A Data Principal has the right to a readily available means of grievance redressal provided by a Data Fiduciary or Consent Manager, in respect of any act or omission regarding the performance of its obligations.
The Data Fiduciary or Consent Manager must respond to a grievance within the period prescribed by the Rules, counted from the date it is received.
The Data Principal must exhaust the opportunity of redressing the grievance under this section before approaching the Data Protection Board.
The right exists whether or not the processing was grounded on consent, because it attaches to the performance of obligations rather than to the ground.
Sequence
fiduciary first, Board second. The internal route is a precondition to the Board, which makes a working grievance channel the thing that keeps a complaint inside the business.
Where people go wrong
Publishing a channel that nobody monitors. The right is to a readily available means of redressal, and an unattended inbox is not one.
Treating the response period as advisory. It is prescribed, and it runs from receipt rather than from the point the complaint is noticed internally.
Confusing this with the section 8 requirement to publish a contact. Section 8 requires somebody who answers questions about processing; section 13 requires a route for complaints about obligations.
Assuming a complaint can go straight to the Board. The Data Principal has to exhaust the internal route first, which is an advantage to the business only if that route works.
Common questions
Does a business have to provide a grievance mechanism under the DPDP Act?
Yes. Section 13 gives every Data Principal the right to a readily available means of grievance redressal provided by the Data Fiduciary or Consent Manager, and requires a response within the period prescribed by the Rules.
Can a person complain directly to the Data Protection Board?
Not first. Section 13(3) requires the Data Principal to exhaust the opportunity of redressing the grievance with the Data Fiduciary or Consent Manager before approaching the Board.
How long does a business have to respond to a grievance?
The period is prescribed by the Rules made under the Act, and it runs from the date the grievance is received rather than from the date it is escalated internally.
A plain-English summary of what this provision requires, not a reproduction of it and not legal advice. Read alongside the bare Act, and take advice on anything turning on your own facts.