Requesting your personal data: access rights and forty days

Current protections and scope

The Personal Data (Privacy) Ordinance lets an individual ask whether an organisation holds their personal data and obtain a copy. The right concerns personal data, not necessarily every complete document mentioning the person. The organisation need not create information it does not hold, while third-party data and statutory exemptions can affect disclosure.

The general response period is forty calendar days after receipt of a complete request, not forty working days. Scope or identity may need clarification first. Fees must not be excessive and should relate to direct, necessary compliance costs. Refusal or incomplete compliance has notification requirements rather than a blanket explanation that privacy prevents any response.

Act in order: evidence and assistance

1. Identify the data user and official privacy contact and obtain the current PCPD OPS003 form. Specify data categories, the relevant account or event and the period so the organisation can locate them. Send each request to the appropriate organisation rather than forwarding all company requests to the Commissioner.
2. Provide reasonable identity or representation evidence through a secure official channel, retaining the completed request and delivery date. Helping a relative does not automatically grant access; explain the authorisation or legal representative status. Do not send identity documents through an unidentified intermediary merely promising faster access.
3. Respond promptly to necessary clarification and ask for the calculation and payment arrangement if a fee is proposed. Record the completed request, additional information and payment separately so the forty-day requirements can be assessed under the law, rather than counting solely from a first vague email.
4. On receipt, check scope, intelligibility and any refusal reasons, asking about specific omissions. For delay, excessive fees or an apparently unjustified refusal, take the form, delivery proof and correspondence to PCPD for enquiry or complaint. Correction of inaccurate data has its own applicable procedure.

Common misunderstandings

Identity verification can be appropriate, especially for financial, medical or employment data, and the verification material should be handled appropriately. Redaction may address third-party information, so a refusal of everything is not necessarily inevitable. Ask for the actual basis rather than assuming all omissions have the same justification.

A data access request is not a substitute for litigation discovery or a universal mechanism to delete all records. Protect the sensitive copies obtained rather than posting them online. If using them in another claim, consider that proceeding's evidence and procedural requirements separately.

Turn the problem into a usable record

For example, identify your employee number and dates when requesting attendance and existing appraisal data from a former employer. That is more workable than demanding all company documents. A request for reasons for dismissal cannot require the organisation to create a new explanation if no such personal-data record exists.