- Download the Part X guide
- Terms used in this guide
- Does Part X of the CYFSA apply to you?
- Collection, use, and disclosure of personal information
Consent and capacity
- Elements of consent
- Consent may be implied in some cases
- Consent may be written or verbal
- Presumption of consent’s validity
- Conditional consent and withdrawal of consent
- Capacity to consent
- Substitute decision-makers
- Safeguarding and managing personal information
Access to records of personal information
- Individual’s right of access
- Access exceptions
- Is the record dedicated primarily to the provision of service to the individual?
- How are access requests made?
- Service provider’s response to access requests
- Substitute decision-makers can request access
- Correction of records
- Offences and immunity
- The role of the Information and Privacy Commissioner
Service provider’s response to access requests
You must respond to an access request as soon as possible and no later than 30 calendar days after receiving the request.
When you receive an access request, you must conduct a reasonable search to locate the responsive record(s). A reasonable search means an experienced employee made a reasonable effort to locate the records. For more information on how to conduct a reasonable search see our fact sheet on this topic.
You must respond to an access request as soon as possible and no later than 30 calendar days after receiving the request.100 A service provider that does not respond within 30 days is deemed to have refused the request.101 The individual may then make a complaint to the IPC.102
In some cases, an individual may request expedited access – for example, they may explain that they need the information within two weeks to meet an application deadline for a specific program or service. If you are satisfied with the evidence that they require access in an expedited period, you must provide access within that period, if you are reasonably able to do so.103
Outside of expedited access requests, your response is due within 30 calendar days. The response must do one or more of the following:
- grant access to some or all of the requested information
- refuse or decline access to some or all of the information, with a written explanation
- extend the deadline for fully responding by up to 90 days, with a written explanation These responses are not mutually exclusive. For example, your response might grant access to some information, while refusing access to other information.