Grievance redressal under the Digital Personal Data Protection Act, 2023
India's Digital Personal Data Protection Act, 2023 (DPDP Act) gives every person — referred to in the Act as a "Data Principal" — a formal right to complain when an organisation holding their personal data mishandles it. Section 13 of the Act sets out this right, and it works alongside the day-to-day civic grievance process this portal exists to support: both are built on the same idea, that a complaint needs a clear channel, a reasonable deadline, and somewhere to escalate if the first attempt at resolution doesn't work.
The two-step process the Act sets up
The DPDP Act does not send every complaint straight to a regulator. Instead, it asks a person to raise the issue directly with the organisation involved first — called a "Data Fiduciary" in the Act — giving that organisation a fair chance to fix the problem before anyone escalates further.
Step 2 — Escalate to the Board. If the organisation doesn't respond in time, or its response doesn't resolve the complaint, the matter can be taken to the Data Protection Board of India — an independent body created by the Act to hear these cases.
What the Data Protection Board of India does
The Board is the adjudicating authority under the Act. Once a complaint reaches it, the Board can call for records, question the organisation involved, and issue binding directions — anything from ordering a correction of data to imposing a financial penalty for serious or repeated non-compliance. Its role is comparable to an ombudsman: independent of the organisations it oversees, and focused on resolving disputes citizens couldn't get settled on their own.
Why this matters for a grievance portal
A civic grievance portal like this one collects and stores personal details — names, contact information, locations, and sometimes photographs — in order to route and resolve complaints about public services. That makes the portal itself a Data Fiduciary under the DPDP Act for the information citizens submit here. In practice, that means:
Clear timelines. Citizens should know roughly how long a response will take, and be told if it's delayed.
A way to escalate. If a complaint about how this portal itself handles someone's data isn't resolved satisfactorily, that person retains the right to take the matter to the Data Protection Board of India.
This is a separate track from the day-to-day civic grievances the portal handles — a pothole report or a water supply complaint doesn't involve the Board. The DPDP Act framework applies specifically to how personal data submitted through the portal is collected, used, and protected.
In short
The DPDP Act builds a simple ladder: raise the issue, give the organisation a real chance to fix it, and escalate to an independent Board if that doesn't happen. It's the same principle this portal applies to civic complaints — direct, department-level resolution first, with a clear path forward when that isn't enough.