DPDP grievance redressal: the ninety day ceiling

Grievance handling is where individual rights and company operations meet, and the framework gives it a hard ceiling.

The right, and the sequence

Section 13 gives the Data Principal a right to readily available means of grievance redressal from the Data Fiduciary or Consent Manager, covering any act or omission about its data obligations or the exercise of rights. And it fixes the sequence:

"The Data Principal shall exhaust the opportunity of redressing her grievance under this section before approaching the Board."

For organisations this cuts both ways. Your grievance channel is the mandatory first stop, which means its quality determines whether disputes escalate. A channel that stalls is an invitation to the Board.

The ninety day ceiling

Rule 14 requires the response period to be published and caps it: a reasonable period not exceeding ninety days, backed by technical and organisational measures that make the system effective within it. Publishing ninety days and treating it as a target is the floor; publishing something shorter you can actually meet reads better to users and reviewers alike. One drafting note for the careful reader: the printed sub rule has words evidently dropped in the Gazette, and the corrigendum on file does not touch it; the ninety day ceiling itself is verbatim.

What to build

A named intake channel, an owner, a clock that starts on receipt, and templates for the common cases. Individuals exercising rights get pointed here when requests fail, so the grievance system is effectively the appeals layer of your whole rights machinery.

What to do

Individuals: the rights assistant walks the sequence. Organisations: the grievance system is an action in the company plan, with the official texts at Section 13 and Rule 14.