Section 13 — DPDP Act, 2023
(1) Every Data Fiduciary shall establish an effective mechanism to redress the grievances of Data Principals. (2) A Data Principal who has a grievance in respect of any action or inaction of a Data Fiduciary or a Consent Manager in relation to her personal data or the exercise of her rights under the provisions of this Act, may make a complaint— (a) first, to the Data Fiduciary or Consent Manager, as the case may be; and (b) if the complaint is not redressed to her satisfaction, to the Board.
Source: Digital Personal Data Protection Act, 2023. Official text available at truconsent.io/resources/dpdp-act.pdf.
Section 13 creates a mandatory first-stop for Data Principals with grievances: they must go to the Data Fiduciary's own grievance mechanism before approaching the Data Protection Board. The Board is not the first stop — the Data Fiduciary's internal mechanism is. This means every Data Fiduciary must have a functioning, responsive grievance redressal system in place. A grievance that is not resolved or is not acknowledged within the prescribed period becomes an automatic gateway to a Board complaint.
The grievance mechanism must be accessible (not buried in a footer that requires five clicks to find), responsive (acknowledging receipt within a defined period and resolving within the prescribed timeline under Rule 14), and staffed (someone must actually review and respond). A generic 'contact us' form that gets no response fails Section 13(1).
A Data Principal requests erasure. The Data Fiduciary does not respond within the prescribed period under Rule 14. The Data Principal files a complaint with the Board under Section 13(2)(b). The Board can investigate and impose penalties under Section 33. The Data Fiduciary's failure to operate a functioning internal mechanism is itself a Section 13 violation.