How long do I have to respond to a privacy access request in Canada?

Access requests used to be rare for startups. They’re now common, often arriving through support tickets, sometimes from former users or during disputes.

What are the deadlines?

Law	Deadline	Extension
PIPEDA	30 days after receiving the request	Up to 30 more days if meeting the deadline would unreasonably interfere with your activities or consultations make it impracticable; longer if needed to convert information into an alternative format for a person with a sensory disability. You must notify the person within the original 30 days, with reasons and their right to complain
Quebec private sector law	30 days (s. 32)	No extension you can give yourself, unlike PIPEDA. A late response is deemed a refusal. If requests are clearly abusive, you can apply to the Commission d’accès à l’information for relief (s. 46)
PHIPA (Ontario health custodians)	30 days (s. 54)	Up to 30 more days in some circumstances, with written notice to the person. See privacy for wellness clinics

Under PIPEDA, if you don’t respond within the deadline, you’re deemed to have refused the request, and the person can complain to the Privacy Commissioner.

What do I have to give them?

Their personal information under your control, an account of how it has been used, and the third parties it has been disclosed to, in a form they can understand. You must help people who need assistance making a request. PIPEDA requires the request to be in writing, which includes email and support tickets.

Can I charge a fee?

Under PIPEDA, only a minimal cost, and only if you tell the person the approximate cost first and they confirm they still want to proceed. Most startups don’t charge.

Can I refuse?

Sometimes. PIPEDA’s section 9 lists cases where you must or may refuse, such as when disclosure would reveal another person’s personal information (which you should sever if you can), information protected by solicitor-client privilege, or confidential commercial information. Explain any refusal in writing.

How do I verify identity?

Ask for enough to confirm the person is who they say they are, such as access to the account email, without collecting more sensitive information than you need. Don’t release information to someone you can’t verify.

What about data portability?

Since September 22, 2024, Quebec’s section 27 gives people the right to have computerized personal information they provided returned in a structured, commonly used technological format, or sent to someone they name. See Quebec’s Law 25 for SaaS.

What if I’m processing data for a business customer?

Pass the request to your customer, which controls the data, and help it respond. Your data processing agreement should say so.

How should I prepare?

Name a privacy contact, write a short internal procedure, and know how to export a user’s data from each system. We prepare privacy policies that explain how to make a request, at fixed fees on our fees page.

This guide is general information about Ontario and Canadian law, not legal advice for your situation. If a request has arrived and you’re unsure how to answer, book a free 15-minute consult.