Organizations can struggle with personal data access requests when reception, departments and record owners handle them separately. They may be unable to reconstruct when a request arrived, whether identity was verified, what was searched, or who approved the response. A request concerns the individual's personal data; it does not automatically entitle them to an entire company file. A single status log can connect intake, verification, searches, redactions and response evidence. This article summarizes PCPD guidance; check the applicable guidance for each case.
How Should You Identify a Data Access Request?
Do not rely on the subject line or form name alone. Route any message asking an organization to confirm whether it holds someone's personal data, or to provide a copy, to a designated intake contact. Examples include a former applicant asking for interview assessment notes or a customer requesting records of transactions on their account. A company registration certificate, an entire customer file, a colleague's records or public documents may fall outside this right. Separate each requested item instead of treating the message as one document-delivery task.
The recipient need not make a legal determination. Preserve the original message, attachments and intake channel, then write a neutral summary: who is asking, whose data is sought, which categories are involved, whether the request seeks confirmation or copies, and the approximate period. PCPD's OPS003 form can help define scope. Its guidance lists failure to use the specified form as a possible refusal ground, but a clear and complete request should not be ignored solely because it arrived in another format.
Mark a broad request such as “everything about me” as awaiting clarification. Ask for the data type, period or event. Correspondence, account interactions and the personal part of a performance review may contain personal data; a full contract, company decision rationale or another person's information needs separate consideration. If a complaint also seeks a review of a decision and copies of the individual's records, open the access request separately and handle the business dispute through its existing process.
Who Records the Date of Receipt?
Have the first person who receives the request open the case. Whether it arrives by email, web form, post or forwarded message, create a unique case number that day. Record the actual date and time, channel, sender's contact details, data subject, summary, attachment list and person taking over. Preserve a read-only copy of the original message and attachments, noting any internal referral. The date it reaches the privacy contact is not a substitute for the organization's initial receipt date. If completeness is unclear, record the original date and list the questions to resolve.
Assign one case owner to maintain the main log and a supervisor or privacy contact for escalation. Search teams should update only their assigned entries. Use 40 calendar days from receipt as a monitoring window, with earlier internal reminders for identity checks, clarification, searches, redaction and review. PCPD guidance says that when clarification is needed to make a request complete, the calculation may depend on when the complete request is established. Keep each exchange and the completeness-confirmation date; do not silently alter the intake date. Weekends, holidays or staff leave should not make a case disappear from the list.
Record each handover, including who transferred the case, who accepted it, when, and what happens next. If a request first reaches a general mailbox and is forwarded the next day, log both times and retain evidence of the initial receipt. For password-protected or unreadable attachments, record the issue, when the requester was notified and the interim handling plan.
How Should Identity and Authority Be Verified?
Before searching or disclosing records, confirm that the requester is the data subject or is entitled to act for them. For a request made by the individual, compare the details with reliable records and ask for only the identity evidence reasonably needed. A customer number alone does not prove identity, and collecting excessive identity documents can create unnecessary risk.
For a representative, separately verify the requester's identity, the data subject's identity, and the relationship or basis of authority. Depending on the case, request reasonable supporting material, such as valid authorization. A reviewer should confirm that it covers the relevant person, data categories and scope. In the log, record whether identity is pending or verified, the date and method, who checked it, missing items and the reviewer. Keep identity documents in a restricted location; the main log should contain only a necessary reference or result, not copied identity numbers.
If documents conflict, authority is unclear or the contact channel appears suspicious, pause disclosure and use a verified channel to confirm with the individual. Do not distribute unverified information to search teams. PCPD's form guidance says a data user may request reasonably necessary proof of identity and, for a representative's request, proof of the individual's identity and the representative's authority. If identity cannot reasonably be confirmed, record the specific gap and checks made, then have someone familiar with privacy requirements review the next step. Verification does not mean that every document is genuine or that a full identity document should be kept indefinitely. Where appropriate, check existing records first and avoid asking for sensitive copies again.
