s.8 · s.13 · Rule 9 · Rule 14
Grievance redressal
Every Data Fiduciary must publish a contact under Section 8(9), establish an effective grievance mechanism under Section 8(10), and answer within the period Rule 14 sets, which is at most ninety days.
These are three separate duties, and a website scan can see only the first. Publishing a contact satisfies Section 8(9). Running a mechanism that receives and resolves grievances satisfies Section 8(10). Answering within a reasonable period, capped at ninety days by Rule 14(3), satisfies Section 13.
Section 13(3) is the part nobody draws: a Data Principal must exhaust the Fiduciary’s own mechanism before approaching the Board. A working mechanism keeps complaints with you; a missing one sends them straight to the regulator.
Rule 9 requires the Section 8(9) contact to appear prominently on the website or app and in every response to a rights request. On the Gevox Readiness Index, 8 of 20 advisor websites published no such contact.
Questions people ask
- Is ninety days the target for answering a grievance?
- No. The test is a reasonable period; ninety days is the outer wall Rule 14(3) puts around it.
- Do we need a named Grievance Officer?
- The Act requires a published contact of a person able to answer questions, and a mechanism. It does not require the title, but naming a person is the simplest way to meet Section 8(9).
- Can a Data Principal go straight to the Board?
- Not under Section 13(3). They must first exhaust your mechanism, which is why having one matters.
Related terms
The DPDP brief
One email a month. What moved in the Act, and what our scans found.
Every claim cited to its section, the same way these pages are. No product news, no roundups of other people’s blogs.