Contents
Privacy Act 2020 guidelines : Contents

Responding to a request for personal information

When you receive a request for personal information, follow these steps as a guide.

1. Acknowledge the request

  • Let the requester know you have received their request and that it will be responded to within 20 working days from the date they made it. See Time limits relating to requests for personal information.
  • If you're not certain what the request is for, or you think the requester may only want specific things rather than their whole file, have a friendly talk to the them to see if they can explain what they want, so we can help them better. Remember though that people are entitled to ask for their whole file if they want to. Make sure you remain helpful and co-operative.
  • If access to the information requested is restricted to another Ministry of Social Development business unit, you may need to ask that unit to send the information to the requester directly.

For guidance on refusing a request if the information does not exist or cannot be found; or transferring a request to another agency if the information is not held by MSD, see:

2. Gather the information

Check everywhere in the Ministry that has information about the requester within the scope of the request. If they are requesting all information held by the Ministry, you must gather all information the Ministry holds about them. Download it, or copy it into a format that will allow you to assess it and withhold any part of it, if required.

3. Assess the information

Generally, the requester will be entitled to access their information. But there are good reasons for withholding information, which we need to consider. For guidance on grounds for withholding information, see Reasons for withholding personal information.

4. Check the information

Carefully check the copy of information that you propose to send to the requester, to make sure you do not release information that the Ministry should withhold (for instance, information about another person where releasing it would breach that person's privacy).

5. Release the information

Send the information with a response letter to the requester. Make sure it is sent safely so that only the requester will see it. The response letter should set out:

  • the date the request was made and what was requested
  • what information you have provided
  • what information you have withheld and your reasons for withholding it
  • that the requester has a right to complain to the Privacy Commissioner if they are not satisfied with our response

The requester should be positively identified before sending the information, so that we can be sure we are sending it to the correct individual. See:

6. Record the request and file it

Keep a record of all key documents related to the request in a secure location:

  • the request letter/email/note
  • acknowledgement letter, transfer letter, extension letter, or refusal letter
  • copies of the original file without redactions and the file with redactions
  • response letter
  • any other correspondence with the requester

More information

For more information, see:

Legislation

Top