Request letter templates
PIPEDA access request template: a letter for Canadians
Quick answer
Copy the letter below, fill in the [brackets] and send it in writing to the organization's privacy officer. PIPEDA lets you find out whether a business holds your personal information, get access to it, and learn how it was used and who it was given to. The organization has 30 days to respond, at minimal or no cost to you, and silence counts as a refusal you can complain about.
All privacy laws“Under PIPEDA, you need to make your access request in writing.”
- Applies in
- Canada (federal private sector)
- Companies must answer within
- No later than 30 days after receipt (PIPEDA s. 8(3)). The organization can extend by up to 30 days, or as long as needed to convert the information into an alternative format, if it tells you within the first 30 days with reasons and your right to complain (s. 8(4)). No answer within the time limit counts as a refusal (s. 8(5)).
- Last updated
Head of Product & Co-Founder
Reviewed by Ludwig Sandgren
Head of Legal
Serus is a privacy company with paid tools to find and remove your personal data. This page is free and based on official sources.
Sources checked: priv.gc.ca, laws-lois.justice.gc.ca
Last verified against the official page:
Anyone whose personal information is held by a private-sector organization covered by PIPEDA. Alberta, British Columbia and Quebec have their own private-sector privacy laws that may apply instead. Federal government institutions fall under a different law, the Privacy Act.
Your rights
-
Right of access
To be told whether an organization holds your personal information and to be given access to it (PIPEDA Schedule 1, clause 4.9).
-
An account of use and disclosure
How your information has been used, and the third parties it has been disclosed to (PIPEDA Schedule 1, clauses 4.9.1 and 4.9.3).
-
Help with the request
An organization must help you prepare your request if you ask (PIPEDA s. 8(2)).
-
A written refusal with reasons
If it refuses, it must tell you in writing, with reasons and the recourse available to you (PIPEDA s. 8(7)).
General information, not legal advice.
How to use it
- 1
Send it in writing to the privacy officer
Use the address the organization designates for access requests or privacy issues, often in the privacy policy at the bottom of its website. Email works. If you need help writing the request, the organization has to assist you.
- 2
Keep the request narrow if you can
A clear request about a specific topic or date range gets a quicker answer, according to the OPC. If you need a format other than paper because of a disability, say so in the request.
- 3
Wait up to 30 days
The organization has 30 calendar days to give you access or tell you it doesn't hold the information, unless it sends you an extension notice within that time. It can only charge a minimal fee, and only if it told you the approximate cost up front and you agreed.
- 4
Check the response
Access doesn't always mean a paper copy: you may be invited to view the records on site. If you find errors, ask for a correction and include evidence. If you and the organization can't agree, you can have your concerns recorded.
- 5
Complain to the OPC
Try to resolve it with the organization first. If that fails, file a complaint with the Office of the Privacy Commissioner of Canada. For a refused access request, including one that simply went unanswered, you have six months from the refusal or the missed deadline. Our PIPEDA page explains the process.
No answer in time? Complain to Office of the Privacy Commissioner of Canada (OPC) .
The letter
Fill in the parts in [brackets] before you send it.
Subject: Access request under PIPEDA [Your full name] [Your address] [Your daytime phone number and/or email address] [Date] To: Privacy Officer, [Organization name] [Address or email designated for access or privacy requests] Dear Privacy Officer, I am requesting access to my personal information under the Personal Information Protection and Electronic Documents Act (PIPEDA), Schedule 1, clause 4.9. Please tell me whether you hold personal information about me and, if you do, give me access to it. I am looking for: [List the information you want. A narrow request, for example "my account records from [date] to [date]" or "notes about my complaint of [date]", gets a quicker answer.] Please also give me: 1. an account of how my personal information has been used; 2. a list of the third parties to which it has been disclosed. To help you identify my records: - Full name: [and any previous names you used with them] - Address: [current, and any previous address they may have] - Account number: [if applicable] Please use these details only to process this request. [If needed: Because of a disability, I need the information in [format].] If there will be any fee, please tell me the approximate cost before you proceed. I understand PIPEDA requires a response within 30 days of receiving this request. If this request has reached the wrong person, please forward it to the person responsible for privacy in your organization. You can contact me at the phone number or email above if you need more information to find my records. Sincerely, [Your name]
What the letter asks for
The letter asks three things: whether the organization holds information about you, for access to it, and for an account of how it was used and who it went to. The last part is easy to leave out, and it's the most useful if you're trying to trace where your details went.
The identifying details help the organization find your file. PIPEDA says information you give to make an access request can only be used for that purpose, so a daytime phone number or email for questions is fine to include.
Access first, deletion after
PIPEDA has no standalone right to be forgotten. Once you know what's held, you can withdraw your consent and point out that information the organization no longer needs should be destroyed, erased or made anonymous. Our guide to removing your personal information in Canada covers that step, and what to do when a company won't delete your account covers pushing back.
Where Serus fits
An access request shows you what one organization holds. Data brokers and people-search sites are many organizations, and most people want their details gone rather than copied back to them. Serus finds the ones that list you where you live, sends the removal requests and follows up when deadlines pass. For one company, this letter does the job. Run a free scan to see where else you're listed.
Data brokers that list people in Canada
Each guide shows how to opt out of that site, step by step.
- Remove yourself from Equifax
- Remove yourself from LiveRamp
- Remove yourself from Verisk
- Remove yourself from LocateFamily.com
- Remove yourself from CallerSmart
- Remove yourself from ZipRecruiter, Inc.
- Remove yourself from Canada Post
- Remove yourself from Experian Marketing Services
Let Serus send the requests for you
Serus finds the data brokers that list you where you live and removes you from them.
Related
Frequently asked
Do I get a paper copy?
Not necessarily. The organization has to give you access, which can mean viewing the material on its premises.
Can I get information about a family member?
Ordinarily no, unless they consent in writing or someone's life, health or security is threatened.
Can the organization withhold information?
Yes, under limited exceptions, for example information about other people, legal privilege, or security or commercial proprietary reasons.
Does PIPEDA apply in Quebec, Alberta and BC?
Those provinces have their own private-sector privacy laws that may apply instead.
Sources
Something wrong or out of date? Tell us and we'll re-check it.