First, read it closely: complaint, inquiry or investigation?
When a letter arrives from the National Privacy Commission, establish whether it concerns an individual complaint, a request for information, or an investigation or compliance check the Commission started itself. Each follows a different procedure and asks for different things, but they share one rule: the deadline in the letter is the deadline that counts.
Extract the essentials: the reference number; whether the company name is correct; who the complainant is, whether a current or former employee, a customer or a third party; what processing is alleged, such as collection without consent, use beyond the stated purpose, a breach, an ignored access or deletion request, or excessive monitoring; what the company must do, such as a written answer, submission of documents, or attendance at mediation or a conference; and the deadline and method of response. If it is unclear when the period starts, ask the issuing office in writing.
Verify that the letter is genuine by contacting the Commission through its published official channels rather than the phone number or email printed on the letter. Scams that impersonate regulators and demand an immediate fine or a full customer database are not unusual, and a real proceeding will never ask you to pay into a personal account. Once confirmed, hand the letter to the company's data protection officer and to management the same day, and name one person to own the matter so the company speaks with one voice.
Diary the deadline in at least two places and set an internal target a few working days earlier. Collecting records, translating anything that is not in English and getting sign-off from an authorized officer always takes longer than expected.
Second, freeze the records and reconstruct what happened
Before drafting anything, freeze every record connected with the complaint: no deletions, no edits, no back-dated signatures. Back-dating turns an explainable compliance gap into a question of honesty, which is far harder to recover from.
You usually need to reconstruct when, why and through what channel the complainant's personal data was collected; what privacy notice was given and whether there is a record of acknowledgment; which system holds the data, who can access it and whether access is logged; whether the data was passed to any third party and whether a written processing agreement exists; and whether the complainant previously made an access, correction or deletion request and how the company answered. A great many complaints start with exactly that: a request nobody answered.
If the complaint involves a breach, containing, assessing and reporting the breach is a separate track. Follow how to respond to a customer data breach and do not wait until the answer is drafted. If a lost device caused it, see what to do when a work laptop or phone is lost. The set of privacy documents the company should already have is listed in the Data Privacy Act basics for businesses; use it now as a checklist to see what is missing. Keep a short log of what you found and where, because the same material will be needed for the answer and for any later stage.
Tell the staff involved, in writing, not to delete emails, chats or files on the subject while the matter is open. A simple hold notice protects the company if questions are later asked about missing records.
Writing the answer: address the facts, show the documents, set out the fixes
The answer is not the place to argue the law at length. Respond to each alleged fact and use documents to show what the company did and what it is now correcting. Being unable to produce documents is the most common reason companies lose ground in these proceedings.
A workable structure: open with the company's full name, the reference number and who is answering. Address each factual allegation in turn, admitting what is true and clarifying what is not. Attach the documents that support the company's position: the privacy notice and acknowledgment records, the data protection officer's appointment, access and permission records, the retention policy, processing agreements with third parties, and the record of any earlier reply to the complainant. Then describe the corrective steps already taken or planned, with dates, and close by confirming the company will cooperate with the next stage.
Things to avoid: describing policies that did not exist at the time; attacking the complainant's character or motives, especially when the complainant is a former employee; attaching other people's personal data that has nothing to do with the case, which could itself be a fresh violation; and promising correction dates you cannot meet. The answer should be signed by an authorized officer. Where criminal exposure, a damages claim or a parallel labor dispute is involved, have a licensed lawyer review it before filing. Keep proof of the date and method of submission.
Number the attachments and refer to them by number in the text. A reviewer who can match every statement to a document reads the answer as credible; a reviewer who has to hunt for support tends to assume there is none.
Mediation and conferences: settling, and what a settlement should say
Privacy complaints often include a mediation or conference stage, and meeting the complainant's legitimate requests reasonably can save the company a full proceeding. Whether mediation applies and how it runs depends on the Commission's current procedure and the notice you received.
