How should I deal with vague or broad requests for personal information?

There is an obligation on agencies to provide assistance to individuals if they request their personal information (see section 42(external link) of the Privacy Act for further information). So, if you receive a request which is vague or difficult to understand, it’s your job to follow up with the individual to clarify the scope of the request.

Often requests are vague or broad because the individual won’t be aware of or understand what personal information you actually have, so you may be able to assist them by explaining the types of personal information you hold.

While individuals are ultimately entitled to ask for any information you hold about them, we still think it’s best practice to follow up on any broad or vague requests to see if you can clarify or even narrow the scope of the request.

You should keep in mind however that the 20 working day time frame for response begins the day after you receive the request and continues to run during any discussions you may have about the scope of the request.

(Updated November 2020)