What to do when an organization's privacy officer reaches out, whether about a breach, an access request, or a complaint.
This page provides legal information, not legal advice. Consult a qualified privacy lawyer or CIPP/C-accredited privacy professional before taking action on access requests, breach response, complaints to a Privacy Commissioner, or Federal Court applications.
Last verified: September 2026
TL;DR
Privacy officers contact individuals for many reasons: to respond to a request, to notify a breach, to propose a settlement of a complaint, or to seek consent for a new use. Written communication creates the record that any later complaint relies on, and a person is not obliged to withdraw a complaint or consent to a new use during that conversation.
Why a privacy officer might contact you
Common reasons:
To confirm your identity for an access or correction request.
To follow up on a privacy complaint you filed.
To notify you of a data breach affecting your information.
To request additional consent for a new use of your information.
What usually protects the individual's position
Communication in writing, or in a way that creates a record.
Clarifying details obtained before any substantive response.
A request to withdraw a complaint put in writing with reasons, so the consequences can be weighed.
A proposed new use of personal information reviewed against the alternatives before consent is given.
If the conversation is unproductive
You can escalate to the applicable privacy commissioner at any time. Filing a complaint does not require you to speak with the organization beyond what privacy law requires.