A step-by-step guide to asking a company, government body, or health custodian for the records they hold about you.
TL;DR
A request identifies the requester, describes the records sought, and cites the law that applies. Response times are 30 days under PIPEDA, the Privacy Act, and PHIPA, 30 business days in BC, 45 days under Alberta PIPA, and 45 business days under Ontario FIPPA (requests from July 1, 2026). Fees must be reasonable. A refusal can be the subject of a complaint to the applicable commissioner.
Identify the right organization
Decide whether you are dealing with a business, a government body, or a health custodian, because each is covered by a different statute. Multiple organizations may hold different pieces of your information.
Write the request
A good request includes:
Your full name and contact details.
A clear description of the records you want and the time period.
A reference to the law (e.g., 'I am making this request under PIPEDA').
Proof of identity.
A preferred format (paper, electronic).
Follow up and escalate
A response later than the statutory period is treated as a deemed refusal under most of these laws, which is what a complaint is based on.
If the response is incomplete or refused, ask for written reasons.
If the outcome is unsatisfactory, a complaint can be made to the applicable commissioner.