How-To · Data Protection · Last verified October 2026

How to Make a Data Protection Grievance Complaint (2026)

Updated for 2026 · Claw Editorial

Your personal data has value and the law now treats it that way. If a company shares your data without consent, keeps it after you asked it to stop, ignores a request to correct or delete it, or simply will not answer, you have a complaint path under the Digital Personal Data Protection Act, 2023. The key is to follow it in order, because you must give the company a chance to fix things before the regulator will step in. This guide, for individuals, sets out the steps, from the company's own grievance channel to the Data Protection Board and an appeal beyond it, and what your complaint should contain. It is general information, not legal advice. Last verified October 2026.

01The short answer

You make a data grievance complaint in a fixed order under the DPDP Act, 2023:

• Exercise your right first with the company: a written request to access, correct, erase, or to withdraw consent.
• Use the company grievance channel if that is ignored or refused. Every Data Fiduciary must publish a grievance contact, and Section 13 gives you the right to grievance redressal with them.
• Escalate to the Data Protection Board of India if the company still does not resolve it.
• Appeal to the Appellate Tribunal within 60 days if you disagree with the Board's order.

The order matters. You normally cannot go straight to the Board; you must first give the company a real chance to fix the problem, and keep a dated record of having done so.

02Your right to complain

The Act gives every Data Principal, the person whose data it is, a set of rights, and a complaint is how you enforce them:

• Access (Section 11): to know what personal data the company holds and how it has used it.
• Correction and erasure (Section 12): to have your data corrected, completed, updated or deleted.
• Grievance redressal (Section 13): to a working complaint channel with the company.
• Nomination (Section 14): to name someone to exercise your rights if you die or cannot act.

A grievance usually arises when one of these is ignored: you asked to delete your data and the company kept it, or you asked what they hold and got no answer. The right of grievance redressal is the foundation of the complaint, so frame your complaint around the specific right that was denied.

03Step 1: the company grievance channel

You must take the grievance to the Data Fiduciary first. Every business must publish the contact details of a person who answers data questions, and a Significant Data Fiduciary must have a Data Protection Officer. Write to that contact, or use its grievance channel, and set out plainly what you want and by when.

The company must respond within the time set by the rules. Keep everything: the dated request, the acknowledgement, and the reply or the silence. This record is essential, because the Board will expect to see that you gave the company a genuine opportunity to resolve the grievance before you escalated.

04Step 2: the Data Protection Board

If the company does not resolve the grievance, you escalate to the Data Protection Board of India, the regulator set up under the Act (its powers and procedure are in Chapter VI, Sections 27 to 28). The Board inquires into breaches of the Act and can direct remedial steps and impose penalties on a company that has broken its obligations.

The Board is designed to work digitally, so a complaint is expected to be filed online through the process the rules provide. It is not a court and does not award you personal compensation in the way a civil court does; its role is to enforce the Act and penalise breaches.

05Step 3: appeal to the Appellate Tribunal

If you are not satisfied with the Board's order, the Act gives a right of appeal. Under Section 29, a person aggrieved by an order of the Board may appeal to the Appellate Tribunal, which is the Telecom Disputes Settlement and Appellate Tribunal (TDSAT), within 60 days of receiving the order. A late appeal can be allowed if you show sufficient cause.

From the Tribunal, the ordinary route of a further appeal to the higher courts follows. For most individual grievances, though, the matter is resolved well before this stage, at the company or the Board.

06What your complaint should contain

Whether you write to the company or escalate to the Board, a clear complaint is a strong one. Include:

• Who you are and that you are the Data Principal whose data is involved.
• Who the company is and your relationship with it, for example a customer or user.
• The exact problem: the right denied or the misuse, with dates.
• What you already did: the request you made and the company's reply or silence, with the record attached.
• What you want: deletion, correction, an answer, or a stop to the misuse.

Attach the dated trail. A complaint that shows you asked the company first and were ignored is far stronger than one that jumps straight to the regulator.

07Where the rules stand in 2026

The complaint path exists, but the machinery is still rolling out. The Digital Personal Data Protection Rules, 2025 were notified in November 2025, and the provisions standing up the Data Protection Board took effect then, while other obligations are coming into force in phases, with the bulk of day-to-day compliance applying over a longer transition into 2027.

So the practical position in 2026 is that your rights and the grievance structure are in place, while the detailed forms and timelines are settling as the rules phase in. If a company mishandles your data now, the sensible move is still to exercise your right, use its grievance channel, and keep the record, so you are ready to escalate as the Board's process beds down.

08Where Claw fits

Claw is an all-in-one legaltech platform for Indian advocates, law firms, and corporate legal teams, combining AI-based case search, an AI legal assistant (Legal GPT), case management, and compliance automation across all Indian courts and tribunals.

Writing the grievance and escalating it is for you and, if needed, your adviser; Claw does not file it. Where Claw helps is research and in tracking a matter once it reaches the regulator or a court. Claw tracks proceedings before the Data Protection Board and appeals to the Appellate Tribunal (TDSAT), along with related matters in the High Courts and the Supreme Court, across 9,102 courts, benches and forums, with alerts and monitoring, so an individual or an adviser sees every movement in a case. Its Legal GPT researches across 30 crore+ judgments, with Supreme Court decisions from 1950 and High Court decisions from 1990, so you can see how courts have treated related data and privacy questions. Results return in under 5 seconds, and Claw does not train its AI models on your documents. To check whether a company already has litigation on record, run a case search across Indian courts by company name. A clean result means nothing was found on the forums and date searched, not that nothing exists, and this is general information, not legal advice.

Related reading: the DPDP Act 2023 for businesses explained.

09Sources and further reading

• Ministry of Electronics and IT (DPDP Act and Rules): meity.gov.in
• India Code (Digital Personal Data Protection Act, 2023): indiacode.nic.in
• Claw: clawlaw.in

This guide is general information, not legal advice. The complaint procedure is set by rules being brought into force in phases; confirm the current process before you file.

10Frequently asked questions