Section 13 — Right of grievance redressal

What this section requires

A Data Principal has the right to readily available grievance redressal from a Data Fiduciary or Consent Manager for anything they did or failed to do regarding her personal data or her rights under the Act.

The Data Fiduciary or Consent Manager must respond within a prescribed period. The Data Principal must exhaust this internal channel before she can escalate to the Board.

Who it applies to

Every Data Fiduciary and Consent Manager — this is the mandatory first stop for any Data Principal complaint, ahead of the Board.

Checklist

• Make a grievance channel genuinely reachable — "readily available" is the statutory standard, not just technically present somewhere in a privacy policy.
• Respond within the period Rule 14 prescribes once in force.
• Expect complaints to the Board to be rejected or deferred if the Data Principal hasn't used your grievance channel first — build your process assuming it's the actual first line, not decorative.

Penalty exposure

No Schedule item names Section 13. An ineffective or unresponsive grievance mechanism falls under the residual item 7 — up to ₹50 crore.

Implementation timeline

Not yet in force. Commences 13 May 2027, eighteen months after the DPDP Rules, 2025 were published (13 November 2025) — per the commencement notification G.S.R. 843(E).