India DPDPA: Article 13 – Right of grievance redressal
13. Right of grievance redressal
(1) A Data Principal shall have the right to have readily available means of grievance redressal provided by a Data Fiduciary or Consent Manager in respect of any act or omission of such Data Fiduciary or Consent Manager regarding the performance of its obligations in relation to the personal data of such Data Principal or the exercise of her rights under the provisions of this Act and the rules made thereunder.
(2) The Data Fiduciary or Consent Manager shall respond to any grievances referred to in sub-section (1) within such period as may be prescribed from the date of its receipt for all or any class of Data Fiduciaries.
(3) The Data Principal shall exhaust the opportunity of redressing her grievance under this section before approaching the Board.
What Article 13 Means for Your Business
Article 13 requires every Data Fiduciary to establish an accessible grievance redressal mechanism for Data Principals. This is not optional, it is a mandatory operational requirement. The Article also creates a two-tier escalation path: first to the Data Fiduciary, then to the Data Protection Board of India if the individual is unsatisfied.
- You must establish and publish a clear grievance redressal mechanism, a named contact, email address, or online form is the minimum requirement.
- Grievances must be addressed within the time period prescribed under the DPDP Rules, failing to respond within the prescribed timeframe entitles the Data Principal to escalate directly to the Board.
- The grievance mechanism must be accessible and not require the individual to navigate complex processes to reach it, burying it in a lengthy privacy policy is insufficient.
- Maintain a log of all grievances received, responses given, and timelines, this forms part of your compliance record and may be reviewed by the Board.
- Train customer-facing and compliance staff to identify and properly route data protection grievances so they are handled under Article 13 requirements rather than general customer service processes.