Customer Data Request Handling Checklist

Before you start

Under the Privacy Act, individuals may have rights to access and correct personal information a business holds about them, including in a debt context. When a request arrives, treat it seriously even if it comes mid-dispute. Before responding, confirm exactly what is being asked and what personal information you actually hold.

• Identify whether the request is for access, correction, or both.
• Confirm the requester is the person the information is about.
• Map where the relevant personal information is stored.
• Note any information that may be subject to limits on disclosure.

This is general information only and not legal advice. Access and correction obligations have exceptions and timeframes — get professional advice on how the rules apply to your business.

Verify and locate

1. Verify the requester's identity before disclosing any personal information.
2. Clarify the scope if the request is vague or very broad.
3. Search your systems, including emails and any collection records, for relevant data.
4. Separate the requester's own personal information from third parties' information.
5. Identify anything that may fall within an exception to disclosure.

Verifying identity first prevents you from handing personal information to the wrong person, which would be its own privacy breach. Take care to separate out information about other people that should not be disclosed.

Respond and record

1. Decide what you can provide and the form in which to provide it.
2. If you withhold anything, understand the basis before doing so.
3. For a correction request, amend accurate-but-wrong details or note the disagreement.
4. Respond within a reasonable time, consistent with the rules.
5. Keep a record of the request, what you searched, and what you provided.

A timely, documented response both meets your obligations and protects you if the handling is later questioned. If you are unsure whether an exception applies, get advice rather than guessing in either direction.

Common mistakes

• Disclosing information without first verifying the requester's identity.
• Releasing third parties' personal information along with the requester's.
• Ignoring or sitting on the request, especially during a dispute.
• Withholding information without understanding the proper basis.
• Keeping no record of how the request was handled.

If a data request arrives alongside a payment dispute, keep the recovery side moving too — a free debt appraisal can help you handle the debt while you respond to the request.