Section 13 — Right of Grievance Redressal

Section 13 gives every Data Principal the right to readily available means of grievance redressal from a Data Fiduciary or Consent Manager, over any act or omission concerning that Fiduciary's or Consent Manager's obligations toward her personal data, or her exercise of rights under the Act. It's a right pointed inward at the organisation first, before anything reaches the regulator.

"Readily available," not buried — 13(1)

The right is to a mechanism that's actually readily available — the same functional standard Section 8(10) sets for the Fiduciary's own obligation to establish an effective grievance mechanism in the first place. A form that technically exists somewhere on a website, but that nobody actually monitors or resolves anything through, satisfies neither section. A dedicated statutory grievance channel is also a different thing from general customer support — the two shouldn't be mixed together in a way that lets ordinary support-ticket handling substitute for a defined, tracked grievance-redressal process.

A response window the Fiduciary sets, capped by the Rules — 13(2)

The Data Fiduciary or Consent Manager must respond to a grievance within such period as may be prescribed. Rule 14(3) fills that in: every Data Fiduciary and Consent Manager must prominently publish, on its website or app, its own grievance-redressal response period — one that cannot exceed ninety days — and must implement the technical and organisational measures needed to actually respond within it. That ninety-day figure is a ceiling on how long a Fiduciary's published response window is allowed to be, not a separate service-level promise attached to any other specific right; it's the outer limit Rule 14(3) sets for this section's own response duty.

Exhaustion before the Board — 13(3)

A Data Principal must exhaust the opportunity to redress her grievance under this section before approaching the Data Protection Board. Practically, that means an organisation's grievance channel functions as a statutory filter: closing grievances without a reasoned response, or auto-closing them after a fixed number of days with no substantive answer, undermines exactly the mechanism this exhaustion requirement depends on working properly. A grievance system that resolves complaints on the merits is what keeps the organisation off the Board's docket in the first place; a weak one makes escalation close to inevitable.

What escalation to the Board actually gets someone

It's worth being precise about what happens after exhaustion, because the Act's own remedy is narrower than it might sound. The Board's power under Section 33 is to impose a monetary penalty, credited to the Consolidated Fund of India — not to award compensation to the complainant. Section 39 separately bars civil courts from entertaining any matter within the Board's jurisdiction under the Act. A Data Principal seeking personal damages, rather than a penalty against the organisation, is relying on whatever other law Section 38 preserves for her outside the DPDP Act itself — that route sits alongside the Act's machinery, not inside it.

Why this matters in practice

Because exhaustion is mandatory, the quality of an organisation's own grievance process directly determines how often it ends up in front of the Board at all. A response that's reasoned, timely and actually resolves the underlying issue closes the loop; a dismissive or delayed one all but guarantees the complaint moves on to regulatory scrutiny.

Illustration: a Data Principal emails a company asking why her correction request under Section 12 hasn't been actioned after several weeks. If the company has no defined grievance channel and simply doesn't reply, it has failed its own Section 8(10) and Section 13 obligations — and because there's no functioning internal mechanism for her to exhaust, she has a stronger, more immediate basis to escalate straight to the Board.

How Section 13 connects to the rest of the Act

Section 8(10) is where the Fiduciary's duty to build this mechanism actually originates; Section 13 is the Data Principal's corresponding right to use it. Rule 14(3) supplies the ninety-day outer cap on response time. Sections 11 and 12 are the rights most likely to generate the grievances this section governs, and Sections 33, 38 and 39 together define what happens — and what doesn't — once a matter actually reaches the Board.