistake anyone expected. VidhiSar is software, not a law firm: every answer names the section it relies on so you can check it, and anything turning on your specific facts is worth putting to a professional. More about who builds this
Maintains the law explainers, calculators, templates and blog posts on vidhisar.in: checks them against the statute text and updates them when the law changes. Errors and changes in the law can be reported to legal@vidhisar.in.