Privacy and data protection

1. 1.1

   The Data Fiduciary. The Citizen Grievance Bureau determines the purpose and means of processing the personal data described in this notice, and is the Data Fiduciary for it.

2. 1.2

   Data contact. Questions about the processing of personal data, and requests to exercise any right, are answered by the Case Registry at case@cgb.org.in, subject line "Data request". A complaint about the handling of a request goes to the Grievance Officer of the Bureau at grievance@cgb.org.in.⁴

3. 1.3

   Standard applied. The Bureau applies the standards of the Digital Personal Data Protection Act, 2023 and the Digital Personal Data Protection Rules, 2025 to each matter now, including those obligations that come into force in stages.³

Processing rests on your consent, given at registration and in the Letter of Authority, for the purposes stated above, and on the uses the Act permits without consent, such as compliance with law.⁵

1. 5.1

   Minimal record. A minimal entry is kept for one year after closure, and then erased: the Registry Number, the name of the institution, the dates of correspondence and the manner of closure, with the logs of processing.⁸

2. 5.2

   Earlier erasure. You may ask for erasure before closure. The Bureau then revokes its authority, informs the institution within one working day, hands you the complete file, and erases your data within 30 days.

3. 5.3

   Unpursued registrations. A registration on which the Letter of Authority is not signed within 60 days is closed after written notice to you, and erased in the same manner.

4. 5.4

   Copies already sent. Representations already delivered to an institution or forum are held by that body under its own obligations. On request, the Bureau asks the institution in writing to deal with them according to law.

The request is prepared in your own email application and sent by you. Nothing is transmitted from this page. Send it from the email address registered with the matter, so that your identity is established without further documents.

1. 8.1

   Access. Personal data in a matter is seen only by the desks handling that matter.

2. 8.2

   Transmission. Email to and from the Bureau's addresses travels over encrypted connections where the other party's service supports them. This website is served only over HTTPS.

3. 8.3

   Minimisation. Only what the matter requires is sent to an institution. Card numbers are reduced to the last four digits, and Aadhaar numbers are masked.

4. 8.4

   Breach. If a personal data breach occurs, each affected person is informed without delay, with its nature, its likely consequences and the steps taken, and the Data Protection Board of India is informed as the Rules require.⁷

1. 10.1

   Persons under eighteen. A grievance concerning a person under eighteen years of age is registered through a parent or lawful guardian, whose verifiable consent is obtained before any data of the child is processed.⁹

2. 10.2

   Persons with disability. A grievance concerning a person with a disability who has a lawful guardian may be registered by that guardian, on the same terms.

1. 11.1

   First to the Bureau. A grievance about the handling of personal data is first made to the Grievance Officer of the Bureau, who decides it within seven working days.⁹

2. 11.2

   Then to the Board. If the grievance is not resolved, a complaint may be made to the Data Protection Board of India, which functions as a digital office.

1. 12.1

   Revision. This notice may be revised to reflect a change in law or practice. The revised notice is published on this page with its date.

2. 12.2

   Material change. Where a change affects a matter already registered, the citizen is informed by email before it takes effect, and may withdraw consent.