Data protection · Provision

Section 13, DPDP Act 2023 — Grievance Redressal Mechanism & Procedure

Data Fiduciaries must provide a readily available grievance redressal mechanism, and the Data Principal must exhaust it before approaching the Board. (Section 13, Digital Personal Data Protection Act, 2023.)

Quick Statutory Answer

Section 13 of the DPDP Act 2023 establishes the statutory right of Data Principals to access an easily available grievance redressal mechanism provided by the Data Fiduciary. Crucially, Section 13(3) requires that the individual must first exhaust internal grievance channels with the company before filing a regulatory complaint with the Data Protection Board of India. Fiduciaries must resolve grievances within statutory timelines prescribed under the DPDP Rules.

Check your compliance exposure — free All provisions

What the section does

  • A Data Principal has the right to a readily available means of grievance redressal provided by a Data Fiduciary or Consent Manager, in respect of any act or omission regarding performance of obligations.
  • The Data Fiduciary or Consent Manager must respond to grievances within the period prescribed by the DPDP Rules, counted from the date of receipt.
  • Crucially, Section 13(3) requires the Data Principal to exhaust the opportunity of redressing the grievance under this section before approaching the Data Protection Board.
  • The right attaches to the performance of obligations under the Act, operating whether processing was based on consent or a Section 7 legitimate use.

Section 13 DPDP Act: Grievance Escalation & Statutory Timelines

Section 13 DPDP Act: Grievance Escalation & Statutory Timelines
Dispute Stage Responsible Forum Statutory Prerequisite Outcome / Authority
Internal Grievance Data Fiduciary Grievance Officer Submitted via published channel Resolution / reasoned decision under DPDP Rules
Consent Dispute Registered Consent Manager Filed regarding consent withdrawal Consent record audit and revocation
Regulatory Complaint Data Protection Board of India (DPBI) Exhaustion of Section 13 internal channel Formal inquiry & monetary penalty under Section 33

Exhaustion sequence

Fiduciary first, Board second. Internal redressal is a statutory prerequisite before the Data Protection Board will entertain a complaint.

Where people go wrong

  • Publishing a dead email address with nobody monitoring submissions.
  • Ignoring grievance turnaround deadlines prescribed by the DPDP Rules.
  • Failing to keep auditable dispute logs required to prove compliance before the Board.

Common questions

Does a business need a grievance redressal channel under the DPDP Act?

Yes. Section 13 gives every Data Principal the right to readily available grievance redressal, and businesses must publish an accessible mechanism and respond within prescribed timelines.

Can a user file a direct complaint with the Data Protection Board?

No. Under Section 13(3), the user must first exhaust the internal grievance redressal mechanism provided by the business before approaching the Board.

Act on this

  • DSAR response report format
  • Section 12 — correction & erasure
  • Section 16 — grievance officer

Other provisions

  • Section 14, Digital Personal Data Protection Act
  • Section 12, Digital Personal Data Protection Act
  • Section 15, Digital Personal Data Protection Act
  • Section 10, Digital Personal Data Protection Act
  • Section 17, Digital Personal Data Protection Act
  • Section 9, Digital Personal Data Protection Act

Maintained by the VidhiSar Legal Team

Maintains the law explainers, calculators, templates and blog posts on vidhisar.in: checks them against the statute text and updates them when the law changes. Errors and changes in the law can be reported to legal@vidhisar.in.

About this summary

A plain-English summary of what this provision requires, not a reproduction of it and not legal advice. Read alongside the bare Act, and take advice on anything turning on your own facts.