Your Rights · Section 13 + Chapter VI
When a company ignores you — file a complaint with the Data Protection Board
If a Data Fiduciary refuses your access, correction, erasure, withdrawal or nomination request — or simply ignores it — you can escalate to the Data Protection Board of India. The DPB can investigate and impose penalties of up to ₹250 crore. Here is the prerequisite (Section 13 grievance), what evidence to keep, and the 5-step filing process.
The prerequisite
Section 13 — exhaust the grievance route first
Section 13(1) of the DPDP Act says you must first approach the Data Fiduciary’s Grievance Officer with a “readily available means of grievance redressal”. That means: send your request, give them time, and try once more if they go quiet. Only after that can you move to the Data Protection Board.
This is also the part where most complaints fail — the DPB will ask for proof you exhausted Section 13. So even before you file, keep your original request, any reply, and a screenshot of any ongoing violation (e.g. marketing emails that kept coming after you withdrew consent). That evidence pack is what makes the complaint stick.
The 5-step escalation
From silent inbox to DPB filing
Step 1
Exhaust Section 13
Original request + a clear reminder to the Grievance Officer. Give 30 days. Cc yourself both times.
Step 2
Build the evidence pack
Request emails, replies (or silence), screenshots, privacy policy snapshot, dates. PDFs work best.
Step 3
Map to a Section
Be specific. “Failed to action my Section 12(3) erasure request within 30 days” is much stronger than “they ignored me”.
Step 4
File with the DPB
Use the DPB’s online portal once notified. Until the portal goes live, keep your pack ready and watch dpb.gov.in.
Step 5
Follow up
Track the case ID. Answer clarifications quickly. Outcomes can include orders to comply, monetary penalties, or both.
What to put in the complaint
The 6-line core of a DPB filing
Complainant: [your full name, registered email, phone]
Respondent: [company name, registered address, Grievance Officer email]
Section(s) violated: [e.g. Section 12(3) — failure to erase on request;
Section 6(4) — failure to honour consent withdrawal;
Section 8(9) — no Grievance Officer published]
Brief facts (chronological):
1. On [date] I sent the attached [request type] to the Grievance Officer.
2. On [date] I sent the attached reminder.
3. As of [today's date] the request remains [un-actioned / refused].
Relief sought:
• An order directing the Data Fiduciary to action my request in full.
• Such monetary penalty as the Board deems fit under Schedule 1.
Evidence:
[list of attached PDFs / screenshots]
The DPB portal will likely accept this as either an upload or a guided form. The structure above keeps your complaint clean either way.
Common questions
FAQ
What is the Data Protection Board of India (DPB)?
A statutory authority created by Chapter V of the DPDP Act, 2023. It is the regulator that hears complaints from Data Principals against Data Fiduciaries, investigates DPDP violations, and can impose monetary penalties — up to ₹250 crore for the most serious defaults.
When can I complain to the DPB instead of the company?
The DPB is an escalation, not a first step. Section 13 requires that you first raise a grievance with the Data Fiduciary’s Grievance Officer and give a reasonable time to respond — usually 30 days. If they ignore you, refuse on weak grounds, or the response is plainly unsatisfactory, you can then file with the DPB.
Does filing a complaint cost anything?
No — filing a complaint with the DPB is free for the Data Principal. The DPB itself can levy penalties on the Data Fiduciary, but those go to the Consolidated Fund of India, not to you.
Will the company find out it was me?
Yes — the DPB has to put the substance of the complaint to the Data Fiduciary so they can respond. Anonymous complaints generally won’t move forward. Section 15 also asks you not to file frivolous complaints, so stick to clear, documented facts.
How long does a DPB proceeding take?
Early proceedings under the DPDP regime are likely to take a few months. The exact timeline depends on the complexity of the matter and the DPB’s caseload — but the process itself is designed to be online, document-driven and free.
Can I also go to consumer court or the police?
Yes, in parallel where appropriate. The DPDP route is the right one for data-handling violations (no notice, ignored access/erasure, breach). Consumer fora handle service disputes. Police / cyber-crime cells handle illegal access, doxxing, blackmail and the like.
Related