Under Canadian privacy law, people have the right to ask what personal information an organization holds about them, how it has been used and to whom it has been disclosed. These requests — often called access requests or DSARs (data subject access requests) — are becoming more common as people become more privacy-aware. A simple, repeatable process turns them from a scramble into routine.
Response deadlines by jurisdiction
| Law | Deadline |
|---|---|
| PIPEDA (federal) | 30 days; may be extended by up to 30 more days with written notice and reasons |
| Quebec private-sector act | 30 days |
| Alberta PIPA | 45 days |
| BC PIPA | 30 business days |
The clock usually starts when you receive the request, so log the date immediately.
Step 1: Make requests easy to submit
- Publish a contact point in your privacy policy — a dedicated email address or web form works well.
- Train front-line staff to recognize a request even if it doesn’t use legal language (“Can you tell me what you have on file about me?”).
Step 2: Verify identity — proportionately
You must not disclose personal information to the wrong person, but verification should be proportionate. Ask for the minimum needed, for example confirming account details or responding from the email address on file. Avoid requesting copies of government ID unless the sensitivity of the data justifies it.
Step 3: Search all your systems
This is where a data map pays off. Check your CRM, email inbox and archives, support tickets, billing and accounting tools, marketing platforms, shared drives, spreadsheets and backups that are reasonably accessible.
Step 4: Review before releasing
Some information may need to be withheld or redacted, for example:
- Information about other individuals (unless they consent or it can be severed).
- Information protected by solicitor-client privilege.
- Confidential commercial information, where it can be separated from the requester’s information.
Withhold only what the law permits, release the rest, and explain any refusal in writing with the reason and the person’s right to complain to the privacy commissioner.
Step 5: Respond clearly
Provide the information in a form the person can understand — explain internal codes and abbreviations. Under PIPEDA access should be at minimal or no cost, and you must tell the person the approximate cost in advance if you intend to charge.
A response typically includes:
- The personal information you hold, or copies of it.
- How it has been used.
- The third parties to which it has been disclosed (or the types of organizations, where a precise list is not possible).
- How to request a correction.
Step 6: Handle corrections and keep records
If someone shows that their information is inaccurate or incomplete, correct it and, where appropriate, inform third parties that received it. If you disagree, record the person’s challenge. Keep a log of every request, the dates, what was provided and any exemptions applied.
Response template
Dear [Name],
Thank you for your request dated [date] for access to your personal information. We have verified your identity and searched our records. Attached is the personal information we hold about you, along with a description of how it is used and the organizations to which it has been disclosed. [If applicable: Some information has been withheld because (reason), as permitted under (law).] If you believe any information is inaccurate, please contact us at [contact] and we will review it. If you are not satisfied with our response, you may contact the [Office of the Privacy Commissioner of Canada / relevant provincial commissioner].
Sincerely, [Privacy officer]
Make it scalable
As your business grows, a self-service portal where customers can view and manage their own data and consent settings can reduce the volume of manual requests and strengthen trust. Quebec’s Law 25 also adds a right to data portability, so it pays to keep data exportable in a structured format.
Access is one of the 10 principles in our PIPEDA compliance checklist.
Frequently asked questions
Can I refuse a request that seems excessive?
Refusals are only permitted on specific grounds set out in the law. If a request is broad, you can ask the person to help you narrow it — but you cannot simply ignore it.
Do I have to include data from emails?
Yes, if those emails contain the requester’s personal information and are reasonably retrievable.
Get a second pair of eyes
Secure Pathways helps small and mid-sized businesses turn privacy requirements into a clear, manageable routine — from privacy audits and policy templates to consent management and breach readiness. If you are not sure where you stand on access requests, get in touch for a complimentary consultation.
This article is general information, not legal advice. Privacy rules change and depend on your industry and province — confirm your obligations with a qualified professional.
