Disclosure focus
complaints received from outside parties and substantiated by the organization; and
complaints from regulatory bodies.
It also requires the total number of identified leaks, thefts or losses of customer data.
A substantiated complaint is either a qualifying written statement from a regulatory or similar official body identifying a breach or a complaint lodged with the organization that the organization has recognized as legitimate.
Complaint counts and customer-data incident counts are separate measures. A data incident does not need to result in a complaint, and one data incident can result in several complaints.
If no substantiated complaints were identified, a brief statement is sufficient. The organization must still report any identified leaks, thefts or losses of customer data.
The organization must also indicate if a substantial number of the reported breaches relates to events in preceding years.
Policies, cybersecurity controls, affected-customer counts, financial losses and remediation actions can provide additional context but do not replace the required information.
This LRA educational guidance supports disclosure preparation. For the exact requirements, always refer to the official Global Reporting Initiative source.
Prepare
What to collect before drafting
Tick each field as the evidence lands. Owners are the teams that usually hold the source files.
-
Outside-party complaints substantiated by the organization
Privacy / Customer Complaints / LegalComplaints concerning customer-privacy breaches lodged by external parties and recognized as legitimate.
Evidence Complaint register, investigation outcome and substantiation decision.
Watch for The published response for outside-party complaints substantiated by the organization is incomplete or does not match the supporting records.
-
Complaints from regulatory bodies
Privacy / Regulatory Affairs / LegalQualifying written complaints or statements from regulators or similar official bodies identifying customer-privacy breaches.
Evidence Regulator correspondence, decision and legal review.
Watch for The published response for complaints from regulatory bodies is incomplete or does not match the supporting records.
-
Total substantiated complaints
Sustainability ReportingReconciled sum of the two complaint-source categories.
Evidence Controlled complaint calculation and duplicate check.
Watch for The published response for total substantiated complaints is incomplete or does not match the supporting records.
-
Identified customer-data leaks, thefts or losses
Information Security / PrivacyTotal number of unique identified events involving customer data.
Evidence Privacy and security incident register, forensic findings and breach records.
Watch for The published response for identified customer-data leaks, thefts or losses is incomplete or does not match the supporting records.
-
Customer population
Privacy / Data GovernanceConfirmation that consumers and relevant B2B customers are covered.
Evidence Data classification and customer-system mapping.
Watch for The published response for customer population is incomplete or does not match the supporting records.
-
Preceding-year connection
Privacy / LegalWhether a substantial number of the reported breaches relates to events in preceding years.
Evidence Event, complaint, identification and resolution dates.
Watch for The published response for preceding-year connection is incomplete or does not match the supporting records.
-
Zero-complaints statement
Privacy / ComplianceBrief statement where no substantiated complaints were identified.
Evidence Complete complaint search and sign-off.
Watch for The published response for zero-complaints statement is incomplete or does not match the supporting records.
-
Methodology and exclusions
Sustainability ReportingCounting units, reporting dates, duplicates, non-customer data and reasons for omission.
Evidence Methodology paper and exception log.
Watch for The published response for methodology and exclusions is incomplete or does not match the supporting records.
Before you start
- Which external complaints concerning customer privacy were recognized as legitimate by the organization?
- Which written complaints or official statements were received from regulatory or similar official bodies?
- Have the two complaint-source categories been kept separate?
- What is the total number of identified leaks, thefts or losses of customer data?
- Are customer-data incidents being counted independently from complaints?
- Does the customer population include relevant B2B customers?
- Have employee-only and supplier-only data matters been excluded?
- Have complaint records from customer service, privacy, legal and regulators been reconciled?
- Have customer-data incidents from privacy, cybersecurity, operational risk and third-party systems been reconciled?
- Have duplicate complaints and duplicate incident records been removed?
- Is every outside-party complaint in the total recognized as legitimate?
- Is every regulatory complaint supported by the relevant written statement?
- Does every data incident counted involve customer data?
- Were complaints counted rather than complainants, allegations or affected records?
- Were data events counted rather than affected customers or notification letters?
- Does a substantial number of the reported breaches relate to preceding-year events?
- If no substantiated complaints were identified, is the zero statement explicit?
- Can all disclosed counts be traced to controlled records?
How to prepare it
Request the data
Request the disclosure evidence
Translate the disclosure into an internal business question — then adapt it to your organisation's own language.
