The Role, Obligations, and Liability of Grievance Officers Under India’s DPDP Act and DPDP Rules, 2025

The enforcement of the Digital Personal Data Protection Act, 2023 (“DPDP Act”) together with the DPDP Rules, 2025 has fundamentally altered India’s data governance landscape. The new regime is rights-driven and accountability-centric, placing clear duties on organisations and enforceable rights in the hands of data principals.

A key feature of this framework is the requirement for every Data Fiduciary to appoint a Grievance Officer (“GO”), who acts as the statutory point of contact for individuals seeking redressal or exercise of their rights. With organisational penalties now reaching up to INR 250 crores, the Grievance Officer’s role is no longer procedural but mission-critical.

Statutory Basis Under the DPDP Act

Sections of the DPDP Act require Data Fiduciaries to:

• Publish the contact details of the Grievance Officer;
• Facilitate the filing of grievances;
• Ensure timely resolution of complaints and data principal requests; and
• Maintain a transparent redressal workflow.

The GO may be any competent person within the organisation commonly from the legal, compliance, privacy, or information security functions.

DPDP Rules, 2025 – Procedural Duties and Timelines

The DPDP Rules expand the Grievance Officer’s responsibilities and lay down mandatory timelines and workflows. The key requirements include:

a. Acknowledgment Requirements

Under Rule 4 and Rule 7 of the DPDP Rules, 2025:

• All data principal grievances must be acknowledged promptly (usually within 24–72 hours, depending on the category of complaint or organisational process).
• The acknowledgment must include a tracking number, point of contact, and expected resolution window.

b. Timeline for Rights Fulfilment

Rules governing rights fulfillment impose strict timelines for:

• Access requests
• Correction and updating of personal data
• Deletion requests
• Withdrawal of consent
• Filing grievances

Most requests must be resolved within 7 working days, unless an extension is justified under a documented exception. Denials must include the specific legal basis under the DPDP Act.

c. Escalation and Appeal Workflow

The Rules require that:

• If a data principal is dissatisfied with the GO’s response, they must have access to an internal appeal mechanism.
• If unresolved, the matter may escalate to the Data Protection Board of India (DPB).
• The GO must maintain the entire audit trail for potential regulatory review.

d. Documentation and Record-Keeping

Rule 6 and Rule 12 emphasise that the GO must maintain logs of:

• Grievances received;
• Dates of acknowledgment and closure;
• Internal communications with IT, HR, Operations, or Security;
• Grounds for approval or refusal of requests;
• Breach notifications and actions taken.

These records must be retained for the periods prescribed under the Rules and produced to the Board when required.

e. Cooperation With the Data Protection Board

The GO must support the Data Fiduciary in regulatory interactions by:

• Producing records;
• Explaining the grievance-handling workflow;
• Demonstrating adherence to statutory timelines;
• Assisting in breach inquiries under Rule 10.
• Failure to cooperate may aggravate the organisation’s liability.

Liability Exposure for Grievance Officers

The DPDP Act is structured to impose penalties primarily on the Data Fiduciary, not on individual employees. However, certain risks remain for the GO.

a. Organisational / Internal Liability

The organisation may hold the GO accountable for:

• Delay in processing rights requests;
• Mishandling or ignoring grievances;
• Failure to escalate severe issues such as data breaches;
• Breakdown in documentation or communication.

Internal disciplinary action may follow even where statutory penalties apply only to the organisation.

b. Exceptional Personal Liability

While the Act does not impose automatic personal penalties, the GO may face personal exposure if they:

• Act in bad faith or with malicious intent;
• Knowingly violate the Act or Rules;
• Suppress or conceal a breach;
• Facilitate unlawful processing.

In such cases, general Indian legal principles (e.g., under employment, tort, or criminal law) could apply.

c. Reputational Consequences

The GO may be identified in internal reports or regulatory inquiries, creating reputational risk even without legal liability.

Safeguards for Grievance Officers: How to Protect Themselves

To mitigate exposure, GOs should ensure the following safeguards:

a. Maintain Comprehensive Documentation

Every step must be recorded, including:

• Time stamps;
• Actions taken;
• Internal follow-ups;
• Final decisions;
• Legal reviews obtained.

This documentation is the GO’s strongest defence.

b. Use Escalations Appropriately

The GO should escalate issues that involve:

• Sensitive personal data;
• Cross-border transfers;
• Children’s data;
• Breach indicators;
• Requests requiring legal interpretation.

c. Avoid Independent Legal Interpretation

The GO must not independently:

• Deny rights requests;
• Provide legal justifications;
• Classify data as exempt under statutory exceptions.
• All such decisions must be validated by Legal/Compliance.

d. Follow Approved SOPs and Rule-Based Workflows

Organisations must establish formal SOPs covering:

• Response timelines;
• Verification processes;
• Templates for responses;
• Escalation matrices;
• Breach-handling steps under Rule 10.

A GO acting within an approved SOP is shielded from personal blame.

e. Formal Written Appointment and Role Clarity

A written appointment should define:

• Duties;
• Authority;
• Liability limitations;
• Support structure;
• KPIs and escalation triggers.
• This protects the GO from informal or undefined expectations.

f. Mandatory Training and Capacity Building

Under the Rules, organisations must enable the GO to:

• Understand data flows;
• Use internal systems;
• Interpret timelines;
• Carry out cross-functional coordination.

Conclusion

With the DPDP Act and Rules now operational, the Grievance Officer plays a pivotal role in demonstrating an organisation’s commitment to data protection and accountability. While the legal exposure for the GO is limited under the statute, the operational risks and regulatory expectations make it essential for organisations to empower the role with adequate authority, resources, training, and clear SOPs.

For businesses, a well-supported Grievance Officer is not merely a compliance requirement but a frontline safeguard against regulatory penalties, reputational damage, and operational disruption.

For individuals stepping into the role, adherence to the DPDP Rules, disciplined documentation, timely action, and proactive escalation will ensure strong personal protection in an increasingly regulated landscape.