DPDPEnforced May 13, 2027Start free →
Book demo
++
Chapter III Penalty: Up to ₹50 Crore under general statutory schedule provisions

Section 13: Right of Grievance Redressal

Every organization processing personal data in India must provide a readily accessible grievance redressal mechanism and respond to user complaints within prescribed time limits.

Statutory Reference: Act No. 22 of 2023•Updated October 17, 2026

Statutory Text (Official Gazette)

(1) A Data Principal shall have the right to have readily available means of grievance redressal provided by a Data Fiduciary or Consent Manager in respect of any act or omission of such Data Fiduciary or Consent Manager regarding the performance of its obligations in relation to the personal data of such Data Principal or the exercise of her rights under the provisions of this Act and the rules made thereunder.

(2) The Data Fiduciary or Consent Manager shall respond to any grievances referred to in sub-section (1) within such period as may be prescribed from the date of its receipt for all or any class of Data Fiduciaries.

(3) The Data Principal shall exhaust the opportunity of redressing her grievance under this section before approaching the Board.

What Section 13 Means in Plain English

Section 13 establishes the mandatory customer complaint channel for privacy disputes:

  1. Readily available redressal: You cannot hide customer grievance procedures behind complicated support tickets or unmonitored mailboxes. The grievance channel must be prominent on your website or application.
  2. Response within a published period of 90 days or less: Rule 14(3) of the DPDP Rules 2025 (in force from May 13, 2027) requires every Data Fiduciary and Consent Manager to publish, prominently on its website or app, the period within which it will respond to grievances. That period cannot exceed 90 days, and you must have systems in place to meet it.
  3. Exhaustion requirement: Sub-section (3) protects businesses from frivolous Board complaints by requiring individuals to first attempt resolution through your company’s grievance channel before filing a formal dispute with the Data Protection Board of India.

Engineering Checklist

  • Dedicated grievance portal or email: Publish an accessible contact address (e.g., grievance@yourcompany.com) in your website header, footer, and consent widget.
  • Ticket SLA tracking: Implement automated ticketing workflows that tag DPDP grievances with strict internal SLAs so disputes are resolved before escalating to the Board.
  • Auditable resolution records: Store timestamps of when grievances are opened, communications sent, and final resolutions reached.
++ DPDP Compliance Scanner

Check if your website complies with Section 13

Scan your domain in seconds to detect tracking cookies, third-party analytics pixels firing before consent, and missing regional notices.

Run Free Website Audit Calculate Penalty Risk