InfraVeritas360DPDPiqDPDP Insights › The law › Section 8(9)–(10) · Rules 9, 14
The law
Section 8(9)–(10) · Rules 9, 14: Contact person and complaints
Publish the business contact of a DPO or another person who can answer questions about personal data. Run a working grievance process and reply within a reasonable period, not more than 90 days.
Questions where this section matters
- Someone asks what data we hold about them. What do we send?
- How do we handle a privacy complaint within 90 days?
- Do we need a DPO?
Official text: Digital Personal Data Protection Act, 2023 and DPDP Rules, 2025 (MeitY). The DPDP Rules were notified on 13 November 2025. Consent Manager rules start on 13 November 2026. Most duties, including notice, security, breach reporting, retention, children's data and rights, start on 13 May 2027. A proposal discussed in early 2026 to bring this date forward had not been notified when this page was last reviewed.
Explore our research-built assessment platformsEach one comes out of the same InfraVeritas360 Foundation Layer research. Human-led, with no AI used.