Responding to requests for personal information

Failing to respond properly to access requests is one of the most common causes of complaints to the Privacy Commissioner. It’s also one of the easiest things to get right with a simple process.

Recognise the request

A request doesn’t have to mention the Privacy Act, use a form, or go to the privacy officer. “Can you send me everything you’ve got on me?” in an email to a customer service address is a request. So is a former employee asking for their personnel file, or a customer asking for CCTV footage of an incident. Make sure front-line staff know to pass these on the same day.

Log it and start the clock

Record the date you received it, who asked, what they asked for, and who’s handling it. You must respond as soon as reasonably practicable, and no later than 20 working days after the day you receive it. Working days exclude weekends, public holidays and 25 December to 15 January. Use our deadline calculator.

Within the deadline you must tell the person whether you hold information about them and whether you’ll give access. Respond as soon as you reasonably can. The 20 days is the outer limit.

Check identity

Take reasonable steps to make sure you’re giving information to the right person. Match it to the risk. Confirming an email address on file may be enough for a newsletter history, but for a medical file or HR investigation you’ll want more. Don’t ask for more ID than you need, and don’t keep copies longer than necessary.

If someone asks on behalf of another person, such as a lawyer or family member, check they have authority.

Search properly

Search everywhere the information might be, including email, shared drives, CRM and case systems, messaging apps like Teams or Slack, phone recordings, CCTV, paper files, and suppliers that hold information for you. Ask the people who dealt with the person. Record where you searched.

If the request is very broad, you can ask the person to narrow it, but the clock keeps running while you talk.

Decide what to release

The starting point is to release it. You can withhold information only for reasons listed in the Act. The ones organisations most often rely on:

• releasing it would involve unwarranted disclosure of another person’s affairs
• it’s evaluative material, such as a confidential reference, supplied on the understanding the person’s identity would be kept confidential
• it’s protected by legal professional privilege
• releasing it would be likely to pose a serious threat to someone’s life, health or safety
• the request is frivolous or vexatious, or the information is trivial

Withholding usually applies to specific parts of a document, so release the rest. Redact carefully and check that redactions can’t be undone, for example by copying text from a PDF.

CCTV and recordings often show other people. The Commissioner’s guidance explains options such as blurring others, or letting the person view the footage without taking a copy.

Respond

Your response should say:

• what you hold and what you’re releasing
• what you’ve withheld, and the reason under the Act
• that they have the right to complain to the Privacy Commissioner

Public sector agencies generally can’t charge for access. Private sector agencies can only charge in limited circumstances and the charge must be reasonable. Most don’t.

Extensions

You can extend the time limit in some situations, such as when the request is for a large quantity of information or needs consultation. You must tell the person within the original 20 working days, say how long the extension is and why, and tell them they can complain about it. Don’t use an extension to cover a slow start.

Correction requests

If someone asks you to correct information, decide whether to correct it. If you won’t, and they ask, attach a statement of the correction they sought so it’s read with the information. Tell them what you’ve done. Where practicable, tell anyone you’ve shared the information with about the correction or statement.

Keep a record

Keep the request, your searches, decisions, redacted and released copies, and the response. If the person complains, this is your evidence. Our access request procedure and request log give you the structure.