Please provide the GRI 418-1 complaint and customer-data incident records for [reporting period]. For each complaint, include: controlled complaint ID; date received; source — outside party or regulatory body; complainant type; customer population involved; privacy issue; applicable law or voluntary standard; substantiation status; basis for recognizing the complaint as legitimate; underlying event date; reporting-period classification; and source-record reference. For each customer-data incident, include: controlled incident ID; leak, theft or loss classification; customer-data population; underlying event date; identification date; third-party involvement; linked complaints; affected-customer count as optional context; and source-record reference. Please provide the reconciled totals for the two complaint categories and the separate customer-data incident total.
Use the organisation's own role and document names, but preserve the defined GRI terms and the scope described above.
Better request
Please provide the GRI 418-1 complaint and customer-data incident records for [reporting period]. For each complaint, include: controlled complaint ID; date received; source — outside party or regulatory body; complainant type; customer population involved; privacy issue; applicable law or voluntary standard; substantiation status; basis for recognizing the complaint as legitimate; underlying event date; reporting-period classification; and source-record reference. For each customer-data incident, include: controlled incident ID; leak, theft or loss classification; customer-data population; underlying event date; identification date; third-party involvement; linked complaints; affected-customer count as optional context; and source-record reference. Please provide the reconciled totals for the two complaint categories and the separate customer-data incident total.
Draft your disclosure
Notes that turn data into a disclosure
LRA training templates — adapt them to your organisation, and check the official source before sign-off.
Method note
Substantiated complaints were identified using the GRI definition. Outside-party complaints were counted when recognized as legitimate by the organization. Regulatory-body complaints were identified separately. Customer-data leaks, thefts and losses were counted as unique events.
Context note
Keep mandatory GRI Requirements, GRI recommendations and additional LRA preparation controls clearly distinguished. Apply a GRI 1 reason for omission where required information cannot be reported.
Download Centre
Preparation tools & forms
Download preparation tools for GRI 418-1 with free verified email access for 24 hours. Source-report links remain public.
Check
For each claim, check the evidence
We applied the GRI definition of a substantiated complaint.
Risk The published response does not support this human-reviewed assurance check.
Evidence to check Trace the statement to current approved records and the official IFRS source.
We applied the GRI definition of a breach of customer privacy.
Risk The published response does not support this human-reviewed assurance check.
Evidence to check Trace the statement to current approved records and the official IFRS source.
The customer population includes relevant consumers and B2B customers.
Risk The published response does not support this human-reviewed assurance check.
Evidence to check Trace the statement to current approved records and the official IFRS source.
Employee-only and supplier-only privacy matters were not included automatically.
Risk The published response does not support this human-reviewed assurance check.
Evidence to check Trace the statement to current approved records and the official IFRS source.
Outside-party complaints were reported separately from regulatory-body complaints.
Risk The published response does not support this human-reviewed assurance check.
Evidence to check Trace the statement to current approved records and the official IFRS source.
Every outside-party complaint counted was recognized as legitimate by the organization.
Risk The published response does not support this human-reviewed assurance check.
Evidence to check Trace the statement to current approved records and the official IFRS source.
Every regulatory-body complaint is supported by a qualifying written statement or complaint.
Risk The published response does not support this human-reviewed assurance check.
Evidence to check Trace the statement to current approved records and the official IFRS source.
Regulator enquiries and information requests were not classified automatically as complaints.
Risk The published response does not support this human-reviewed assurance check.
Evidence to check Trace the statement to current approved records and the official IFRS source.
Complaint topics were not used as substitutes for the two required source categories.
Risk The published response does not support this human-reviewed assurance check.
Evidence to check Trace the statement to current approved records and the official IFRS source.
Duplicate complaint records submitted through several channels were removed.
Risk The published response does not support this human-reviewed assurance check.
Evidence to check Trace the statement to current approved records and the official IFRS source.
The customer-data total contains identified leaks, thefts or losses rather than all cybersecurity incidents.
Risk The published response does not support this human-reviewed assurance check.
Evidence to check Trace the statement to current approved records and the official IFRS source.
Every customer-data incident counted involved customer data.
Risk The published response does not support this human-reviewed assurance check.
Evidence to check Trace the statement to current approved records and the official IFRS source.
Customer-data incidents were counted independently from complaints.
Risk The published response does not support this human-reviewed assurance check.
Evidence to check Trace the statement to current approved records and the official IFRS source.
