NDPA modules · Complaints, and how they were resolved
The second time, they don't write to you.
Chinedu asked to see his data on 21 June. When nobody replied he complained to you directly. When nobody replied to that either, he complained to the Commission — and the letter you are now holding is not from him.
SNAG-2026-002 · Chinedu Okafor · the person himself
- 21 JuneDay 0
He asks to see his data
An access request by email. The clock starts here, whether or not anybody notices it arrive — and the Act gives it no end date, only a standard.
- 22 Jun – 25 JunDays 1–5
Nothing
No acknowledgement, no owner assigned, no record created. The request sits in an inbox.
- 26 JuneDay 5
He complains to you directly
SNAG-2026-002. Still addressed to you, still solvable by a reply. This is the last cheap moment.
- 27 Jun – 10 JulDays 6–19
Nothing again
Two weeks. The access request passes twenty days outstanding and nobody is counting.
- 11 JulyDay 20
He complains to the Commission
He no longer needs you at all. The complaint is now on a regulator’s desk with your name on it and his timeline attached.
- 21 JulyDay 30
A letter arrives · NDPC-2026-0104
Not from Chinedu. And the access request underneath all of this is still unanswered.
Days since he first asked
30
Two clocks breached, one regulator engaged, and the original question still not answered.
Halima Sani · SNAG-2026-004
A grievance and a request are the same failure seen twice
Halima asked you to stop marketing to her, and separately complained that you ignored her when she chased it. Two records, two clocks, two replies. Fixing the marketing does not answer the accusation — and teams that assume it does close the wrong one.
The request · DSR-2026-0117
Stop marketing to me
An objection under the Act. Answering it means removing her from the audience and confirming it is done — a task with a definite end.
33 days elapsed · late
The grievance · SNAG-2026-004
And nobody answered when I chased it
An allegation about how you behaved. It needs its own reply, in your own words, acknowledging what went wrong — which no automated confirmation can supply.
Open · not yet answered
The grievance register
Three this year, and each one points at a record
Every grievance is tied to the activity, request or notice it is really about. A complaint that floats free of your register cannot be answered with anything but an apology.
1 escalated
| Who, and what they said | State | What it points at | Handling |
|---|---|---|---|
| Halima SaniThe person herself“You kept marketing to me after I told you to stop, and nobody answered when I chased it.”SNAG-2026-004 · served 18 Jul 2026 | Not yet answered | DSR-2026-0117 Halima Sani wants us to stopACT-030 Marketing to lapsed customers | The grievance and the request are the same failure seen twice. Answering the request does not answer this — she is alleging you ignored her, and that allegation needs its own reply. |
| Paradigm InitiativeCivil society organisation“Your privacy notice does not say how long call recordings are kept, and the recording warning is not read to callers.”SNAG-2026-003 · served 2 Jul 2026 | Answered | POL-002 Privacy noticeACT-021 Recording customer calls | Answered in twelve days with a dated commitment to publish the retention period. They accepted it and did not escalate. This is what a well-handled notice looks like. |
| Chinedu OkaforThe person himself“I asked for my data on 21 June and have heard nothing since.”SNAG-2026-002 · served 26 Jun 2026 | Escalated to the Commission | DSR-2026-0114 Chinedu Okafor wants to see his dataNDPC-2026-0104 Letter from the Commission | Not answered within the month. He complained to the Commission on 11 July, and the letter you are holding is the consequence. The access request underneath it is still late. |
Paradigm Initiative · SNAG-2026-003
Twelve days, one dated commitment, and it stopped there
A civil society organisation pointed out that the notice never says how long call recordings are kept, and that the recording warning is not read to callers. Both true. The reply agreed, named a date to publish the retention period, and named the person who owns it.
They accepted it and did not escalate. That is the whole difference between this file and Chinedu’s — not the seriousness of the complaint, the speed and candour of the answer.
What a reply has to contain
- What you accept
- Named plainly, without hedging. A reply that disputes every point reads as a legal position rather than an answer.
- What you dispute, and why
- Where you disagree, say so and give the reason. Silence on a point is read as agreement you are hiding from.
- A date
- Not “in due course”. Paradigm accepted because the commitment carried a date they could hold you to.
- A named person
- Somebody who owns it, reachable directly. A no-reply address is what sends people to the Commission.
- Their route onward
- That they can complain to the Commission regardless. Telling them costs nothing and withholding it looks exactly like what it is.
Who can serve one
Not only the person whose data it is
A civil society organisation, a journalist, a competitor, a parent on behalf of a child, a union on behalf of staff. None of them need your permission and none of them need standing you would recognise commercially.
Which is why a grievance queue that only accepts complaints from account holders is a queue that misses the ones most likely to escalate.
The person themselves
The ordinary case, and the one most systems are built for. Two of your three this year.
A civil society organisation
Paradigm Initiative did not have an account with you. Their complaint was still correct, and correct is the only thing that matters.
A parent, on behalf of a child
Which is how most children’s-data findings surface — not from an audit, from a parent who noticed something.
A union or staff representative
Employee monitoring complaints usually arrive collectively. Your own people are data subjects too.
Anyone acting with authority
A lawyer, an executor, a carer. Verify the authority, then answer the complaint — in that order, and inside the same clock.
Nobody complains twice. They complain upward.
Every grievance in Asiri carries an owner, a clock and the record it points at — and it stays open until somebody writes back in their own words. Which is usually all it takes.