Grievance Officer Under the DPDP Act: Role and Drafting

A customer emails asking your company to delete her account and everything attached to it. The email lands in the same support queue as delivery complaints, gets tagged "other", and is answered six weeks later with a request for a screenshot. Under the Digital Personal Data Protection Act, 2023, that sequence is not simply poor service. It is a compliance failure with a named officer attached to it. Grievance officer DPDP India requirements are specific about that name being published where the customer can find it.

The grievance officer is the human hinge on which the DPDP Act's redressal machinery turns. The Act does not treat grievance redressal as a courtesy extended by the support team. It treats it as a statutory obligation owed by the data fiduciary, with a designated person accountable for receiving, tracking and answering requests about personal data. Most Indian companies that have updated their privacy policy since 2023 have added a line naming someone as grievance officer. Far fewer have drafted the role properly, given that person the authority to act, or built the records that would prove the mechanism works when the Data Protection Board asks.

What the DPDP Act requires of a data fiduciary

Section 13 of the DPDP Act, 2023 sets out the obligations that sit behind the title. A data fiduciary must publish the business contact information of a Data Protection Officer, where one is required, or of a person who is able to answer questions about the processing of personal data on its behalf. It must put in place an accessible grievance redressal mechanism. And where a data principal makes a complaint, the fiduciary must give the complainant an opportunity to be heard and respond within the period prescribed by the Rules.

Two distinct roles are often collapsed into one in Indian privacy policies, and the Act keeps them separate. The Data Protection Officer is a statutory appointment for significant data fiduciaries under Section 10 — someone based in India who reports to the board of directors and is the point of contact for the Board itself. The grievance officer is the wider, lower-threshold function that every data fiduciary needs: a named, reachable person who receives and resolves complaints from data principals. A small SaaS company with no significant data fiduciary designation still needs the second. It does not need the first.

The Act's enforcement architecture matters here. The Data Protection Board of India does not begin by auditing your servers. It typically begins with a complaint from a data principal who could not get an answer. If your published grievance route bounces, or if the officer answers without any record of the complaint, the Board's first impression is formed by that failure. The grievance officer function is therefore the most visible compliance surface a company has, and the cheapest to get right.

Grievance officer DPDP India: who should be named

The Act does not prescribe a job title, a qualification or a minimum seniority for the grievance officer. It prescribes an outcome: the person must be able to answer questions about processing and must be reachable. That flexibility is useful, but it also means the choice is a judgement call that gets scrutinised after something goes wrong.

Seniority and authority

A support executive with no power to approve a deletion request is a poor appointment, because every complaint becomes a referral upward and the statutory clock runs while it waits. The practical test is whether the person can say yes. If the grievance officer cannot authorise erasure, correction, access or a withdrawal of consent without seeking three approvals, the mechanism is decorative. Most defensible appointments sit at a level where the officer can direct engineering, product and support teams to act, and can escalate to the board when a request raises a legal risk.

Independence and reporting line

Where the same person owns both revenue targets and data complaints, there is an obvious conflict. The Act requires a significant data fiduciary's DPO to report to the board, which signals the expected posture. For a grievance officer, the drafting should at least place the role outside the marketing or sales reporting line, or give the officer a direct escalation route to the board or audit committee that cannot be blocked by a business head. Record that reporting line in the appointment document, not only in an org chart.

Location and accessibility

The Act does not require the grievance officer to be resident in India the way Section 10 requires the DPO to be based in India. What it does require is that the contact information published is business contact information and that the mechanism is accessible. A generic toll-free number that routes to a queue in another country, with no named person and no email, is not accessible in the sense the Act intends. Publish a named individual, a working email address, and a postal address, and keep them current when the person changes roles.

The duties that belong in the role description

A grievance officer appointment that says only "shall handle data grievances" gives the person nothing to work with and gives the company nothing to defend. The role description should name the concrete functions the Act and the Rules assume:

• Receiving and acknowledging requests from data principals, including access, correction, completion, erasure, withdrawal of consent, and nomination.
• Verifying the identity of the requester before acting, without collecting more personal data than necessary for verification.
• Coordinating with product, engineering and support teams to fulfil a request within the statutory period.
• Recording each request, the date received, the action taken, the date closed and the reason for any refusal.
• Explaining a refusal to the data principal in writing, with the ground for refusal and the route to complain to the Data Protection Board.
• Acting as the interface with the Data Protection Board on complaints and information requests.
• Reporting periodically to the board or management on complaint volumes, themes and recurring failures.

The acknowledgement duty is the one most often missed in Indian practice. A data principal who receives no acknowledgement within days assumes the request was ignored, and that assumption is what converts an internal ticket into a Board complaint. An automated acknowledgement that carries a ticket number and an expected response date costs almost nothing and removes most of that risk.

Drafting the appointment: which document does what

Companies routinely put the grievance officer's name in the privacy policy and nowhere else. That is the wrong instrument for the obligation. Three documents carry different parts of the arrangement, and confusing them is a common drafting error.

