# Grievance Redressal Standard Operating Procedure (SOP)
## 1. Purpose
This Standard Operating Procedure (SOP) outlines Privra's process for receiving, investigating, and resolving grievances from Data Principals concerning the processing of their personal data. This SOP ensures compliance with the Digital Personal Data Protection Act, 2023 (DPDP Act) and the Digital Personal Data Protection Rules, 2025 (DPDP Rules), specifically anchoring to **Section 13** of the DPDP Act, which mandates an effective grievance redressal mechanism. It also supports Data Principals in exercising their rights under Sections 11-14 of the Act, including rights to access, correction, and erasure of their personal data.
## 2. Scope
This SOP applies to all employees, contractors, and third-party service providers of Privra who handle personal data. It covers all grievances raised by Data Principals regarding the collection, storage, processing, disclosure, or any other aspect of their personal data managed by Privra, in accordance with the DPDP Act.
## 3. Definitions
* **Company / Privra:** The Data Fiduciary responsible for determining the purpose and means of processing personal data. * **Data Principal:** The individual to whom the personal data relates. * **Data Fiduciary:** Privra, as defined by the DPDP Act. * **Personal Data:** Any data about an individual who is identifiable by or in relation to such data. * **Grievance Officer:** The designated individual at Privra responsible for handling Data Principal grievances. * **DPDP Act:** The Digital Personal Data Protection Act, 2023. * **DPDP Rules:** The Digital Personal Data Protection Rules, 2025 (notified 14 November 2025). * **Data Protection Board of India (the Board):** The independent regulatory body established under the DPDP Act to enforce its provisions.
## 4. Roles and Responsibilities
### 4.1. Grievance Officer (John Doe)
The Grievance Officer serves as the primary point of contact for all Data Principal grievances. Their responsibilities include: * Receiving, logging, and acknowledging all grievances. * Overseeing the investigation and resolution process for each grievance. * Ensuring compliance with all prescribed timelines for acknowledgment and resolution. * Communicating the decision and resolution to the Data Principal in plain language. * Maintaining comprehensive records of all grievances and their resolutions. * Escalating unresolved grievances internally to senior management and externally to the Data Protection Board of India, as appropriate. * Ensuring Privra's contact details for data queries are published as per Section 8(9) of the DPDP Act.
### 4.2. Senior Management
* Reviewing and providing guidance on grievances escalated by the Grievance Officer. * Ensuring adequate resources are available for effective grievance resolution. * Approving final decisions for complex or escalated grievances.
### 4.3. All Employees
* Understanding the grievance redressal process. * Directing Data Principals to the designated Grievance Officer for any data-related queries or concerns. * Cooperating with the Grievance Officer during investigations by providing necessary information and support.
## 5. Grievance Intake Channels
Data Principals can submit grievances through the following channels:
* **Email:** DPO@company.com (Preferred channel for faster processing) * **Postal Address:** [To be completed]
These contact details are published on Privra's website as required by Section 8(9) of the DPDP Act.
## 6. Service Level Agreement (SLA) & Timelines
Privra is committed to addressing Data Principal grievances efficiently and transparently, adhering to the following timelines:
* **Acknowledgment of Receipt:** Within **seven (7) business days** from the date of receipt of the grievance. * **Internal Escalation:** If a grievance remains unresolved or requires senior intervention after **fifteen (15) business days** from acknowledgment, the Grievance Officer will escalate it to senior management. * **Resolution / Decision Communication:** The Grievance Officer will communicate a decision or resolution to the Data Principal within **ninety (90) days** from the date of receipt of the grievance, as per Section 13(1) of the DPDP Act. This communication will be in plain language.
## 7. Grievance Investigation and Resolution Steps
1. **Receipt and Acknowledgment:** * Upon receiving a grievance via email or postal mail, the Grievance Officer logs it in the central grievance register. * An acknowledgment of receipt is sent to the Data Principal within seven (7) business days, confirming the grievance has been received and providing a reference number.
2. **Initial Assessment and Categorization:** * The Grievance Officer assesses the nature of the grievance (e.g., request for access under Section 11, correction/erasure under Section 12, consent-related issue under Section 6, security concern under Section 8(5), or breach notification under Section 8(6)). * The grievance is categorized for appropriate handling.
3. **Investigation:** * The Grievance Officer initiates an investigation, gathering all relevant information and documentation. * This may involve consulting with relevant internal teams (e.g., IT, product, legal, customer support) to understand the facts and circumstances. * Efforts are made to understand the Data Principal's perspective and desired outcome.
4. **Resolution Formulation:** * Based on the investigation, the Grievance Officer formulates a proposed resolution that aligns with the DPDP Act, DPDP Rules, and Privra's internal policies. * If the grievance pertains to a right (e.g., access, correction, erasure), the resolution will detail how Privra has addressed or will address that right. For erasure requests, consideration will be given to Section 8(7) regarding retention requirements under applicable law.
5. **Internal Escalation (if applicable):** * If the grievance is complex, requires significant resources, or remains unresolved after fifteen (15) business days, the Grievance Officer escalates it to senior management for review and guidance. All documentation related to the grievance and investigation is provided.
6. **Communication of Decision:** * Within the ninety (90) day timeline, the Grievance Officer communicates the final decision and resolution to the Data Principal in plain language. * This communication explains the steps taken, the rationale behind the decision, and any actions Privra will undertake.
7. **Implementation:** * Any agreed-upon actions or changes resulting from the resolution are promptly implemented by the relevant teams.
## 8. Documentation and Record Keeping
Privra maintains a robust system for documenting all grievances. This includes:
* A central grievance register with details such as: * Date of receipt * Data Principal's identity (with appropriate verification) * Nature of the grievance * Investigation steps taken * Communication logs * Final decision and resolution * Dates of acknowledgment and resolution * All correspondence with the Data Principal. * Internal notes and reports related to the investigation.
These records are stored securely and retained for a period consistent with Privra's data retention policy and legal requirements.
## 9. Escalation to the Data Protection Board of India
In accordance with Section 13(1) of the DPDP Act, if a Data Principal is dissatisfied with the resolution provided by Privra, or if their grievance remains unresolved within the ninety (90) day period, they have the right to escalate their grievance to the Data Protection Board of India.
Privra will inform the Data Principal of this right in its final communication if the grievance is not resolved to their satisfaction. Information on how to contact the Board will be provided upon request.
## 10. Annual Review
This Grievance Redressal SOP and the overall grievance handling process will be reviewed annually, or more frequently if significant changes to the DPDP Act, DPDP Rules, or Privra's operations occur. The review aims to ensure the process remains effective, compliant, and aligned with best practices.
---
## Quick Reference: Grievance Redressal
| Aspect | Detail