Data protection · Provision

Section 16, DPDP Act 2023 — Grievance Redressal: Every Data Fiduciary Needs a Contact

Section 16, Digital Personal Data Protection Act, 2023

Every Data Fiduciary must publish a grievance contact and respond within the period the Rules prescribe. It is the mandatory first step before the Board.

Check your compliance exposure — free All provisions

What the section does

  • A Data Fiduciary must publish the business contact information of a person able to answer questions about processing — the Data Protection Officer for Significant Data Fiduciaries, a designated contact for others.
  • A Data Principal with a grievance may communicate it to the Data Fiduciary, which must acknowledge and resolve it within the period prescribed by the Rules.
  • Only after exhausting the grievance mechanism with the Data Fiduciary may a Data Principal approach the Board.

Without a grievance contact

Breach of s.8(10). Failing to publish a working grievance contact is a breach of section 8(10). A Data Principal who cannot reach the contact may go to the Board.

Where people go wrong

  • Publishing a generic support email with nobody behind it.
  • For Significant Data Fiduciaries: failing to appoint a DPO resident in India.
  • No internal response timeline set up before the Rules commence.
  • Treating grievances as ordinary support tickets rather than statutory requests.

Common questions

What is the grievance redressal mechanism under the DPDP Act?

Section 16 of the DPDP Act, 2023 requires every Data Fiduciary to publish a contact — a Data Protection Officer for Significant Data Fiduciaries, or a designated person for others — to whom a Data Principal can communicate a grievance about processing. The Data Fiduciary must acknowledge and resolve it within the period the Rules prescribe.

Who is a Data Protection Officer under the DPDP Act?

A person appointed by a Significant Data Fiduciary to be the point of contact for Data Principals on data protection matters. Other Data Fiduciaries must publish a designated contact but are not required to give them the DPO designation.

Can a user go directly to the Data Protection Board with a DPDP complaint?

Only after first filing a grievance with the Data Fiduciary and not receiving resolution within the prescribed period, or receiving unsatisfactory resolution. The Board is the appellate forum, not the first port of call.

What grievance contact must a Data Fiduciary publish under the DPDP Act?

Business contact information of the Data Protection Officer (for Significant Data Fiduciaries) or a designated person capable of answering questions about processing. Section 8(10) requires this — a working contact, not a placeholder.

Act on this

  • Section 11 — what a Data Principal can request
  • Section 33 — the Board's power to impose penalties
  • Section 8 — all Data Fiduciary duties
  • Privacy policy template (includes grievance contact)

About this summary

A plain-English summary of what this provision requires, not a reproduction of it and not legal advice. Read alongside the bare Act, and take advice on anything turning on your own facts.