Affected customers, records and notification letters were not counted as incidents.
Risk The published response does not support this human-reviewed assurance check.
Evidence to check Trace the statement to current approved records and the official IFRS source.
One event classified as both a leak and a loss was not double counted.
Risk The published response does not support this human-reviewed assurance check.
Evidence to check Trace the statement to current approved records and the official IFRS source.
Incidents involving third-party processors were assessed consistently under the reporting methodology.
Risk The published response does not support this human-reviewed assurance check.
Evidence to check Trace the statement to current approved records and the official IFRS source.
Complaints and data incidents use documented reporting-period rules.
Risk The published response does not support this human-reviewed assurance check.
Evidence to check Trace the statement to current approved records and the official IFRS source.
The underlying event date and identification or substantiation date are retained.
Risk The published response does not support this human-reviewed assurance check.
Evidence to check Trace the statement to current approved records and the official IFRS source.
We assessed whether a substantial number of reported breaches relates to preceding-year events.
Risk The published response does not support this human-reviewed assurance check.
Evidence to check Trace the statement to current approved records and the official IFRS source.
We did not replace the preceding-years indication with an unsupported percentage threshold.
Risk The published response does not support this human-reviewed assurance check.
Evidence to check Trace the statement to current approved records and the official IFRS source.
Where no substantiated complaints were identified, the zero statement is supported by a complete search.
Risk The published response does not support this human-reviewed assurance check.
Evidence to check Trace the statement to current approved records and the official IFRS source.
A zero-complaints statement did not cause customer-data incidents to be omitted.
Risk The published response does not support this human-reviewed assurance check.
Evidence to check Trace the statement to current approved records and the official IFRS source.
All counts are exact whole numbers and were not estimated or rounded.
Risk The published response does not support this human-reviewed assurance check.
Evidence to check Trace the statement to current approved records and the official IFRS source.
The published counts reconcile to controlled complaint and incident registers.
Risk The published response does not support this human-reviewed assurance check.
Evidence to check Trace the statement to current approved records and the official IFRS source.
Any unavailable required information is addressed through the applicable GRI reason-for-omission requirements.
Risk The published response does not support this human-reviewed assurance check.
Evidence to check Trace the statement to current approved records and the official IFRS source.
Evidence pack to prepare
Common reporting gaps
- The two required complaint-source categories are not reported separately.
- Complaint topics are used instead of outside-party and regulatory-body categories.
- Only complaints received from customers are reported.
- Regulatory-body complaints are omitted.
- Regulator enquiries are counted automatically as complaints.
- Outside-party complaints are counted before they are recognized as legitimate.
- Partially upheld complaints are treated inconsistently.
- The total number of identified leaks, thefts or losses of customer data is missing.
- All cybersecurity incidents are presented as customer-data incidents.
- Employee-data incidents are included.
- Affected customers or records are counted instead of events.
- Data incidents are omitted because no complaint was received.
- Complaints and data incidents are combined into one total.
- One data event is counted several times as a leak, theft and loss.
- A zero-complaints statement is used as though it also meant zero data incidents.
- The report says no complaints were received rather than no substantiated complaints were identified.
- B2B customer data are excluded.
- Third-party processor incidents are omitted without a methodology.
- A prior-year percentage is disclosed without addressing the GRI substantial number requirement.
- A substantial connection to preceding-year events is not indicated.
- Complaint and incident counts are estimated or rounded.
- The published figures cannot be reconciled to source records.
Examples
How it reads on the page
Synthetic, written by LRA — not from a company report, not text from any standard.
Illustrative synthetic example — Retail banking
During 2026:
nine complaints received from outside parties were substantiated by the Bank;
one complaint was received from a regulatory body; and
five leaks, thefts or losses of customer data were identified.
Six of the ten substantiated complaints related to one privacy breach that occurred in the preceding reporting period. The Bank therefore concluded that a substantial number of the reported breaches related to preceding-year events.
Synthetic LRA illustration. Replace every figure and fact with the reporting organisation's evidence.
Illustrative synthetic example — Healthcare services
Seven outside-party complaints concerning patient-data handling were received. None was recognized as legitimate after investigation, and no complaints were received from regulatory bodies.
The organization therefore identified no substantiated complaints.
Separately, two losses of customer data were identified and reported under Disclosure 418-1(b).
Synthetic LRA illustration. Replace every figure and fact with the reporting organisation's evidence.
