Close a grievance with an explanation and useful evidence

A grievance is not resolved simply because an internal ticket has been closed. The person needs to understand what the organisation found, what changed and what they can do if the explanation does not address the concern.

Write the closure message as the final part of the investigation. If the team cannot explain the result plainly, that may reveal an unresolved decision or a gap in the evidence.

Answer the concern the person actually raised

Consider a hypothetical customer who says they continued receiving promotional messages after asking to stop. Their concern is about the sending behaviour. A response that only confirms the preference screen now says “withdrawn” does not answer it.

The reviewer should establish which messages were involved, which purpose and system produced them, and what decision was in place at the relevant time. Use proportionate evidence and avoid asking the customer to repeat information the organisation can reliably find itself.

If several issues were raised, answer each one. A correction to the customer record may be useful without resolving a complaint about an earlier disclosure. Keep the decisions connected but distinct.

Build the explanation from verified facts

A helpful response contains four parts: the concern understood, the finding, the action taken and any remaining limitation or next step. Explain uncertainty where it matters.

For the hypothetical messaging complaint, the team might establish that an older exported list remained in a campaign tool. The response can describe the affected workflow and the steps taken to stop further use, without disclosing internal credentials, other customers’ records or unnecessary security details.

Do not invent a technical cause to make the answer sound complete. If the evidence cannot establish why a message was sent, say what was verified, what remains uncertain and what action addresses the identified risk.

Avoid unsupported absolutes such as “this can never happen again”. Describe the actual control change and the test performed, within its scope.

Keep the legal route accurate

Section 13 of the DPDP Act provides the grievance route and requires exhaustion of the relevant fiduciary or Consent Manager route before approaching the Board. The final Rules, rule 14(3), call for a published reasonable grievance-response period no longer than ninety days.

Those substantive provisions are scheduled for 13 May 2027 under the commencement notification, as checked on 22 October 2026. Do not describe the future framework as if every route is already operational, or assume ninety days is the applicable deadline for every current complaint.

Existing laws, sector requirements and the organisation’s own published commitments may require different handling. The operator should use a maintained procedure that identifies the applicable route and time expectation.

A closure message should not suggest that the person loses further options merely because the organisation has completed its internal review.

Share evidence at the right level

The person may benefit from dates, the affected preference or record, the action taken and the expected next behaviour. They do not automatically need a raw system log.

Raw logs can contain other people’s information, internal identifiers and confidential configuration. The OWASP Logging Cheat Sheet recognises that logs themselves require protection from unauthorised access and misuse. Prepare a suitable explanation or extract instead of attaching an unrestricted diagnostic file.

Keep the supporting investigation record accessible to authorised reviewers. Link the conclusion to the evidence used, including any processor response and unresolved dependency. This makes a later review possible without requiring the original investigator to remember the case.

Do not close over unfinished work

If the organisation has stopped one sending path but is still waiting for a processor, the case should show that distinction. The customer-facing response can explain the current outcome and the next update, subject to the applicable procedure.

Separate “response sent” from “all remedial actions completed”. Some corrective work may continue after the immediate customer issue is addressed. Give that work an owner and a review date rather than hiding it in the closure note.

For a request that cannot be granted fully, state which part is affected and the actual reason. Avoid a generic reference to “policy” where a more specific explanation is possible.

Final review before sending

Ask an uninvolved colleague to check:

• Does the response address each concern?
• Are factual claims linked to investigation evidence?
• Are completed and pending actions distinguished?
• Is any retained or undisclosed information explained appropriately?
• Have unnecessary personal and security details been removed?
• Are the contact and review routes accurate?
• Can the organisation reproduce the basis for its decision?

A strong closure message gives the person an answer they can use. It also leaves the organisation with a reviewable record of its reasoning, its actions and the limits of what it established.