# Access and correction request procedure

**[Organisation name]**
Owner: [privacy officer]
Approved: [date]

## 1. Recognise and pass on (all staff, same day)

Any request from a person for information we hold about them, or to correct it, is a request under the Privacy Act, even if it doesn't mention the Act. Forward it to [privacy officer email] on the day you receive it. Don't reply with information yourself.

## 2. Log it (privacy officer, day 0)

- Record it in the request log with the date received.
- Calculate the deadline, which is 20 working days after the day received.
- Acknowledge receipt to the requester and tell them when to expect a response.
- If they've asked for urgency, record their reason and decide whether to treat it as urgent.

## 3. Confirm identity and authority (by day 3)

- Confirm identity in proportion to the sensitivity of the information.
- If someone is asking on another person's behalf, confirm their authority (written consent, power of attorney, parental responsibility for a younger child).

## 4. Clarify if needed (by day 3)

If the request is unclear or very broad, contact the requester to clarify. The clock keeps running.

## 5. Search (by day 10)

Search, and record where you searched, including email, shared drives, [CRM / case management], [Teams / Slack], phone recordings, CCTV, paper files, and suppliers who hold information for us. Ask staff who dealt with the person.

## 6. Decide (by day 15)

- Release information unless a ground in the Privacy Act allows withholding.
- For each withheld item, record the specific ground.
- Redact rather than withhold whole documents where possible. Check redactions can't be reversed.
- For footage or recordings showing other people, consider blurring or viewing in person.
- If an extension is genuinely needed, notify the requester **before day 20**, with the length of extension, the reason, and their right to complain to the Privacy Commissioner.

## 7. Respond (by day 20)

Send a response that:

- states whether we hold information about them
- provides the information being released, securely
- lists what's withheld and the ground for each
- tells them they can complain to the Privacy Commissioner

## 8. Corrections

- Decide whether to correct the information.
- If we correct it, tell the requester, and where practicable tell anyone we disclosed it to.
- If we won't correct it and they ask, attach a statement of the correction sought so it's always read with the information, and tell them.

## 9. Close

Save the request, search record, decision notes, released and redacted copies and the response. Update the log. Report numbers and on-time rates to leadership twice a year.

---
From Faraday, faraday.co.nz/templates/access-request-procedure/ (CC BY 4.0). Checked against New Zealand sources on 19 October 2026. General information, not legal advice.