(a) (b) (c) (d) (4) 39. data protection impact assessments under section 33; record-keeping under section 34; data audits under section 35; and data protection officer under section 36. Notwithstanding sub-section (3), the Authority may notify the application of all or any of the obligations in sub-section (3) to such data fiduciary or class of data fiduciaries, not being a significant data fiduciary, if it is of the view that any processing activity undertaken by such data fiduciary or class of data fiduciaries carries a risk of significant harm to data principals. Grievance Redressal. — (1) Every data fiduciary shall have in place proper procedures and effective mechanisms to address grievances of data principals efficiently and in a speedy manner. (2) A data principal may raise a grievance in case of a violation of any of the provisions of this Act, or rules prescribed, or regulations specified thereunder, which has caused or is likely to cause harm to such data principal, to— (a) (b) the data protection officer, in case of a significant data fiduciary; or an officer designated for this purpose, in case of any other data fiduciary. (3) A grievance raised under sub-section (2) shall be resolved by the data fiduciary in an expeditious manner and no later than thirty days from the date of receipt of grievance by such data fiduciary. (4) Where, a grievance under sub-section (2) is not resolved within the time period mentioned under sub-section (3), or where the data principal is not satisfied with the manner in which the grievance is resolved, or the data fiduciary has rejected the grievance raised, the data principal shall have the right to file a complaint with the adjudication wing under section 68 of the Act in the manner prescribed. (5) Any person aggrieved by an order made under this section by an Adjudicating Officerin accordance with the procedure prescribed in this regard, may prefer an appeal to the Appellate Tribunal. CHAPTER VIII TRANSFER OF PERSONAL DATA OUTSIDE INDIA 40. Restrictions on Cross-Border Transfer of Personal Data. — (1) Every data fiduciary shall ensure the storage, on a server or data centre located in India, of at least one serving copy of personal data to which this Act applies. 23