What do I do if we don’t have the information someone has requested?

If you receive a request for information which you don’t hold, the first thing to consider is whether you do know who has the information. If you know the information is held by another organisation, you should consider whether it would be appropriate to transfer the request to that organisation. If you transfer the request, you need to do so promptly (within 10 days of receiving it). However, you shouldn’t transfer a request if you know the individual wouldn’t want you to.

If you don’t know who has the information, then you will just need to let the individual know that you don’t have their information within 20 working days.

However, you should also keep in mind that if you don’t have, or can’t find, personal information which you should actually hold, for whatever reason, this may be in breach of your obligation to take reasonable steps to keep personal information secure(external link). You also need to search thoroughly and check all reasonable possibilities of where the information might be, before you refuse on this basis.

If you discover that information is lost or missing, you should assess whether this is a notifiable privacy breach(external link). Under the Privacy Act, there is an obligation to report a serious privacy breach to the Privacy Commissioner, and to the individuals affected (unless an exception applies). This includes accidental loss or destruction of personal information.

Updated September 2024