Rights and duties
How long do I have to answer a grievance?
- Short answer
- A period not exceeding ninety days from receipt. The clock starts when the grievance is received, not when you get around to triaging it, and acknowledging a complaint is not the same as resolving it.
Ninety days is an outer limit rather than a target. A complaint that sits unresolved for eighty nine days is technically within the period and is unlikely to be viewed kindly if it reaches the Board.
A Data Fiduciary must publish a means of contacting the person responsible for answering questions about processing, so the route has to be findable rather than buried.
The Data Principal must exhaust your grievance route before approaching the Data Protection Board, which makes a working internal process your first line of defence as well as an obligation.
Where this comes from
- Section 8(10) and Section 13, DPDP Act 2023
- Rule 14(3), DPDP Rules 2025
The mistake people make
Treating an automated acknowledgement as compliance. The duty is to respond to the grievance, not to confirm receipt.