When something goes wrong with how your data was handled, the Act gives you a specific, two-step path to raise it.
THE ESCALATION PATH
STEP ONE
Complain to the organisation
Every Data Fiduciary and Consent Manager must provide a readily available way to register a grievance.
STEP TWO
Escalate to the Board
If the response is unsatisfactory or absent, you can take it to the Data Protection Board of India directly.
NO COST
No lawyer, no fee required
The escalation route is designed to be usable without hiring legal representation.
For organisations, this means a grievance mechanism isn’t a nice-to-have contact form — it’s a specific published channel with a defined response process, because the alternative to a good internal response is the complaint going straight to a regulator.
A grievance ignored internally doesn’t stay internal for long — it escalates to the Board, without needing a lawyer to get there.
SOURCES The DPDP Act, 2023 — official text, MeitY — https://www.meity.gov.in/static/uploads/2024/06/2bf1f0e9f04e6fb4f8fef35e82c42aa5.pdf