Access and correction request procedure

How to use this

Adopt this as your internal procedure and make sure front-line staff know step 1. Our guide to responding to requests explains the reasoning behind each step, and the deadline calculator works out the due date.

Access and correction request procedure

[Organisation name] Owner: [privacy officer] Approved: [date]

1. Recognise and pass on (all staff, same day)

Any request from a person for information we hold about them, or to correct it, is a request under the Privacy Act, even if it doesn’t mention the Act. Forward it to [privacy officer email] on the day you receive it. Don’t reply with information yourself.

2. Log it (privacy officer, day 0)

• Record it in the request log with the date received.
• Calculate the deadline, which is 20 working days after the day received.
• Acknowledge receipt to the requester and tell them when to expect a response.
• If they’ve asked for urgency, record their reason and decide whether to treat it as urgent.

3. Confirm identity and authority (by day 3)

• Confirm identity in proportion to the sensitivity of the information.
• If someone is asking on another person’s behalf, confirm their authority (written consent, power of attorney, parental responsibility for a younger child).

4. Clarify if needed (by day 3)

If the request is unclear or very broad, contact the requester to clarify. The clock keeps running.

5. Search (by day 10)

Search, and record where you searched, including email, shared drives, [CRM / case management], [Teams / Slack], phone recordings, CCTV, paper files, and suppliers who hold information for us. Ask staff who dealt with the person.

6. Decide (by day 15)

• Release information unless a ground in the Privacy Act allows withholding.
• For each withheld item, record the specific ground.
• Redact rather than withhold whole documents where possible. Check redactions can’t be reversed.
• For footage or recordings showing other people, consider blurring or viewing in person.
• If an extension is genuinely needed, notify the requester before day 20, with the length of extension, the reason, and their right to complain to the Privacy Commissioner.

7. Respond (by day 20)

Send a response that:

• states whether we hold information about them
• provides the information being released, securely
• lists what’s withheld and the ground for each
• tells them they can complain to the Privacy Commissioner

8. Corrections

• Decide whether to correct the information.
• If we correct it, tell the requester, and where practicable tell anyone we disclosed it to.
• If we won’t correct it and they ask, attach a statement of the correction sought so it’s always read with the information, and tell them.

9. Close

Save the request, search record, decision notes, released and redacted copies and the response. Update the log. Report numbers and on-time rates to leadership twice a year.