Data protection · Provision
Every Data Fiduciary must publish a functioning grievance redressal contact and resolve complaints before a Data Principal can approach the Board. (Section 16, Digital Personal Data Protection Act, 2023.)
Quick Statutory Answer
Under Section 16 of the DPDP Act 2023, every Data Fiduciary must establish and publish a transparent grievance redressal mechanism. A Data Principal must first communicate any data protection grievance to the designated Grievance Officer or Data Protection Officer (DPO) and await resolution within the statutory timeline prescribed under DPDP Rules before filing a complaint with the Data Protection Board of India (DPBI). Failure to maintain a functioning grievance contact constitutes a direct violation of Section 8(10) actionable by the Board.
| Escalation Stage | Responsible Authority | Statutory Trigger | Turnaround / Response Window |
|---|---|---|---|
| Stage 1: Internal Grievance | Designated Grievance Officer / DPO | Written communication from Data Principal | Within period prescribed by DPDP Rules |
| Stage 2: Redressal / Remedy | Data Fiduciary Management | Verification of user identity & data review | Prompt rectification, erasure or reasoned refusal |
| Stage 3: Board Complaint | Data Protection Board of India (DPBI) | Unresolved grievance or expiry of timeline | Statutory inquiry and adjudication under s.28 |
Exhaustion requirement. The internal grievance procedure is the mandatory first step before regulatory escalation to the Board.
A designated Grievance Officer capable of answering questions and redressing complaints regarding data processing. Significant Data Fiduciaries must appoint an India-resident Data Protection Officer.
No. The user must first exhaust the grievance redressal mechanism provided by the Data Fiduciary under Section 16.
Maintains the law explainers, calculators, templates and blog posts on vidhisar.in: checks them against the statute text and updates them when the law changes. Errors and changes in the law can be reported to legal@vidhisar.in.
A plain-English summary of what this provision requires, not a reproduction of it and not legal advice. Read alongside the bare Act, and take advice on anything turning on your own facts.