DSR & Grievance

The DPDP Act gives every individual (a "Data Principal") rights over their personal data: the right to access it, correct it, and erase it. It also mandates a formal grievance redressal mechanism with a named Grievance Officer. Privacy Labs provides out-of-the-box public forms for both, an operator workflow to process them, automation that fetches related data from your backend, and a full escalation path to the DPO.

DPDP Act requirement: Data fiduciaries must respond to DSRs within 30 days (§12, §13, §14). Grievances must be acknowledged and addressed within a reasonable timeframe by a published Grievance Officer (§13). Failure attracts penalties.

Public-Facing Forms

Privacy Labs creates two public forms automatically as part of onboarding. No additional setup is required. The URLs include your organisation slug and are live immediately after onboarding.

DSR Form

Data Subject Request

Individuals use this to submit access, correction, or erasure requests. The URL pattern is:

https://www.theprivacylabs.com/privacylabs/dsrSee a live example

Grievance Form

Complaint redressal

Individuals use this to submit complaints about how their data is being handled. The URL pattern is:

https://www.theprivacylabs.com/privacylabs/grievanceSee a live example

Where to link these: Add the DSR form link to your privacy policy and to the "Your Rights" section of your website. Add the grievance form to your footer and your privacy policy. The DPDP Act requires the grievance form to be easily accessible.

DSR form fields

Field	Required	Notes
Full name	Required
Email address	Required	Used to look up records in your connected database and to send status updates.
Phone number	Optional
Request type	Required	Access (get a copy of my data), Correction (fix incorrect data), Erasure (delete my data).
Description	Required	Freeform explanation of what the person wants.

Grievance form fields

Field	Required	Notes
Full name	Required
Email address	Required
Phone number	Optional
Address	Optional
Subject	Required	Short summary of the complaint.
Category	Required	Data breach, consent issue, unlawful processing, other.
Description	Required	Detailed description of the complaint.

Public Status Tracking Page

On submission, the individual receives a unique reference ID ( DSR-YYYY-XXXXX for requests, GRV-YYYY-XXXXX for grievances ). They can check progress at any time on a public status page - no account or login required.

DSR status

https://www.theprivacylabs.com/privacylabs/dsr/status

Grievance status

https://www.theprivacylabs.com/privacylabs/grievance/status

Access is verified by the reference ID plus the email address used on the original form - so only the requestor can view it. The page shows:

Current status badge (e.g. Received, In Review, In Progress, Escalated, Completed / Resolved).
A summary of the request: type or category, subject, and the description the person submitted.
Submission date and the 30-day SLA due date.
A timeline of updates - including any notes the operator adds when moving the request forward.
For completed Access / Portability requests: a secure button to download the exported data (time-limited link, see below).

When an operator writes a note while updating the status, that note is both emailed to the requestor and shown on this status page's timeline - so the person sees the same comment in their inbox and when they check the tracking link.

Email Notifications

Privacy Labs sends transactional emails automatically at each step so the requestor is kept informed without anyone having to email them manually. All emails go to the address provided on the form and include the reference ID and a link to the status page.

DSR emails

Trigger	What the email says
Request submitted	Confirms the request was received, gives the DSR reference ID, and links to the status page to track it.
Moved to In Review / In Progress	Tells the requestor work has started, shows the new status, includes the operator’s note if one was added, and links to the status page.
Completed - Access / Portability	Confirms completion and includes a secure, time-limited button to download the exported data (link expires in ~7 days).
Completed - Erasure / Correction	Confirms the requested action (deletion or correction) has been carried out.

Grievance emails

Trigger	What the email says
Grievance submitted	Confirms the complaint was received, gives the grievance reference ID, and links to the status page.
Status updated	Shows the new status and the officer’s note (the response/comment), and links to the status page.

Beyond DSR and grievance, the platform also sends transactional emails elsewhere: account verification and welcome, password reset, MFA codes, team and customer invites, SLA warning/breach alerts to the DPO, security alerts, and data-discovery scan-complete notifications. Email delivery is handled through Resend.

Operator Dashboard: DSR & Grievances

Navigate to: Operator Dashboard > DSR & Grievances

This section has two sub-tabs: DSR Requests and Grievances. Operators process all incoming requests here.

