Who must appoint a Grievance Redressal Officer under the DPDP Act?

Every Data Fiduciary — including MSMEs, startups, clinics, and online platforms operating in India — must publish details of a Grievance Redressal Officer under Section 8(10).

What is the time limit for resolving grievances under DPDP Rules 2025?

The DPDP Rules 2025 enforce a strict maximum resolution window of 90 days for all Data Principal grievances.

Can I generate a formal GRO appointment letter for free?

Yes, you can generate signature-ready GRO appointment letters and website HTML cards using the free Ronin Works Grievance Officer Kit at roninworks.in/tools/grievance-kit.

DPDP Act Section 8(10) · Compliance Guide

How to Appoint a DPDP Grievance Officer: Section 8(10) Rules & 90-Day SLA

Published 30 July 2026 · 5 min read · By Ronin Works Team

Short Answer

Section 8(10) of the DPDP Act 2023 requires every Data Fiduciary to appoint a Grievance Redressal Officer (GRO) and publish their name, email, physical address, and helpline number on all web properties. Under DPDP Rules 2025, GROs must acknowledge grievances within 48 hours and resolve them within a statutory 90-day SLA cap. You can generate appointment letters and website HTML disclosure blocks for free using the Ronin Works Grievance Officer Kit.

Under India's Digital Personal Data Protection Act 2023, data principal grievances are no longer a customer support ticket — they are a legal compliance obligation enforced by the Data Protection Board of India (DPB).

1. Statutory Duties of a Grievance Redressal Officer

Section 8(10) mandates that a GRO must serve as the official point of contact for Data Principals seeking to exercise rights to access, correct, update, or erase personal data, as well as to withdraw consent.

Acknowledge Grievances: Log and acknowledge every incoming request within 24–48 hours.
Enforce 90-Day Resolution SLA: Resolve valid grievances or issue formal written extensions inside the 90-day statutory window.
Maintain 1-Year Audit Logs: Retain grievance records, investigation logs, and resolution notices for at least 1 year under DPDP Rules.

2. Where Must Contact Details Be Published?

The DPDP Act requires published contact information to be easily accessible to Data Principals at the time of data collection. You must publish your GRO's details on:

Your website's Privacy Policy and footer.
Your mobile application's account settings page.
Your Section 5 consent notices at signup or checkout.

Connecting Consumer Rights: Saaph.in ↔ Ronin Works

Consumer privacy platforms like Saaph.in allow Indian citizens to submit structured data erasure requests to companies.

Saaph's rights engine scans company registries to find your published GRO email address. If your website lacks a designated GRO contact, automated privacy requests fail — triggering regulatory complaints to the Board. Use our Free Grievance Officer Kit to ensure your GRO details are published correctly.

Generate GRO Kit Free → Scan Your Website →

3. Generate Your Appointment Letter & HTML Card

Instead of drafting legal documents from scratch, use our free Grievance Officer Kit to generate:

Formal Board Resolution & GRO Appointment Letter
Embeddable Website Disclosure HTML/CSS Snippet
Day-1 Acknowledgment Email Template
Formal 90-Day Resolution Notice Template

Legal Disclaimer: This guide provides administrative information regarding Section 8(10) of the DPDP Act 2023. It does not constitute legal counsel.

Subcontracted DPO & GRO Services

Need a Subcontracted Virtual DPO / GRO Team?

Ronin Works provides qualified India-resident Virtual DPO and Grievance Officer subcontracting for MSMEs.