The Grievance Redressal Officer requirement: what every app's help section must have

At a glance

Under India’s DPDP Act, every business that handles personal data must give people a way to raise and resolve complaints about how their data is handled — a published point of contact and a working grievance-redressal route, with a response within the period you publish. It isn’t only for large companies: a named, reachable grievance contact in your app or site’s help or contact section is a baseline duty. Ignoring a grievance, or hiding the contact, is itself a failure.

Educational resource only. This explains the grievance-redressal and published-contact requirement under India’s Digital Personal Data Protection Act, 2023 (DPDP Act); it is not formal legal advice.

The situation

When someone wants their data corrected or deleted — or is unhappy about how you handled it — they need somewhere to go. The DPDP Act makes that route a requirement, not a courtesy. And it’s also the first step a person must take before they can escalate to the regulator, which makes your grievance channel part of the wider enforcement system.

What the law actually requires

Two linked duties: publish a contact, and run a mechanism that actually resolves grievances. The Act requires a Data Fiduciary to publish the business contact details of a Data Protection Officer (where one applies) or another person able to answer questions about its processing, and to provide an effective grievance-redressal mechanism (Section 8). For a Significant Data Fiduciary the contact is a formal DPO; for everyone else it’s a named, reachable person — but the grievance route itself is required of all.

The bar isn’t “have an email address somewhere.” It’s a route a person can find and use, and that leads to a real response.

Where the contact has to live

Published means findable — in the places a user would actually look. In practice that’s your app’s or website’s help, contact, or privacy section, and your privacy notice. A grievance contact buried where no one can find it doesn’t meet the spirit (or the point) of “published.” For an app, the help/settings section is the natural home; for a site, the footer, contact page, and privacy notice. The test: could an ordinary user locate how to complain in a few seconds?

The response clock

You must respond within the timeframe you publish — and the person can escalate if you don’t. The Rules require you to state, and stick to, a period within which you’ll address grievances. Two consequences follow: publish a realistic response window and meet it; and remember that a person who is ignored, or not answered within that window, has grounds to escalate to the Data Protection Board of India. So the grievance route isn’t a formality — a slow or dead channel is exactly what turns a manageable complaint into a regulator matter.

What to put in place

A findable contact, a real process behind it, and a stated response time. Concretely:

1. Name a contact for data grievances (a person or role), and publish their business contact details.
2. Put it where users look — help/contact/privacy sections and your privacy notice.
3. State a response window and make it realistic.
4. Build the process behind it — how a grievance is logged, actioned, and closed, so it doesn’t sit unanswered.
5. Track and close grievances — a record that you responded is your evidence you met the duty.

FAQ