Complainants usually want one or more of the following: access to their data or a copy of it; correction or deletion; an end to a particular processing activity such as marketing messages or a form of monitoring; an apology or explanation; or compensation. The first few are things the company is generally obliged to honor anyway, and doing so early shows good faith. Where compensation is sought, assess the facts and evidence, and do not admit things that did not happen just to close the file quickly.
If you settle, put it in writing: what exactly the company did, for example which data was deleted or which processing stopped, when it was done, and what the parties agree about the rest of the proceeding. A settlement does not remove the duty to fix underlying compliance gaps; the Commission may still require corrective measures. Privacy complaints from former employees are frequently tied to labor disputes, and the company's account must be consistent across both. For the labor side, see where employers most often lose in labor arbitration. Agreeing a consistent statement of facts early saves the company from contradicting itself later.
Send someone to the conference who knows the facts and has authority to agree practical steps. A representative who can only take notes and report back usually means another session and more delay.
Possible outcomes and what you must deliver afterward
A proceeding may end with the complaint dismissed, with an order to correct and report back, or, where a violation is found, with a sanction or referral to another process. Outcomes and penalty levels follow the Commission's current rules and the decision in each case; this guide does not quote amounts.
Corrective orders usually require specific steps within a set period, with proof of completion, such as appointing or updating the data protection officer, revising privacy notices, adopting a retention and disposal policy, signing missing processing agreements, training staff or changing a monitoring practice. Meet the deadlines in the decision and submit documentary proof; documents carry far more weight than assurances. If employee monitoring is part of the issue, such as fingerprint or face-scan attendance, cameras or monitoring of work computers, fix it alongside the order using privacy rules for biometric attendance.
If you disagree with a decision, have a lawyer assess within the applicable period whether and how to seek reconsideration or appeal. Bear in mind that the complainant may also file a civil claim in court or raise the same facts with another agency, so prepare every document you submit on the assumption that it will be read again by someone else. A single, well-organized file of everything submitted makes any later stage far easier to manage.
After the matter closes, record what was learned: which document was missing, which request went unanswered, which process changed. That short note is the most useful thing to show if a similar complaint arrives in future.
Preventing the next complaint, and how Yixing helps
Most privacy complaints start with an unanswered request from an employee or customer, or with processing the person was never told about. Close those two gaps and complaints drop sharply.
The best-value measures are: a published privacy contact, with the data protection officer or a named person answering access, correction and deletion requests within a reasonable time and keeping a record of each reply; clear privacy notices given at hiring and at customer onboarding, with acknowledgment kept on file; handling former employees' data according to the retention policy, neither keeping it indefinitely nor using it as leverage in an exit dispute; real, working opt-outs for marketing; and written processing agreements with outsourcers and system providers. When an employee error sends personal data to the wrong person, the internal side of the incident is covered in handling losses caused by an employee mistake.
Yixing can help you build the document list the letter requires, coordinate the internal fact-finding, review privacy notices and the employee handbook, handle matters around the data protection officer's appointment and registration, connect you with a licensed lawyer, and add privacy compliance to the company's annual compliance calendar. See our compliance retainer service. For other regulator letters, such as an SEC request for explanation, see how to reply to an SEC show cause order. Yixing is an SEC-registered company (registration no. CS202009551) with no affiliation with the National Privacy Commission and cannot decide any outcome. For your specific case, consult a licensed lawyer. This article is not legal advice.
A brief yearly review of these points costs far less than one proceeding.
Frequently Asked Questions
Do we have to respond to an NPC complaint notice?
How do we check that an NPC letter is genuine?
A former employee says we misused their data. Can our answer explain why they were dismissed?
We never appointed a data protection officer. Is it too late?
The complainant wants their data deleted. Can we just delete it?
Can we settle privately with the complainant?
How much can the NPC fine us?
Let’s talk through your situation — free
Every company is different. Leave your details and a Chinese-speaking advisor will get back within 1 business day with practical, industry-specific guidance and a transparent quote.
Get help with Compliance → Free consultation