Sooner or later a customer or former employee will ask: "What information do you have about me?" If your business is covered by the Privacy Act, you need a plan for that moment before it arrives.
The two rights
- Access (APP 12). A person can ask for the personal information you hold about them, and you generally must provide it unless a specific exception applies.
- Correction (APP 13). If information is inaccurate, out of date, incomplete, irrelevant or misleading, you must take reasonable steps to correct it.
How quickly to respond
The law asks for a response within a reasonable period. OAIC guidance generally treats 30 calendar days as a sensible benchmark, so do not leave a request sitting in an inbox.
A simple process
- Name one person who receives and tracks requests
- Confirm the identity of the person asking before releasing anything
- Search every place data lives: email, CRM, spreadsheets, accounting, paper
- Reply in writing, with the information or the reasons for any refusal
- Log the request and the outcome
If you refuse
You can only refuse on limited grounds. If you do refuse, give written reasons and explain how the person can complain. For corrections you decline, the person can ask you to attach a statement saying the information is disputed.
Make it easy to ask
Your privacy policy should say how to make a request and who to contact. Hiding the contact details is a quick way to turn a simple request into a complaint.
What to do this week
- Check your policy lists a contact for access and correction
- Decide who handles requests, and write down the steps
- Do a trial run: could you find everything held about one customer in a day?
This is general information, not legal advice. If you are unsure how this applies to your business, speak with a qualified privacy lawyer and see the OAIC guidance.