DPDP grievance redressal: what Rule 14(3) says about 90 days

Grievance handling is where individual rights and company operations meet, and it is the only right in Chapter III with a number attached to it. That number is in Rule 14(3), in a sentence the Gazette printed with a piece missing. None of it is in force yet: section 13 and Rule 14 both sit in the 18 month group, computed at 13 May 2027 and interpretation until officially confirmed.

The right, and the sequence

Section 13 gives the Data Principal a right to readily available means of grievance redressal from the Data Fiduciary or Consent Manager, covering any act or omission about its data obligations or the exercise of rights. And it fixes the sequence:

"The Data Principal shall exhaust the opportunity of redressing her grievance under this section before approaching the Board."

Section 17(1) removes the whole of Chapter III, including this right, in the 6 cases it lists, so nothing here is unconditional.

For organisations this cuts both ways. Your grievance channel is the mandatory first stop, which means its quality determines whether disputes escalate. A channel that stalls is an invitation to the Board.

The 90 days, and the sentence that lost its object

Rule 14(3) is the only place a period appears in this area, and the sentence that carries it lost its object at notification. As printed it requires a fiduciary or Consent Manager to "prominently publish ... within a reasonable period not exceeding ninety days under its grievance redressal system for responding to the grievances of Data Principals", so the sentence has no object for "publish" and 2 readings are open: that the 90 days caps the response period the fiduciary must publish, or that it is a time limit on the publishing itself. This site takes the first, for 2 reasons. The second half of the same sub rule requires measures "for ensuring the effectiveness of the system in responding within such period", and the sub rule then uses "such period" for responding, which the earlier words can only supply if they are a response period. And section 40(2)(o), the rule making entry under which a period may be prescribed for section 13(2), describes it as "the period within which the Data Fiduciary shall respond to any grievances". That is this site's reading, not what the printed sentence states. Draft rule 13(3) of the January 2025 draft had the missing object, reading "publish ... the period under its grievance redressal system", which is why this site reads the dropped words as the period; that reading is ours. Corrigenda G.S.R. 892(E) correct Gazette pages 24, 29, 32, 34 and 38 only, so page 30 stands as printed and the defect has not been repaired. Because section 13(2) leaves the response period to be prescribed, a fiduciary could argue the defect leaves it unprescribed. That is an argument this site records rather than adopts, and no Board decision or judgment addressing it has been located, as at 2 September 2026. The duty to prominently publish is on the face of the sub rule and the words "not exceeding ninety days" are verbatim; what is missing is the thing to be published. Until that is corrected or construed, publishing a response period you can actually meet, and meeting it, is a recommendation this site makes rather than a requirement the printed text spells out.

Diagram headed "Rule 14(3): the sentence carrying the 90 days lost its object", with a subtitle recording that this is the only period in the rules on Data Principal rights and that the print does not say what it limits. A band across the top prints Rule 14(3) in full from Gazette issue No. 760 at page 30: every Data Fiduciary and Consent Manager shall prominently publish on its website or app, or both, as the case may be, within a reasonable period not exceeding ninety days under its grievance redressal system for responding to the grievances of Data Principals and shall, for ensuring the effectiveness of the system in responding within such period, implement appropriate technical and organisational measures. A note underneath asks publish what, and records that the object is absent, so what those words limit is not stated on the face of the text. The left panel, headed as reading A and as this site's interpretation, is that those words cap the response period the fiduciary must publish, because the same sub rule then uses such period for responding, which the earlier words can only supply if they are a response period, and it records that section 40(2)(o) points the same way, as does rule 13(3) of the superseded draft. The right panel, headed as reading B and as also open on the words, is that those words cap the publishing itself: nothing in the printed sentence rules that out, and a fiduciary could further argue that section 13(2) leaves the response period to be prescribed while the defect leaves it unprescribed, an argument this site records rather than adopts. A band across the foot, labelled not in force, records that section 13 and Rule 14 sit in the 18 month commencement group, computed at 13 May 2027 and interpretation until officially confirmed. The footer records that no Board decision or judgment addressing the missing object has been located as at 2 September 2026, and that corrigenda G.S.R. 892(E) correct Gazette pages 24, 29, 32, 34 and 38 only, so page 30 stands as printed.

What to build

A named intake channel, an owner, a clock that starts on receipt, and templates for the common cases. Individuals exercising rights get pointed here when requests fail, so the grievance system is effectively the appeals layer of your whole rights machinery.

What to do

Individuals: the rights assistant walks the sequence, and Data Principal rights under the DPDP Act sets out each right beside its section. Organisations: the grievance system is an action in the company plan, with the official texts at Section 13 and Rule 14.