How to explain a partial refusal of a privacy request

“We cannot comply due to legal requirements” leaves a customer with more questions than answers. Which information remains? What requirement applies? Did the business do anything with the parts of the request it could fulfil? A partial response should make the decision understandable without overstating either the customer’s rights or the organisation’s exceptions.

The DPDP Act contains rights with defined scope and limits, including access under section 11 and erasure under section 12. As of 22 October 2026, those provisions are scheduled for May 2027. Use the Act, final rights rule and commencement notification as the basis for readiness work.

Make separate decisions for separate parts

Suppose a hypothetical equipment retailer receives a request to erase an account, stop promotional messages and delete records of an unresolved warranty dispute. The team should not use the dispute to reject the whole request without analysis.

Assess the promotional use, active account information and dispute evidence separately. Some processing may stop; some records may be erased when required; other records may need restricted retention for a specific reason. Record the decision for each category and the evidence supporting completion.

This approach also helps identify overbroad internal assumptions. “Finance needs the customer record” may mean finance needs an invoice and payment reference, not every support note, profile field and campaign interaction.

Name the actual reason

For erasure, section 12(3) recognises retention needed for the specified purpose or legal compliance. Section 17 contains particular exemptions, including processing necessary for a legal right or claim; the section 17(1) exemptions preserve section 8(1) accountability and section 8(5) security duties. The final retention rule must also be considered, including rule 8(3) and its at-least-one-year minimum for Seventh Schedule purposes.

The explanation should identify the relevant reason with enough detail to be meaningful. If a legal retention requirement applies, cite the actual authority after verifying it. If records remain necessary for a specific unresolved matter, describe the category and purpose without revealing privileged or inappropriate material.

Do not invent an exception called “business convenience”. A record being useful, difficult to delete or embedded in a legacy system is not automatically a legal reason to refuse. Technical limitations require a managed response and accurate explanation, not a new statutory exemption.

Explain what has already changed

Lead with the actions completed. In the retailer example, the response might explain that promotional processing has stopped and the account is closed, then identify the transaction or dispute records retained. This is a drafting approach, not a universal response template.

State any important difference between closing the account and erasing its information. If a vendor action remains pending, do not claim it has been completed. Give a clear next step and an honest status while the organisation follows through.

Where retained records are no longer available for ordinary marketing or operational reuse, explain that if it is true and relevant. This can help the customer understand that continued storage does not necessarily mean all previous uses continue.

Give a period or review trigger

A partial refusal should not silently create indefinite retention. Identify when the reason will end or when the decision will be reviewed. A dispute may have a case-closure trigger; another legal record may have a defined retention period.

If the exact end date depends on an event, explain the event rather than inventing a date. Assign an internal owner to revisit the decision. A promised review that nobody owns will not protect the customer or the organisation.

Keep exceptions in a register that can be monitored. Limit it to the information needed to understand the decision, avoiding a second full copy of every underlying record.

Offer a route to question the decision

Section 13 requires exhaustion of the internal grievance opportunity before approaching the Board. Explain the actual contact route and how to identify the request. Do not treat disagreement with the business as evidence that the customer is making a frivolous complaint.

The future rule 14 grievance-response ceiling should not be described as a universal period within which every underlying rights request can be ignored. Existing sector or other applicable requirements may also need consideration.

Before sending, ask a second authorised reviewer to check whether the reasons correspond to the data retained, whether completed actions are evidenced and whether the response exposes another person’s information. The best partial response is a precise account of a bounded decision, with completed work, a justified exception and a real path for review.