How do we handle a privacy complaint within 90 days?

Short answer: Reply within your published period, never beyond 90 days

Publish one clear way to complain, log every complaint, give it an owner and reply within the period you publish, never more than 90 days. People can go to the Data Protection Board only after using your process, so a good process keeps most matters with you.

What the law says

Section 8(10) requires a working grievance process. Rule 14(3) caps the reply time at 90 days. Section 13 says people must use your process before approaching the Board.

Section 8(9)–(10) · Rules 9, 14: Publish the business contact of a DPO or another person who can answer questions about personal data. Run a working grievance process and reply within a reasonable period, not more than 90 days.
Sections 11–14 · Rule 14: People can ask for a summary of their data and who it was shared with, ask for correction, completion, updating or erasure, complain, and nominate someone to act for them. You must publish how to do this.
Sections 18–26: The Data Protection Board of India hears complaints and inquires into breaches. It was established in November 2025. When this page was last reviewed, its chairperson and members had not yet been appointed.

Steps

Publish one contact for privacy complaints on your website, app and notices.
Log each complaint with the date, channel and a named owner.
Acknowledge within a few days, and set an internal target well under 90 days.
Find and fix the cause, not just the single case.
Reply in writing and close the entry with the date.

Evidence to keep

Complaint register with dates
Replies sent
Monthly summary to management

Common mistakes

Mixing privacy complaints into general complaints with no tag
No owner, so nobody counts the days
Closing a complaint without fixing the cause

How it plays out by sector

Banking, financial services and insurance: A privacy complaint may also reach the RBI Ombudsman. One log, tagged for both, avoids two different answers.
IT, ITeS, BPO and GCC: Most complaints come from staff, ex-staff and candidates. Tag them.
Central government: ministries and departments: Data complaints often arrive through CPGRAMS or the scheme helpline. Tag them.
Public sector undertakings and utilities: Complaints come through call centres, portals and CPGRAMS. Tag the data ones.
Healthcare and hospitals: Patient relations already handles complaints. Tag the data ones and count the days.

From each seat

DPO / Privacy lead: Count the days yourself. A short monthly note to management with open complaints and their age keeps the 90-day limit visible.
Operations head: Many complaints start as service complaints. Tag the ones about personal data so they enter the privacy log.
Customer service department: Tag privacy complaints and count the days.

What a good answer from management sounds like

“Every privacy complaint has an owner and a date. Our average reply time is well under the limit, and the repeat causes are reported to us every quarter.” Effort and time: Light · 3 to 6 weeks.