Template · Grievance policy
Grievance redressal policy under the DPDP Act
By Suryansh Sagar, founder of Gevox. Last updated 3 October 2026.
The Act sets three separate duties: publish the contact of a person who can answer questions about processing (Section 8(9)), establish an effective grievance redressal mechanism (Section 8(10)), and respond within the period you publish, at most ninety days (Section 13, Rule 14). The policy is where all three are written down and made visible.
From the Gevox Readiness Index: Eight of twenty advisor websites have no DPDP-compliant privacy notice; eight publish no privacy contact.
Three duties, one document
Publishing a name answers Section 8(9). Running a route that receives, logs and resolves grievances answers Section 8(10). Answering inside the period answers Section 13. Rule 9 requires the contact to appear prominently on the website or app and in every response to a rights request. Rule 14(3) sets the ninety-day outer limit; the policy should state a shorter period.
Why it keeps the Board out
Section 13(3) requires a Data Principal to exhaust the Fiduciary’s own mechanism before approaching the Board. A working mechanism means complaints stay with you and are resolved. A missing one means every complaint goes straight to the regulator.
What it must contain
- 01The contactName or designation, email and a working channel, of the person able to answer questions about the processing.Section 8(9), Rule 9
- 02Where it is publishedProminently on the website or app, and repeated in every response to a rights request.Rule 9
- 03How to raise a grievanceThe form, address or portal, what to include, and an acknowledgement on receipt.Section 8(10), Rule 14(1)
- 04The response periodA stated period, not more than ninety days, within which the grievance is answered.Section 13(2), Rule 14(3)
- 05The mechanism behind itWho investigates, how it is logged, how it is escalated, and what the Data Principal is told at the end.Section 8(10)
- 06Escalation to the BoardThat the Data Principal may approach the Board after exhausting this mechanism, and how.Section 13(3), Section 27
What Gevox generates
An unedited excerpt from a document Gevox produced for a fictional client from its intake answers: Grievance Officer appointment and website disclosure. Every client gets its own, built from its own answers, with each clause tied to the provision it satisfies.
GRIEVANCE OFFICER
For any concern regarding the processing of your personal data by Northline Analytics Private Limited, contact our Grievance Officer:
Name: Asha Menon
Designation: Grievance Officer
Email: grievance@northline.example
Phone: +91 80 4000 1234
Postal address: 4th Floor, Gala House, Bengaluru 560001
Availability: Monday to Friday, 10:00 to 18:00 IST
You may submit a grievance through:
Email, Web form, Post
Service levels:
Acknowledgement: 48 hours
Resolution: 30 days
Every grievance is issued a unique tracking ID so you can follow its progress.
We can respond to your grievance in: English, Hindi.
If you are not satisfied with the resolution of your grievance, you may complain to the Data Protection Board of India.
Excerpt. The full document continues.
01
Answer the intake
The client, or you for them, answers questions about their data, purposes and vendors.
02
Gevox drafts it
Fixed templates fill from those answers. The same answers always give the same document, and gaps are flagged, not guessed.
03
Hand it over
Export to Word or PDF. On Suite and Firm it carries your firm’s name.
Sample structure
Headings with the substance each carries.
Who to contact
Grievance Officer: [name], [email]. Available Monday to Friday. Also stated in every response we send to a rights request.
How to raise a grievance
Email the address above with your name, what happened and what you want done. We acknowledge within two working days.
How long we take
We resolve grievances within thirty days. The law allows up to ninety; we do not use it.
If you are not satisfied
You may complain to the Data Protection Board of India after using this route. The Board’s process is digital.
Questions people ask
- Do we need a Data Protection Officer?
- Only a Significant Data Fiduciary must appoint a DPO under Section 10. Every Data Fiduciary needs a published contact under Section 8(9).
- Is ninety days the target?
- No. It is the outer limit under Rule 14(3). State a shorter period and meet it.
- Where must the contact appear?
- Prominently on the website or app, and in every response to a communication exercising a right, per Rule 9.
Read next
The DPDP brief
One email a month. What moved in the Act, and what our scans found.
Every claim cited to its section, the same way these pages are. No product news, no roundups of other people’s blogs.