Request card: what the operator sees

Requestor details: name, email, phone.
Request type (Access / Correction / Erasure for DSR; category for grievances).
Description of what the person wants.
SLA deadline: creation date + 30 days.
Days remaining or days overdue.
Current status: Pending, In Progress, Completed, Escalated.
Escalation history: if previously escalated, a timeline of who escalated, to whom, when, and why.
Response / resolution field: where the operator writes their reply before marking complete.

DSR automation: data fetch

When the operator opens a DSR, Privacy Labs automatically queries your connected database for all records associated with the requestor's email address. The results appear in two views:

View	What it shows
Data Locations	A list of tables where the requestor's data was found: table name, column hit, and number of matching rows. Built from your data discovery scan map.
Data Preview	A read-only preview of the actual matching rows. Used by the operator to compile an Access response or identify all records to delete for an Erasure request.

Privacy Labs fetches data on demand using your read-only database connection. It does not cache or store copies of your user data. Each time an operator opens a DSR the fetch runs fresh.

Processing actions

Action	Who	What it does
Mark In Progress	`OPERATOR`	Changes status and starts the SLA timer display.
Write response	`OPERATOR`	Free-text field. This is what gets sent to the requestor.
Mark Complete	`OPERATOR`	Closes the request. Sends a response email to the requestor if configured.
Escalate to DPO	`OPERATOR`	Sends to Admin > Privacy Ops > Escalations. Operator must provide a reason.
Resolve escalation	`DPO / ADMIN`	Done from Admin Dashboard > Privacy Ops > Escalations. DPO adds resolution and closes.

SLA Tracking

Every request is assigned a 30-day SLA from submission date (DPDP Act §12). The operator dashboard shows the remaining time prominently on each request card.

State	Visual	Meaning
Within SLA	Green badge	More than 7 days remaining.
SLA warning	Amber badge	7 days or fewer remaining.
SLA breached	Red badge + slaBreached flag	Past 30 days. Flagged in Privacy Ops Escalations and surfaces as a critical item in the Compliance Hub checklist.

SLA-breached requests are automatically surfaced in Admin Dashboard > Privacy Ops > Escalations without needing the operator to escalate manually.

Escalation Flow

Escalation moves a request from the Operator Dashboard to the Admin Dashboard's Privacy Ops module. Common reasons: the operator does not have authority to approve a data erasure, the requestor is disputing the response, or the request involves sensitive data types outside the operator's permission scope.

Operator Dashboard

DSR & Grievances > Open request > Escalate to DPO

Admin Dashboard

Privacy Ops > Escalations tab

DPO resolves

Adds resolution, closes. Status syncs back to operator view.

Escalation fields stored

Field	Value
Type	"dsr" or "grievance"
Priority	Critical, High, Medium, or Low based on SLA status and request type.
Escalated by	Operator's name and email.
Escalated to	DPO's name and email.
Reason	Free text from the operator when escalating.
Days overdue	Calculated from SLA deadline to today, if SLA is breached.
SLA breached	Boolean. Used to sort and highlight critical escalations.
Data subject / complainant	Name, email, phone, address from the original form.
Escalation history	Full timeline: every escalation event with who, to whom, when, reason, and system-triggered auto-escalations.

Admin Dashboard: Privacy Ops

Navigate to: Admin Dashboard > Privacy Ops

Only DPOs and Admins can access this module. Two tabs:

Tab	Content
Escalations	All escalated DSRs and grievances. Sorted by priority (SLA-breached and high-priority first). Filter by status, type, and priority. Each card expands to show full request details, data subject info, escalation history, and a resolution form.
Policies	Internal policy documents set by the DPO for how operators should handle specific request types. Not public-facing. Example: "Erasure requests for inactive accounts: approve within 5 days."

Grievance Officer Requirement

The DPDP Act requires every data fiduciary to designate a Grievance Officer and publish their contact details (§13). Configure this in:

Admin Dashboard > Team & Settings > Organisation Settings

The Grievance Officer's name and email appear on the public grievance form and in the auto-generated privacy policy. In Privacy Labs, the DPO role maps to the Grievance Officer function.

Next up

After your first DSR is resolved, the activity feeds into the Compliance Hub score. See Legal Policies for breach notification obligations that sit alongside DSR handling.

Legal Policies & Breach Management