Short answer: From 13 May 2027, every app must publish a contact person for data questions, run an effective grievance redressal mechanism and answer grievances within a published period of no more than 90 days (s.8(9), s.8(10), Rule 14(3)). Users must use this route before they can complain to the Data Protection Board (s.13).
What is grievance redressal under the DPDP Act?
Grievance redressal under the DPDP Act is the readily available means an app must provide for users to raise complaints about how their personal data is handled, which the user must exhaust before approaching the Data Protection Board (s.8(10), s.13).
- Contact person: the Data Protection Officer, where one applies, or another person able to answer the user's questions about processing of her personal data (s.8(9)).
- Data Protection Officer (DPO): mandatory only for Significant Data Fiduciaries, where the DPO is based in India and is the grievance point of contact (s.10(2)(a)). See significant data fiduciaries.
What contact details must an app publish?
An app must publish the business contact information of its DPO, if it has one, or of a person who can answer questions about processing, prominently on its website or app, and mention it in every response to a rights request (s.8(9), Rule 9).
How long does an app have to resolve a grievance?
A reasonable period that the app publishes, capped at 90 days (Rule 14(3)). The same ceiling applies to Consent Managers.
- The Gazette wording of Rule 14(3) is grammatically incomplete, and the December 2025 corrigendum did not fix it.
- PIB's official explainer confirms the 90-day ceiling for responding to access, correction, updating or erasure requests.
- What exactly must be published under Rule 14(3) is listed as an open question in our research. The 90-day maximum is clear.
How does a grievance reach the Board?
| Step | What happens | Source |
|---|---|---|
| 1 | User raises a grievance with the app or Consent Manager | s.13 |
| 2 | App responds within its published period, no more than 90 days | Rule 14(3) |
| 3 | If unresolved, user may complain to the Board | s.13, s.27(1)(b) |
| 4 | Board inquiry, to be completed within six months of the complaint, extendable by up to three months at a time | Rule 19(9) |
| 5 | Appeal against a Board order lies to TDSAT | s.29, Rule 22 |
The user must exhaust the grievance route before approaching the Board (s.13). The Board was established on 13 November 2025 (G.S.R. 844(E)), but as of MeitY's Lok Sabha answer of 12 August 2026, only the recruitment advertisement for its Chairperson and Members had been reported, and no appointment was reported. Inquiry and penalty provisions take effect on 13 May 2027.
What must a notice say about grievances?
The notice must tell the user how to exercise her grievance rights and how to complain to the Board, and Rule 3(c) asks for the particular link in the app or website to do so (s.5(1), Rule 3). Consent requests must also give the contact details of the DPO, where applicable, or another authorised person (s.6(3)). See notice requirements.
What this means for your app
These are practical steps teams commonly consider. They are not a guarantee of compliance.
- Consider naming a privacy contact (role and email) and showing it in the app's settings, privacy notice and help centre.
- A common approach is a single in-app form that handles both rights requests and grievances, with a ticket reference sent to the user.
- Consider publishing a response period shorter than 90 days, and tracking performance against it.
- Train support teams to recognise data-related complaints that arrive through general channels such as app store reviews or chat.
- Keep records of each grievance, the response and the date, which can help if the matter later reaches the Board.
- Include the contact person's details in every response to a rights request, as Rule 9 requires.
- Link the grievance flow to the rights process and track it in the readiness checklist.