How do I deal with an individual’s request for their personal information?

There are a number of steps for you to work through if you’ve received an access request (when someone requests their own personal information):

• The first thing you need to work out is whether you actually have the personal information which has been requested. If you don’t, you may need to transfer or refuse the request.

• Once you’ve established that you do hold the information, the next thing to decide is whether you’re the right agency to make a decision on releasing it. If you know the information is also held by another agency, and have reasonable grounds to think it would be more appropriate for that agency to make a decision on providing the information, it may be appropriate for you to transfer the request to that agency.

• If you hold the information, and haven’t transferred the request to another agency, then you will need to make a decision on the request. Generally this must be done within 20 working days. However, the timeframe could be shorter if the individual has grounds to ask for the information urgently, or longer if you have grounds to seek an extension.

• When you do provide a decision, it must set out whether you agree to release all of the information requested, some of the information, or none of the information.
  
  If you are withholding any or all of the personal information requested, you need to let the individual know which withholding grounds you are relying on to withhold the information. You will also need to let the individual know that they have a right to have your decision reviewed (by making a complaint to us about your response).
  
  If you agree to provide any or all of the personal information requested, you need to let the individual know that they have a right to request correction of the personal information you hold. If you intend to charge the individual for their information, you need to let them know how much the charge will be.

• It’s also important to know that you don’t necessarily have to provide the personal information at the same time you provide the individual with your decision (although this will often be the case). However, if you’ve agreed to provide personal information, but haven’t included the information with your decision, you need to make sure that you do provide it without undue delay – in other words, as soon as you can.