Access request and records search support

Every Canadian privacy regime gives individuals a right to see the personal information an organization holds about them. Under PIPEDA's individual access principle, a person can ask whether you hold personal information about them, how it has been used and to whom it has been disclosed, and get access to it, subject to limited exceptions. BC and Alberta's private-sector laws and Quebec's private-sector law give similar rights, and Ontario's PHIPA gives patients a right of access to their health records.

Requests often arrive in the middle of a dispute: an employee who has just been terminated, a customer with a complaint, a patient considering a claim. That makes them sensitive. The response has to be complete and on time, and must not disclose other people's information or privileged material.

If you miss the deadline under PIPEDA without a valid extension, the request can be deemed refused, which opens the door to a complaint. Plan the search in the first few days, not the last.

A person's information rarely sits in one place. It is in email threads, Teams chats, shared files, CRM notes, HR and payroll systems, ticketing tools and backups. We search each source using defensible methods so you can show the search was reasonable:

1. 01

   Scope

   Confirm the requester's identity, names, email addresses, phone numbers, employee or account IDs, and the date range.

2. 02

   Microsoft 365

   Use Microsoft Purview eDiscovery searches across Exchange mailboxes, OneDrive, SharePoint and Teams, with holds where needed so content isn't deleted mid-request.

3. 03

   Google Workspace

   Use Google Vault searches and exports across Gmail, Drive and Chat where Vault is licensed.

4. 04

   Business systems

   Run reports or exports from CRM, HR, payroll, practice management and ticketing systems, working with the system owners.

5. 05

   De-duplicate and organize

   Remove duplicates, thread conversations and organize results for review.

6. 06

   Log everything

   Record sources searched, terms used, dates and result counts.

Most records about one person also contain information about others: colleagues in an email chain, other customers in a spreadsheet, a manager's notes. Privacy laws generally require you to protect third-party personal information when responding, and there may be other grounds to withhold material, such as solicitor-client privilege or information generated in a formal dispute resolution process. Those are legal decisions.

Our role is to make that review efficient. We prepare the collection in a review platform or structured export, flag documents likely to contain third-party information or privileged communications (for example, messages to or from your lawyers), and apply redactions as directed by your privacy officer or counsel. The final decision on what is released stays with you.

If the requester complains to a privacy commissioner, you will need to show what you did. We deliver a search memo that records the scope, sources, methods, dates, search terms and result counts, plus a record of what was withheld or redacted and on whose instruction. Keep it with the request file. It is also useful if the same person later brings a legal claim and the same information has to be preserved or produced.

• A simple intake form and request log, with deadline tracking.
• A standard list of systems to search, maintained in your data inventory.
• Retention policies applied so you are not searching through data you should have deleted years ago.
• Pre-configured eDiscovery or Vault roles, so the right people can search without broad admin rights.
• Template letters for acknowledgement, extension and response.