Question · Grievance
Grievance officer under the DPDP Act: publish, establish, answer
By Suryansh Sagar, founder of Gevox. Last updated 3 October 2026.
The Act does not use the title, but it requires what the title means: a published contact of a person able to answer questions about the processing (Section 8(9)), an effective grievance mechanism (Section 8(10)), and a response within the period you publish, at most ninety days (Section 13, Rule 14). A name on a page satisfies the first and asserts the other two.
From the Gevox Readiness Index: Eight of twenty advisor websites have no DPDP-compliant privacy notice; eight publish no privacy contact.
Three duties, read apart
- Publish. The business contact of a person who can answer questions about the processing, prominently on the website or app and in every response to a rights request. Section 8(9), Rule 9.
- Establish. A grievance redressal mechanism, and the Act requires it to be effective. Section 8(10).
- Answer. Within a reasonable period, capped at ninety days by Rule 14(3). Section 13(2).
Why it matters more than it looks
Section 13(3) requires a Data Principal to exhaust the Fiduciary’s mechanism before approaching the Board. A working mechanism keeps complaints with you. A missing one sends them to the regulator, where Section 27 gives the Board the power to inquire and Section 33 to penalise.
The DPO is a different duty
Only a Significant Data Fiduciary must appoint a Data Protection Officer under Section 10. Every other Fiduciary needs the Section 8(9) contact and the Section 8(10) mechanism, whatever the person is called.
Questions people ask
- Can the grievance officer be a shared mailbox?
- Section 8(9) requires the contact of a person able to answer questions. A mailbox that a named person answers works; an unmonitored alias does not.
- Is ninety days the target?
- No. Rule 14(3) sets it as the outer limit around a reasonable period. Publish a shorter one.
- Where must the contact appear?
- Prominently on the website or app, and in every response to a rights request, under Rule 9.
Read next
The DPDP brief
One email a month. What moved in the Act, and what our scans found.
Every claim cited to its section, the same way these pages are. No product news, no roundups of other people’s blogs.