Illustrative treatment — Regulatory complaint
A data-protection authority issued a written statement identifying a breach of customer privacy. The complaint was reported in the regulatory-body category without waiting for the organization to mark it as upheld.
Synthetic LRA illustration. Replace every figure and fact with the reporting organisation's evidence.
Illustrative treatment — One incident, several complaints
One customer-data leak caused 14 separate substantiated customer complaints. The organization reported 14 complaints under 418-1(a) and one data leak under 418-1(b).
Synthetic LRA illustration. Replace every figure and fact with the reporting organisation's evidence.
Real reports
How 3 companies report it
Examples of full and partial reporting practice. These are evidence-led reviews, not exact disclosure templates to copy.
Transportadora de Gas Internacional S.A. E.S.P.
Review finding
TGI’s Integrated Sustainability Report 2025 contains a dedicated GRI 418-1 table that follows the required structure:
- complaints received from outside parties and substantiated by the organization
- complaints from regulatory authorities
- identified leaks, thefts or losses of customer data
View full reviewHide full review
LRA review note
The current card should:
- use the substantive GRI 418-1 table on report page 158 as the principal evidence
- present the exact 2025 values for all three required rows
- distinguish current-year values from the comparative figures
- remove the 202 ethics and compliance activities from the GRI 418-1 assessment
- remove Scope 3 Category 4 emissions
- remove flaring, fugitive-emissions, venting and pneumatic-source information
- assess whether the report indicates a substantial connection to preceding-year events
- classify the disclosure based only on the privacy-complaint and customer-data rows
Disclosure gap
The report extract shows the required GRI categories and a non-zero customer-data incident result; unrelated emissions and compliance-activity data do not contribute to Disclosure 418-1.
Bottom line
The official report search extract identifies the outside-party, regulator and customer-data rows.
O-Bank Co., Ltd.
Review finding
O-Bank’s report contains information that needs reconciliation.
View full reviewHide full review
Assessment
The GRI content-index section states that no substantiated complaints concerning breaches of customer privacy or losses of customer data were received. Elsewhere, the report discloses two data breaches and states that 100% were personal-data breaches affecting account holders.
LRA review note
The card should:
- retain the zero substantiated-complaints statement for Disclosure 418-1(a), subject to verifying both required complaint-source categories
- not treat the zero-complaints statement automatically as zero customer-data incidents
- identify whether the two personal-data breaches were leaks, thefts or losses of customer data under GRI 418-1(b)
- reconcile pages 311 and 313
- report the customer-data incident total separately
- retain affected account holders only as supplementary context
- remove the absence of monetary legal losses as a gap
- classify the disclosure as internally inconsistent or requiring reconciliation until the two breach records are resolved
Bottom line
The current LRA card itself records both the zero statement and the two personal-data breaches, but focuses incorrectly on monetary losses.
First Financial Holding Co., Ltd.
Review finding
First Financial Holding’s 2024 Sustainability Report provides quantitative information relevant to GRI 418-1.
View full reviewHide full review
Assessment
The report identifies one data breach, indicates that it was a personal-data breach and reports 592 affected account holders. It also contains a GRI 418-1 table with numeric complaint and customer-data values.
LRA review note
The card should:
- use report page 232 as the principal source for the GRI 418-1 complaint and customer-data figures
- verify that outside-party and regulatory-body complaints are shown separately
- use pages 218 and 226 only as supporting context for the data breach and affected-account count
- report one identified data incident only if the incident meets the leak, theft or loss definition used for GRI 418-1(b)
- retain 592 affected account holders as supplementary context
- remove financial losses from litigation exceeding NT$5 million
- remove whistleblowing-report discussion
- remove supplier-category information
- classify the report based on the exact GRI 418-1 table and its reconciliation to the reported breach
Bottom line
The official report source maps information security and privacy protection to GRI 418-1, while the current card introduces unrelated litigation, whistleblowing and supplier information.
Ask the Knowledge Hub AI Assistant about this disclosure
Get practical answers for your reporting context.
Check your text
Paste one or two paragraphs. The fragment is used for this check only and is not stored in your conversation.
Peer comparison uses examples on this card, not prevalence in the report corpus.
Advice, not assurance
Framework references
Relevant GRI requirements and related disclosures
GRI
GRI 418-1
within GRI 418: Customer Privacy
Related & explore
More in GRI 418 →Browse full catalogue →Search all disclosures →