Section 13

Section 13 establishes the grievance redressal architecture for Data Principal complaints — the escalation ladder from Data Fiduciary to Board. The first tier is the Data Fiduciary's own internal mechanism: every Data Fiduciary and Consent Manager must provide a readily available, effective grievance mechanism for Data Principals to raise concerns about any violation of the Act or their rights. The DPDP Rules will specify what makes a mechanism adequate — expected to include: a designated contact point, prescribed response timelines (likely aligned with consumer protection standards), and records of grievances and resolutions. This internal mechanism must be 'readily available' — not buried in fine print, not requiring elaborate procedures to access, and genuinely effective at resolving complaints rather than being a formal compliance box-tick. The second tier is the Data Protection Board: if the Data Principal is dissatisfied with the Data Fiduciary's response, they can escalate to the Board under Section 13(3). The Board then has jurisdiction to investigate and impose penalties under Sections 27–33. The escalation model — internal → Board → High Court — mirrors the tiered dispute resolution used in consumer protection (internal complaint → Consumer Forum → NCDRC) and financial services (internal redressal → Ombudsman → Tribunal). For Consent Managers, the grievance mechanism is particularly important because they are the interface between Data Principals and multiple Data Fiduciaries — a complaint about consent withdrawal or management will often first hit the Consent Manager rather than the underlying Data Fiduciary.