How long does an organisation have to respond to a Privacy Act request?

The rule

Section 44 of the Privacy Act 2020 says an organisation that receives a request under principle 6 must respond as soon as reasonably practicable, and in any case not later than 20 working days after the day on which the request is received.

The response must tell you whether they hold information about you and, if you asked for it, whether they’ll give you access to some or all of it.

Counting working days

The count starts the day after the request is received. Section 7 of the Act excludes:

• Saturdays and Sundays
• Waitangi Day, Good Friday, Easter Monday, Anzac Day, the Sovereign’s birthday, Matariki and Labour Day
• the following Monday when Waitangi Day or Anzac Day falls on a weekend
• every day from 25 December to 15 January

Regional anniversary days are not excluded.

For example, a request received on Monday 19 October 2026 is due by Tuesday 17 November 2026, because Labour Day (26 October) doesn’t count. A request received on Friday 4 December 2026 is due by Monday 25 January 2027, because the summer period pauses the clock.

Our deadline calculator does this for any date.

Extensions

An organisation can extend the time limit in some situations, such as a request for a large amount of information, or one that needs consultation. It must tell you within the original 20 working days, say how long the extension is and why, and tell you that you can complain to the Privacy Commissioner about it.

Urgent requests

You can ask for your request to be treated as urgent, with your reasons, such as a court date or a job offer. The organisation must consider it.

If they miss the deadline

A failure to respond in time is treated as a refusal. You can complain to the Privacy Commissioner. Before you do, a short reminder letter often works; our request letter builder writes one with the correct deadline.