Log the arrival date, the employing entity, the likely jurisdiction, and the requested records before you choose a response deadline.
Key takeaways for personal information access request jurisdiction deadline
- Verify jurisdiction before applying deadlines. Do not assume a single response time fits every location. Check the specific privacy law governing the employing entity before committing to a timeline.
- Understand Canadian scope limits. The 30-calendar-day access standard applies to organizations under the Office of the Privacy Commissioner of Canada, but PIPEDA’s employee and applicant rules cover only federally regulated organizations.
- Distinguish between fixed and flexible periods. Some jurisdictions use specific calendar-day counts, while others rely on "reasonable" periods. Confirm whether your local guidance mandates a fixed number of days or a reasonable period.
- Record the request immediately. Log the arrival date, the specific records requested, and the employing entity. This creates a clear audit trail and helps you identify which privacy office’s guidance applies to the applicant's situation.
- Avoid automatic disclosure of third-party data. An applicant's request typically covers their own personal information. Do not disclose information about other individuals without verifying the specific legal rights and consent requirements for that jurisdiction.
Record the request and check jurisdiction before choosing a deadline
Log the exact date the request arrived, the specific legal entity employing the applicant, the suspected jurisdiction, and the list of records requested. Do not assume a single deadline applies across all regions. The Information Commissioner's Office instructs that to calculate a month, you must start from the actual date you receive the request, fee or other requested information and count forward to the end of the same date in the following month, according to Information Commissioner's Office. This calculation method is specific to the UK guidance provided. Verify the jurisdiction before applying any timeline. If the applicant is located in a different country, the UK rule does not automatically apply. Record the details in your intake log immediately. Identify the correct privacy office for the applicant's location. Use the specific publisher row for that jurisdiction to determine the scope and deadline questions. Do not disclose information about another person without verification. Check if the request falls under federal or local regulations. Note any potential exemptions that might limit access. When the records are medical, read medical record checks. Keep the intake record separate from the hiring file initially. See hiring decision notes. Confirm the identity of the requester before proceeding. Assign the request to the appropriate team member for review. Ensure the response aligns with the specific guidance of the relevant privacy office.
Read the UK calendar-month rule without making it a universal clock
According to the Information Commissioner's Office, a request received on 31 January will run until the end of 28 February, or 29 February in a leap year. Because 31 January does not exist in February, that example is not a general end-of-month deadline, and the February date does depend on the length of the month. You cannot apply this January-to-February example as a universal 28-day clock for every request, because the deadline shifts with the calendar.
If your internal systems require a consistent number of days for operational purposes, the Information Commissioner's Office suggests you could adopt a 28-day period to ensure compliance within a calendar month. This is an operational choice for system consistency, not a change to the legal calendar-month requirement. Using a 28-day internal target helps you meet the deadline in any month, but the legal standard remains the calendar month. Do not treat the 28-day period as the statutory deadline itself; it is a recommended internal buffer for operational simplicity.
The deadline can pause if you need to ask the requester for clarification. According to the Information Commissioner's Office, if you ask for clarification, the time limit pauses on the day you request clarification and resumes on the day after you receive it. The clock does not pause automatically; it stops specifically on the day of the clarification request and restarts the day after the response is received. Record the date you sent the clarification request and the date you received the answer to calculate the remaining time accurately. This pause is what the UK Information Commissioner's Office guidance states.
Check Canada’s employment scope before using its access deadlines
Before applying any Canadian deadline to an applicant's request, verify that the employing entity falls within the scope of the regulations cited by the Office of the Privacy Commissioner of Canada. Confirming this regulatory boundary is the first step in routing the request correctly.
According to the Office of the Privacy Commissioner of Canada, if the organization does not have the requested personal information, it must advise the individual of that fact within 30 days. This 30-day window is a specific requirement for notifying the requester when records are absent, not a general deadline for providing all existing data. Record this distinction in your intake log to avoid conflating a "no record" notice with a full data disclosure timeline.
When an organization requires more time to process a request, the rules are strict about how that delay is communicated. According to the Office of the Privacy Commissioner of Canada, there are some very specific circumstances under which the organization may require an extension of up to 30 additional days. This extension is not automatic and applies only in defined situations. Do not assume that every complex request qualifies for this extra time; the burden is on the organization to determine if the circumstances meet the specific criteria outlined in the guidance.
