When complaints are ignored or handled badly, small security issues become expensive disasters. For example, if a customer reports that their invoice data is visible to other users, and you don't have a process to fix it quickly, that customer loses trust, tells others, and you could face regulatory action from authorities like data protection officers. Without a clear complaint process, you also fail audits from large customers (like those doing vendor compliance), lose business, and waste time fighting fires instead of preventing them. In India, DPDP Act violations and customer complaints can lead to penalties up to ₹50 lakh or more.
Find where your organisation is today. Be honest — the self-assessment is only useful if it reflects reality.
Absent
You have no formal way for people to report security or data issues—they either tell someone verbally or it gets lost. Nothing is documented, tracked, or followed up, so you never know if problems were actually fixed.
Initial
You have an email address or WhatsApp group where people can report issues, but there's no standard form or checklist—reports are scattered across different channels and often forgotten after a few days.
Developing
You have a basic log or spreadsheet where complaints are written down, and you assign them to someone to fix, but there's no fixed timeline and sometimes nothing happens for weeks without anyone checking status.
Defined
You have a documented process with a simple form, a timeline (like 'respond within 2 days, fix within 1 week'), and someone is assigned to track progress—most issues are resolved but a few slip through the cracks.
Managed
Your process includes a tracking system with clear escalation rules, investigations are documented with root cause analysis, fixes are verified before closing, and you track metrics to see if the process is working well.
Optimised
You have a formal complaint management system that integrates with your security operations, all reports are automatically logged with unique IDs, trends are analyzed quarterly to prevent repeat issues, and third parties can audit the entire process.
| Step | What to Do | Who | Effort |
|---|---|---|---|
| 0 → 1 | Create a simple one-page process document (in Hindi or English) that says: 'To report a security issue, email [security@company.com] or call [number].' Print it and put it on the office wall and website. | Business Owner or IT person | Half day |
| 1 → 2 | Set up a Google Form or Excel spreadsheet to capture reports with: Date, Reporter Name, Issue Description, Severity (High/Medium/Low), Status (New/In Progress/Fixed). Assign one person to check it daily. | IT person or Office Manager | 1 day |
| 2 → 3 | Write a formal complaint handling procedure document that includes: SLA timelines (acknowledge within 48 hours, investigate within 1 week), who approves fixes, how to verify the fix worked, and sign-off process. Train all staff on it. | IT person with Business Owner review | 1-2 weeks |
| 3 → 4 | Implement a free ticketing system (like Zulip, Plane, or osTicket), add escalation rules (e.g., if not fixed in 5 days, escalate to manager), conduct root cause analysis for each issue, and create a monthly dashboard showing complaint trends and closure rate. | IT person | 3-4 weeks |
| 4 → 5 | Integrate complaint data with your security incident response plan, conduct quarterly reviews to identify systemic issues, establish customer feedback loops to validate fixes, and prepare audit-ready reports showing compliance with your own SLAs and lessons learned. | IT person and Management | Ongoing (2-3 hours per month) |
Documents and records that prove your maturity level.
- Documented complaint handling procedure or policy document with clear process steps and timelines
- Complaint log or tracking spreadsheet/system with at least 5-10 past reports showing Date, Reporter, Issue, Status, and Resolution Date
- Examples of 3-4 closed complaints with notes showing investigation was done and fix was verified
- Evidence of communication back to reporters (email or ticket confirmation) acknowledging their complaint within agreed timeline
- Monthly or quarterly summary report showing complaint volume, average resolution time, and trends (e.g., 'most complaints are about password resets')
Prepare for these questions from customers or third-party reviewers.
- "Can you show me your process for handling data or security complaints? Is it documented somewhere I can read?"
- "Walk me through a recent complaint—show me the log entry, investigation notes, and how you verified the fix worked."
- "What is your target time to acknowledge a complaint and to fully resolve it? Can you show me 5 examples where you met this timeline?"
- "What happens if a complaint is not resolved on time? Who escalates it and to whom?"
- "Do you track complaints over time? Show me a report of trends—are the same issues being reported multiple times?"
| Purpose | Free Option | Paid Option |
|---|---|---|
| Track and log complaints with status updates and timelines | Google Forms + Google Sheets (zero cost, easy to set up, works offline); or osTicket (open-source, self-hosted, requires basic server setup) | Plane (₹99-499/month); Jira Service Management (₹900-4000/month); Zoho Desk (₹1,000-15,000/month depending on users) |
| Send automated acknowledgment to reporter and track resolution time | Gmail with templates + Google Sheets; or Formspree (forms linked to email, free tier 50 submissions/month) | Zapier automation (₹5,000-30,000/year to auto-log and notify); n8n (self-hosted, free) |
| Analyze complaint trends and create dashboards for management | Google Data Studio (free, integrates with Sheets); Microsoft Excel pivot tables | Tableau Public (free version); Metabase (self-hosted, free) |
- Creating a fancy complaint process on paper but not actually using it—complaints still come via WhatsApp and get lost, defeating the purpose entirely
- Setting unrealistic timelines (like 'fix within 1 hour') and then missing them constantly, so the process loses credibility and people stop reporting
- Investigating complaints but never telling the person who reported it what you found or did—they assume nothing happened and lose trust in the process
- Logging complaints but only in someone's personal inbox or notebook, so when that person leaves or is on leave, the complaints disappear and nothing gets fixed
- Treating all complaints the same—a user unable to login gets same urgency as a suspected data leak, causing confusion and delayed response to serious issues
| Standard | Relevant Section |
|---|---|
| DPDP Act 2023 | Section 8 (Right to grievance redressal); Section 6(9) (Grievance officer requirement) |
| CERT-In 2022 | Guideline 5.4 (Incident handling and response capability); incident reporting to CERT-In within agreed timelines |
| ISO 27001:2022 | A.16.1.5 (Response to information security incidents); A.16.1.6 (Post-incident activities) |
| NIST CSF 2.0 | Respond (RS) Function - processes to contain and remediate security incidents |
Ready to assess your organisation?
Answer all 191 questions and get your NIRMATA maturity score across all 12 pillars.
Start Free Self-Assessment →