A customer asks what personal information you hold: how to respond

Treat the request as a work item

A customer might write, “What information do you have about me?” rather than cite a legal provision. Log the date, the request, the responsible person and the next response milestone. Do not leave it buried in a salesperson's mailbox. Check the legal framework that applies to your organisation. The OAIC's access guidance is for organisations covered by the Privacy Act; separate rules can apply in particular sectors. If the position is uncertain, resolve that question early rather than assuming a small business has no obligations.

Keep readingCheck what you told people when you collected their details

Confirm identity and clarify scope

Use a proportionate identity check before disclosing information. The OAIC recommends flexibility and says sighting identification is preferable to copying and retaining it. An access process should not build a new archive of identity documents unnecessarily. Ask whether the person wants a particular file, date range or all personal information held. Offer clarification without making it a barrier to the request. Explain the planned delivery method and how to contact the person handling it.

Search a system map, not just the contact card

Create a search checklist that follows how information entered and moved through the business. Record systems searched, identifiers used, dates covered and any gaps needing a second owner.

Do not assume a CRM export includes the email attachment, the earlier spelling of a name or a file stored by a contractor. Check those locations explicitly and keep the search evidence concise.

• Website forms and attachments, including submissions that failed to sync.
• CRM contacts, enquiry notes, tasks and associated communications.
• Shared and individual work mailboxes used for the customer.
• Relevant spreadsheets, document storage and service-provider systems you control.

Review the material before sharing it

A customer file may also contain another person's details, internal identifiers or information subject to a legitimate access exception. Assess those issues against the applicable rules; do not disclose everything automatically or use a blanket refusal because the file is inconvenient to assemble. OAIC guidance says an organisation must respond within a reasonable period, which in most cases should not exceed 30 calendar days. It cannot charge for making the request. A charge for providing access must not be excessive. Decide and communicate any proposed charge before doing chargeable work, with the person's circumstances considered.

Deliver safely and handle corrections

Agree a delivery method appropriate to the sensitivity of the information. Verify the recipient and access permissions, then record what was supplied and when. An unrestricted public file link is a poor default for a private customer file. An access request may reveal an incorrect address or an obsolete note. Treat correction as a separate decision with a clear owner. OAIC guidance provides correction and refusal procedures, including reasonable response timing and no charge for correction. Do not silently rewrite disputed history without considering how the record must be maintained.

Keep readingCheck whether the Privacy Act covers your business

A worked request and a useful first reply

Imagine a former prospect asks for their enquiry information. The CRM contains one contact, but the sales inbox holds two attachments and the form tool has an earlier submission. The owner checks identity, searches all three, reviews third-party details and supplies the appropriate information through an agreed private channel. A useful initial reply is: “We received your request on [date]. [Role/name] is handling it. Please tell us if you mean a particular period or service. We will confirm any identity information needed and how we can provide access securely.” Fill in actual details and follow through; an acknowledgement alone does not complete the request.