Filled reference table of four privacy offices’ access guidance
The following table summarizes the access standards provided by four distinct privacy authorities. Each row cites the specific guidance and source URL for that jurisdiction. Note that applicability to any other jurisdiction is UNKNOWN.
| Publisher | Jurisdiction | Access Deadline or Standard | Source URL |
|---|---|---|---|
| Information Commissioner's Office | UK | To calculate a month, you must start from the actual date you receive the request, fee or other requested information and count forward to the end of the same date in the following month. | Information Commissioner's Office |
| Office of the Privacy Commissioner of Canada | Canada | The organization is supposed to give you access to your personal information within 30 calendar days. | Office of the Privacy Commissioner of Canada |
| Office of the Australian Information Commissioner | Australia | An organisation must respond to a request for access to personal information within a reasonable period. | Office of the Australian Information Commissioner |
| Office of the Privacy Commissioner of New Zealand | New Zealand | Generally, an organisation must provide access to the personal information it holds about someone if the person in question asks to see it. | Office of the Privacy Commissioner of New Zealand |
Use the specific row matching your applicant's location to identify the required scope and deadline questions before routing the request.
Separate Australian applicant records from employee exemptions
Australia does not impose a fixed statutory 30-day rule for every private employer regarding access requests. The Office of the Australian Information Commissioner states, "We think 30 days is a reasonable period," according to Office of the Australian Information Commissioner. This guidance appears in the "Access your personal information" section of their site. It serves as a benchmark for what constitutes a reasonable timeframe, but it is not a universal deadline that applies identically to all organizations or contexts. When an applicant submits a request, recognize that this is guidance rather than a rigid legal mandate for every scenario.
If you refuse access to personal information under Australian privacy law, specific notification requirements apply. The Office of the Australian Information Commissioner notes, "Generally, if an organisation or agency refuses you access to your personal information under Australian privacy law, they must tell you in writing their reasons for refusing and how you can make a complaint," according to Office of the Australian Information Commissioner. This written notice requirement ensures transparency when access is denied. You must document the reasons for refusal and provide the applicant with information on how to lodge a complaint. This step is critical for maintaining compliance and demonstrating that your decision-making process was transparent and fair.
Check who is asking before disclosure
Use this intake note to record the core details of an applicant's request before routing it for review. The goal is to capture the specific jurisdiction and scope questions that determine which privacy rules apply, rather than assuming a single deadline fits every situation. According to the Office of the Privacy Commissioner of New Zealand, an organisation must generally provide access to personal information it holds if the person in question asks to see it. This general rule highlights the need to identify who is asking and what information is held before taking action. Do not disclose information about another person without verifying the requester’s authority and the specific jurisdiction’s requirements.
Illustrative example: day 30
An employer logs 1 request on day 1. Where the matching row uses 30 calendar days, day 30 is the illustrative access point. If the records are absent, day 30 is also the illustrative point for saying so. An illustrative extension is 30 additional days only where that rule allows the extra time.
Take the next step today
Today, log the arrival date, employing entity, likely jurisdiction, and requested records, then read the matching table row.
Applicant data access FAQ
Is a UK calendar month always 30 days?
No, a UK calendar month is not fixed at 30 days. It is calculated as the end of the same date in the following month, which can result in 28, 29, 30, or 31 days depending on the specific dates involved.
When can the UK clarification request pause the clock?
The time limit pauses on the day a clarification is requested. It resumes the day after the requested clarification is received.
Does PIPEDA cover every Canadian employer’s applicant records?
No, PIPEDA does not cover every Canadian employer. It applies only to federally regulated organizations for employee and applicant information.
Does Australia’s employee-record exemption cover unsuccessful applicants?
No, the exemption does not apply to the collection of personal information about prospective employees who are subsequently not employed, such as unsuccessful job applicants.
Can someone request another person’s information under New Zealand’s rule?
No, the Privacy Act does not allow you to request information about another person. This is unless you are acting on that person’s behalf and have written permission. In some situations, an organisation may have good reasons to refuse a request for access to personal information. If an individual concerned is given access to personal information, the individual must be advised that, under IPP 7, the individual may request the correction of that information, according to Office of the Privacy Commissioner of New Zealand.