DPDP in practice
People must be able to complain to you before they complain about you.
The Act gives every person a right to readily available grievance redressal, and makes them use it before going to the Data Protection Board of India. That makes your grievance desk the first forum for every dispute. Run it well and most complaints end there.
Back to DPDP services01 · What the Act asks
Four provisions that build the mechanism
Sections 8(9), 8(10), 13 and the notice in section 5.
- Section 8(10)
- Set up an effective mechanism to redress grievances.
- Section 13(1) and (2)
- The person has a right to readily available means of redress, and you must reply within a prescribed period.
- Section 13(3)
- The person must exhaust your mechanism before approaching the Board.
- Section 8(9)
- Publish the business contact of a DPO, if you have one, or of someone who can answer questions about processing.
- Section 5(1)
- Every notice tells the person how to use the grievance right and how to complain to the Board.
02 · Contact or DPO
A contact point for everyone, a DPO for some
Every fiduciary names a contact. Only significant data fiduciaries must appoint a DPO.
Every data fiduciary
A named contact
- Someone able to answer questions about processing
- Business contact details published prominently on the website or app (rule 9)
- Named again in every reply to a rights request
- Can be a role mailbox with a responsible person behind it
Significant data fiduciary
A Data Protection Officer
- Represents the fiduciary under the Act
- Based in India
- Answers to the board of directors or similar body
- Is the point of contact for the grievance mechanism
Which businesses are significant depends on a government notification under section 10. If you might be named, plan the DPO role early.
03 · Response time
What the Rules say about replying
Rule 14: publish your period, keep it at or under 90 days, and resource it.
- Publish on the website or app how to make a request and what identifier the person must give, such as a customer number or registered email.
- Publish the period within which you will answer grievances. The Rules cap it at ninety days.
- Back the period with technical and organisational measures, so the published number is one you meet.
- Accept a nominee acting for a person who has died or lost capacity, using the means you publish.
Ninety days is a ceiling
A desk that needs the full ninety days for a simple question will lose people to the Board. Set a period you can beat, and measure it.
04 · Running the desk
Running a grievance desk, step by step
Eight steps, each leaving a trace in the log.
- Receive through the channels you publish, and log the date and time.
- Acknowledge quickly with a reference number and the expected reply date.
- Verify the person using the identifier you published; ask for no more than you need.
- Classify: a question, a rights request, a complaint about processing, or a breach concern.
- Route to the owning team through the data map, with a due date inside your published period.
- Decide and record the reason, including any law that limits what you can do.
- Reply in plain words, naming the contact point and the person's route to the Board.
- Close and review: patterns go to the privacy lead monthly.
- LanguageReplies in the language the person used where you can; the Act's notice languages are a guide.
- ChannelsAt least one digital channel; avoid forms that need an account the person no longer has.
- Escalation insideA second-level review before a refusal goes out.
05 · To the Board
When a complaint goes to the Board
After your desk, the Board; after the Board, TDSAT.
| Stage | Who | What happens | Time set by law |
|---|---|---|---|
| Your desk | You | The person raises the grievance; you reply | Your published period, at most 90 days (rule 14) |
| Complaint | The Board | The person complains once your mechanism is exhausted; the Board inquires | Inquiry within six months, extendable by up to three months at a time (rule 19(9)) |
| Appeal | TDSAT | Either side appeals the Board's order or direction | Filed within sixty days (section 29) |
The person has duties too. Section 15 bars a false or frivolous grievance or complaint, and the Schedule sets a ceiling of ten thousand rupees for breaching those duties. Log what you receive faithfully either way; the Board will read your record, not your view of the complainant.
06 · Log template
A grievance log that answers the Board's questions
One row per grievance. Example values are illustrative.
| Field | What to record | Example (illustrative) |
|---|---|---|
| Reference | A unique number given at receipt | GRV-0142 |
| Received | Date, time and channel | Web form, 09:40 |
| Identity check | Identifier used and outcome | Registered email, matched |
| Category | Question, rights request, complaint or breach concern | Erasure request |
| Systems touched | From the data map | CRM, email platform, billing |
| Owner and due date | Team and the date inside your published period | Support lead, within published period |
| Decision and reason | What you did and why, citing any law that limits it | Erased marketing data; billing kept under tax law |
| Reply sent | Date, and confirmation that it named the contact and the Board route | Sent; both included |
| Escalated | Whether the person went to the Board | No |
| Lessons | Anything to fix in process or product | Unsubscribe link missing from one template |
- A contact that cannot answer. Rule 9 wants someone able to answer questions about processing, not a generic help line.
- No published period. Without it you cannot show you met it.
- Replies with no Board route. Leaving it out invites a complaint that you hid the person's options.
- Grievances outside the log. Complaints sent to staff directly or on social media still count.
Sources: the Digital Personal Data Protection Act, 2023 (sections 5, 8(9), 8(10), 10(2), 13 to 15, 27 to 29 and the Schedule); the Digital Personal Data Protection Rules, 2025, G.S.R. 846(E), rules 9, 14, 19 and 22; the PIB backgrounder on the Rules, November 2025.
Questions about grievances and the DPO
Do we need a DPO if we are not a significant data fiduciary?
No. You need a published contact who can answer questions.
Section 10 requires a DPO only of significant data fiduciaries. Everyone else publishes the contact of a person able to answer on their behalf. Many choose to give that person a privacy title anyway.
Can the DPO sit outside India?
Not for a significant data fiduciary.
Section 10(2) requires the DPO of a significant data fiduciary to be based in India and answerable to its board of directors or similar body.
Can a person go straight to the Board?
Not for a grievance. They must use your mechanism first.
Section 13(3) makes the person exhaust your redress before approaching the Board. That is why a working desk, with a reply on record, matters.
Is a grievance the same as a rights request?
Related, but not the same.
A rights request asks you to do something: give access, correct or erase. A grievance is a complaint about what you did or failed to do, including how you handled a request. Log both, and link them when one leads to the other.
Can we outsource the desk?
You can outsource the work, not the duty.
A provider can run intake and tracking under contract. The mechanism stays yours under section 8(10), and replies should name your contact point.
Settle complaints at your desk, not at the Board.
A DPDP readiness assessment reviews your contact point, published periods and grievance log. Counsel should confirm how the Act and the Rules apply to your contracts and sector.