Where the company has a group structure, the appointment should also say which entity the officer serves. A grievance officer named in a parent company's privacy policy who has no employment relationship with the Indian subsidiary creates an accountability gap: the subsidiary is the data fiduciary, but the officer answers to someone else. Name the officer for each fiduciary entity, or record an explicit group arrangement with delegated authority.

Timelines, escalation and record-keeping

The Act leaves the response period to the Rules rather than fixing it on the face of the statute. In practice, Indian privacy notices typically commit to acknowledging a request within a few days and resolving it within thirty days, and that thirty-day figure has become the de facto benchmark against which complainants measure delay. Whatever period you adopt, draft it as an outer limit with an internal target well inside it. A published promise of thirty days that is met on day twenty-nine reads as compliance; the same promise breached on day forty reads as contempt.

Build the escalation into the document. The sequence that works is: automated acknowledgement, triage within two working days, substantive response within the internal target, written refusal with reasons where the request cannot be granted, and a final note telling the data principal that they may complain to the Data Protection Board. That last sentence is not optional in spirit. A refusal that does not disclose the appeal route invites the complainant to go straight to the regulator without giving the company a chance to correct its own error.

Record-keeping deserves more attention than it gets. Keep a grievance register that captures the date of receipt, the nature of the request, the identity verification step, the action taken, the date of response, and any refusal ground. Retain it for a period longer than your general support ticket retention, because a Board inquiry may arrive months after the complaint closed. The register is also the raw material for the periodic report to the board, which is where systemic problems — a product feature that makes erasure impossible, a vendor that never responds — become visible before they become a pattern of complaints.

Common drafting mistakes

• Naming a role, not a person. "The Grievance Officer" with no name and a generic inbox gives the data principal nobody to hold accountable and gives the Board nothing to test.
• Publishing a dead address. Privacy policies are updated annually; the officer changes quarterly. A bounced email to the published address is the single most damaging fact in a complaint file.
• No delegation clause. When the officer is on leave, requests sit unanswered. The appointment should name a deputy or provide for automatic delegation.
• Conflating the DPO and the grievance officer. A significant data fiduciary needs both functions, and the DPO's board reporting line is a statutory feature that a grievance officer appointment does not replicate.
• No refusal template. Officers improvise refusals by email, often without stating a ground. The Act expects reasons, and an unexplained refusal is the easiest complaint to sustain.
• Ignoring processor requests. Where a vendor receives an erasure request directly, the contract is usually silent on how fast it must be passed on. Add the obligation and a fixed number of days.
• No link to the consent withdrawal flow. Withdrawal of consent is a separate right with its own operational path; the grievance officer should not be the only way to exercise it.

Each of these is cheap to fix at the drafting stage and expensive to fix after a complaint. The pattern across all of them is the same: the company has treated the obligation as a disclosure to be published rather than a process to be operated.

Frequently asked questions

Is a grievance officer mandatory for every company that processes personal data?

Yes, in substance. Section 13 requires every data fiduciary to publish contact information for a person able to answer questions about processing and to provide a grievance redressal mechanism. That obligation applies regardless of size. What changes with scale is the formality expected: a ten-person startup can name its founder and publish a working email, but it still needs an acknowledgement process and a log.

Can the grievance officer be based outside India?

The Act's India-residency requirement is attached to the Data Protection Officer of a significant data fiduciary, not to the grievance officer function generally. A company may appoint an officer abroad if the person can genuinely answer questions about the processing and the published contact route works. In practice, regulators and complainants both prefer a locally reachable contact, and an overseas appointment should come with a clear local escalation point.

What happens if we do not respond within the period?

The data principal can complain to the Data Protection Board, and the Board can inquire into the fiduciary's practices. The exposure is not limited to the individual complaint: a pattern of unanswered requests is evidence about the design of the mechanism, which is exactly what the Board is empowered to examine. Penalties under the Act are structured by category of breach, and the schedule should be checked against the current text rather than assumed.

Does the grievance officer handle employee data complaints too?

The Act applies to personal data processed digitally, and employment-related processing is within its scope subject to the exemptions notified for certain purposes. A company that employs people in India should treat employee grievances about data — access to personnel files, correction of records, deletion of biometric attendance data — as within the same mechanism. Naming the HR head as an additional contact for employee requests is a workable structure.

Can we outsource the grievance officer role to a law firm or vendor?

You can appoint an external person, but the accountability stays with the data fiduciary. The appointment document should make the external officer's authority explicit, require confidentiality, require access to internal systems needed to resolve requests, and set reporting obligations to the board. An outsourced inbox that only forwards emails to the company does not discharge the function, because nobody is actually deciding.

How often should the published details be reviewed?

At least annually, and immediately on any change of incumbent. The review should test the route end to end — send a test request to the published address and see whether it is acknowledged within the promised window. That single test catches the failure that matters most, which is a published contact that no longer reaches anyone.

Drafting Support

Our drafting team prepares grievance officer appointment letters, board resolutions, privacy notice clauses and internal grievance SOPs aligned to the DPDP Act, 2023 and the Rules notified under it, tailored to how your company actually handles data requests.