Who Is Responsible for Internal Searches?
The case owner should turn the request into searchable tasks and assign each to the department or record owner most likely to hold the information. For recruitment assessments during a stated period, for example, Human Resources might search applications, evaluation records and relevant email, while a system administrator checks the recruitment platform and archived systems. A request for customer-service interactions may require checks by customer service, account management and the owners of relevant systems.
Each task should specify the person's name or identifying details, data categories, date range, likely systems, exclusions and reply date. Ask the department to report where it searched, the search terms or identifiers used, when it searched, the result, any reason records could not be found, an item count or file reference, and whether third-party data appears. A “no results” response should identify the systems and locations checked, who confirmed them, and whether a vendor-held or offline archive remains to be checked. “No reply yet” does not mean “no data.” If access is missing or a system has been migrated, escalate that day and record the expected completion date.
After the searches, a designated reviewer should distinguish the individual's personal data from non-personal information and other people's data. A response may need to provide the requested personal data without providing the entire document that contains it. Assess whether third-party identifying details can be redacted, and keep the reason and approval record. Where a vendor stores records, ask the internal contract or system owner to follow existing arrangements and track the answer, limiting any disclosure to the vendor to what is necessary.
How Should Missing Information or Non-Compliance Be Recorded?
Keep “awaiting information,” “not held,” “partially provided” and “refused” as separate outcomes because each has different facts and next steps. “Awaiting information” means the request may proceed after identity or scope details are supplied. “Not held” should mean the scoped searches are complete and the log identifies where they took place. “Partially provided” means the available portion is ready while a specific part is restricted. A refusal should state the reason, supporting facts, decision-maker and review result. Labels such as “insufficient information” or “privacy issue” are too vague for a colleague to follow or explain.
If evidence of a representative's authority is missing, record what was requested, when the requester was notified, how they can respond and the current status. If the scope is too broad, retain the clarification questions and the date answers arrived. If records contain another person's data, note whether redaction or another handling step would allow disclosure. Where refusing, PCPD guidance requires notice with reasons within 40 days and retention of the refusal reasons for at least four years. If the organization cannot comply within the period, it must explain this in writing within that period and proceed as soon as possible. If considering a compliance fee, document the basis for direct and necessary costs. Keep source facts, the reason applied, the notice copy, sending evidence and review comments in one record trail; use the guidance to assess each case rather than treating a template as the decision.
How Should Response Status Be Tracked?
The log should show at a glance the current stage, what is blocking progress, the next owner and the next date. Possible internal stages are received, identity check, scope clarification, internal search, third-party data review, approval, response pending and closed. These are working labels, not official PCPD statuses. For each change, record the time, person making it, previous and new status, reason, next step and due date. Add a written summary of important calls or verbal confirmations.
| Case field | Example entry |
|---|---|
| Receipt and monitoring | Assume receipt on October 1; provisionally monitor 40 calendar days and set an earlier internal reminder |
| Identity and scope | Identity verified; recruitment assessment records requested; period to be confirmed |
| Search owner | Human Resources: assessment records; system administrator: archived platform |
| Status and next step | Awaiting clarification; owner to ask for the date range by the agreed date |
| Response evidence | Reviewer, sending date, items provided and redaction reasons |
The date and entries above illustrate recordkeeping; they do not determine a case deadline. In daily or weekly reviews, flag cases nearing a deadline, missing identity or scope details, overdue searches, cases without an owner, and responses sent without filed evidence. Give each stalled case one follow-up owner and a specific date. If the organization expects it cannot comply in time, prepare the written explanation and next steps; “referred to legal” does not mean the requester has been answered. At closure, verify the attachment versions, sent content, channel and delivery evidence, then restrict access and handle records under the organization's retention arrangements. A useful first exercise is to assign an intake contact and run a hypothetical request through verification, search and closure to confirm that every reminder and handover has an owner. To learn more about Chan & Chung, visit the English homepage.