Country-specific guidance Current

PIPEDA client privacy requests: how and when to respond

A client's request for their own information has a real deadline, not just a general expectation.

When a client asks what personal information your firm holds about them, PIPEDA sets specific rules for how and when you must respond. This guide sets out those rules. It is general information, not legal or privacy advice.

Action plan

1 Respond within 30 calendar days as the default The 30-day clock starts from receipt, and an acknowledgement alone doesn't stop it.

The Office of the Privacy Commissioner of Canada's guidance sets the default response timeframe at 30 calendar days from receiving the request. A simple acknowledgement that the request was received isn't itself a response -- the substantive reply needs to land within that window.

  • Log the exact date a client's information request was received
  • Track the 30-calendar-day deadline from that date
  • Treat an acknowledgement of receipt as separate from the substantive response

Done when: The client's request was logged with its received date and a substantive response was tracked against the 30-day deadline

OPC Canada: responding to access requests under PIPEDA
2 Extend by up to 30 more days only for a genuine, specific reason An extension isn't a default buffer -- it applies only where a specific condition is met, and you must tell the client.

OPC guidance allows an extension of up to 30 additional days only where responding within the original 30 days would unreasonably interfere with your firm's activities, would require consultations that make the original deadline impracticable, or where converting the information to an alternate format would take significant time. If your firm extends, it must notify the client within the original 30 days, explain why, and advise them of their right to complain to the Privacy Commissioner.

  • Only extend where one of OPC's specific conditions genuinely applies
  • Notify the client of any extension within the original 30-day window, not after it
  • Tell the client the reason for the extension and their right to complain to the Privacy Commissioner

Done when: Any extension applied a genuine OPC-recognised reason and was communicated to the client within the original 30 days

OPC Canada: responding to access requests under PIPEDA
3 Cover what the response itself must include A bare list of data isn't a complete response -- PIPEDA expects specific context alongside it.

OPC guidance describes a complete response as confirming whether the requested personal information exists, explaining how it has been used, and listing any organisations to which it has been disclosed. Where any part of the request is refused, the response should explain the reasons and tell the client about their right to complain to the Privacy Commissioner.

  • Confirm whether the requested personal information exists
  • Explain how the information has been used and disclosed, including to whom
  • If any part is refused, give the reasons and the client's right to complain to the Privacy Commissioner

Done when: The response confirms existence, explains use and disclosure, and (if applicable) gives reasons for any refusal plus the complaint right