Loopholes in the law
HR ka sabse pyara jawab: dekh rahe hain
- How long do you have to resolve a data grievance?
- Rule 14(3) sets a hard ceiling of 90 days to fully resolve a personal data grievance, not merely to acknowledge that it exists. We are looking into it is not a valid holding pattern, and the clock starts when the ticket does.
- Who this affects
- Every Data Fiduciary operating a grievance channel.
- What to do about it
- Measure resolution rather than acknowledgement, and start the clock from the moment the complaint arrives.
Surya filed the complaint on a Tuesday.
His company's HR software had synced his PAN card to the wrong employee ID. Someone else's account now showed his salary slips, and he could see theirs. He raised it through the grievance portal, got an automatic reply with a ticket number, and closed his laptop feeling like it was handled.
Ninety days later, nothing had changed. Same mismatched records. Same silence from HR, apart from one email: "We're looking into it."
"Looking into it" is not a holding pattern
Here is what Surya did not know, and what most employees, and a lot of companies, still get wrong. Under India's DPDP framework, "we're looking into it" is not a valid holding pattern forever. Rule 14(3) sets a hard ceiling of 90 days to fully resolve a personal data grievance, not merely to acknowledge that it exists.
Think of it less like a suggestion box and more like a parking meter. The moment your ticket goes in, a timer starts, and it counts down whether or not anyone at the company is actually watching it.
Why the number exists at all
That number, 90, is not arbitrary. It exists because "we're working on it" used to be how grievances quietly died of neglect. No deadline meant no accountability. The DPDP Rules close that loophole. Publish the redressal channel prominently, and actually close the loop within three months, or answer for it.
The twist before you quote this to HR
Surya's story has one twist worth knowing before you quote this rule to your own HR team. This provision sits in the third and final phase of the DPDP rollout, which only becomes fully enforceable from 13 May 2027. Right now, in mid 2026, it is the direction the law is heading, not yet a stick the Data Protection Board can swing at a company that misses the mark.
So today, Surya's real leverage is not a regulator. It is simpler than that. The law is coming, and any organisation that builds the 90 day habit now will not be scrambling to invent it under pressure in 2027.
The lesson for anyone building or running a grievance system: do not wait for the deadline to become law before you start acting like it already is. Ninety days from complaint to resolution is not red tape. It is the difference between a portal that actually protects people, and one that just quietly collects tickets.
Is your organisation's grievance process built to a clock, or just built to look responsive?
