Accessing your personal information

Canada’s two federal privacy laws—the Privacy Act, which applies to federal government institutions, and the Personal Information Protection and Electronic Documents Act (PIPEDA), which applies to many private-sector organizations—give people a right to access their personal information held by organizations.

This page offers information to help individuals access their personal information held by businesses or the federal government.

How to access your personal information held by businesses

Canada’s federal private sector privacy law, the Personal Information Protection and Electronic Documents Act (PIPEDA) gives people a general right to access their personal information held by businesses subject to this law.

Please note: Three provinces—Alberta, British Columbia, and Quebec—have adopted private-sector privacy legislation that may apply instead of PIPEDA.  For more information, please see the following document: Overview of privacy legislation in Canada.

How do I ask for my personal information?

You need to put your request to the organization in writing.

Tips:

  • Address your request to the person responsible for privacy compliance within the organization—often called the Privacy Officer—if possible. The organization’s privacy policy should provide this contact information.
  • Provide sufficient information and be as specific as possible, because that will help the organization respond promptly.

What types of personal information can I ask for?

Under PIPEDA, personal information is defined as “information about an identifiable individual,” but does not include the name, title, or business address or telephone number of an employee of an organization.

The definition is broad and can include a wide range of information.

Examples of information that can be considered personal information include: your financial transaction histories, your credit history, other people’s opinions about you, photographs of you, your fingerprints or voice prints, your blood type, video or audio footage where you appear or are heard.

Does it cost anything to access my personal information?

Ordinarily, it should cost you little or nothing to gain access to your personal information. The law requires an organization to respond to your request at minimal or no cost to you.

An organization may only charge you a minimal fee for responding if it has informed you of the approximate cost up front and you agree to proceed with the request at that cost.

If you feel that an organization is attempting to charge an unreasonable fee, you have the right to file a complaint with the Office of the Privacy Commissioner of Canada.

Can I get a paper copy of my personal information?

While you might typically receive a paper copy of the documents containing your personal information, the organization is not obliged by law to give you a copy. Rather, they are required to provide you with access to your personal information. In some cases, you may be invited to go to the organization’s premises and access the material on site.

Tip: If you have a disability that requires a format other than paper or prevents you from accessing the material on site, you should advise the organization at the time of your access request.

How long should I expect the process to take?

Under the law, the organization is supposed to give you access to your personal information within 30 calendar days. If they don’t have it, they must advise you of this fact within those 30 days.

There are some very specific circumstances under which the organization may require an extension of up to 30 additional days. If that is the case, they have to advise you within the first 30 days and explain the reason for the delay.

You have the right to file a complaint about this delay to the Office of the Privacy Commissioner of Canada.

What if I find an error in my personal information?

You may request that any factual errors or omissions be corrected. You would typically have to provide some evidence to back up your claim. Under the law, an organization must amend the information, as required, if you successfully demonstrate that it’s incomplete or inaccurate.

If you and the organization can’t agree on changing the information, you have the right to have your concerns recorded.

If the organization has previously shared incorrect information with third parties, it must, where appropriate, forward the amended information (or the record of the unresolved challenge) to those parties, so that they too can correct their records.

Can I obtain access to the personal information of someone else?                  

Ordinarily, you may only request access to information about yourself. Organizations may withhold information that relates to a third party, such as a family member, or sever it from other personal information that relates to you.

If, however, the family member consents in writing to the release of the information or if you need the information because an individual’s life, health or security is threatened, then you may be entitled to access it.

Can a company deny my request for access to my personal information?

Yes. The law sets out a number of exceptions to your general right of access to your personal information.

There are, for example, circumstances under which the organization may choose to withhold some or all of the information. There are also circumstances under which organizations are forbidden by law from releasing the information.

For more details, please see: Accessing Personal Information under PIPEDA - What businesses need to know

What can I do if the organization denies part or my entire access request?

If you feel that the organization is withholding more information than it should, you have a right to file a complaint with the Office of the Privacy Commissioner of Canada.

However, before doing so, you should try to resolve the matter with the organization directly. Sometimes the problem stems from a simple oversight or a misunderstanding that can be easily corrected.

How to access your personal information held by the federal government

The Privacy Act provides people with the general right to gain access to information that is held about them by the federal government.

How do I ask for my personal information?

You can fill out a Personal Information Request form.  This form must be sent to the federal institution that holds your personal information. 

Some institutions accept this access request form online.  Information about how to submit a request online and a list of participating departments is available on the Government of Canada website.

Tips:

  • In order to determine which federal agency holds your personal information; consult Info Source, the public directory of federal government agencies.
  • In your request, identify yourself so that the government can be sure it is you, and not someone else, asking for your personal information.
  • Specify the personal information you are seeking. The more precise your request, the faster it can be answered. As well, the onus is on you to be specific enough so that the information can be retrieved.

Note: Requests for access to information held by the federal government that is not personal information should be made under the Access to Information Act

For more information, please see the website of the Office of the Information Commissioner of Canada and the Access to Information Request Form on the Treasury Board Secretariat website.

Who can make a request?

Canadian citizens, permanent residents and any individual present in Canada can make a request under the Privacy Act. People outside of Canada who are not Canadian citizens or permanent residents can ask a Canadian citizen or permanent resident to act as a representative and make a request on their behalf.  Written consent is required.

What types of personal information can I ask for?

The Privacy Act defines as any recorded personal information “about an identifiable individual.” It is important to provide sufficient detail to make the information reasonably retrievable.

Does it cost anything to access my personal information?

There is no charge to apply for information under the Privacy Act.

Can I get a paper copy of my personal information?

While you might typically receive a paper copy of the documents containing your personal information, the organization is not obliged by law to give you a copy. Rather, they are required to provide you with access to your personal information. In some cases, you may be invited to go to the organization’s premises and access the material on site.

Tip: If you have a disability that requires a format other than paper or prevents you from accessing the material on site, you should advise the organization at the time of your access request.

How long should I expect the process to take?

The Privacy Act requires that federal institutions respond to access requests in a timely manner. Within 30 days of receiving a written access request, an institution must write back to say whether it will give access to the information and, if so, it must produce the information.

There are some circumstances in which the institution may be entitled to an extension of that time limit. For example, a federal institution may extend the response deadline by a maximum of 30 days, if meeting the original time limit would unreasonably interfere with the institution’s operations, or if consultations are necessary to comply with the request and cannot reasonably be completed within the original time limit.

The deadline may also be extended for a “reasonable” length of time if the personal information has to be translated or converted into an alternative format.

What if I find an error in my personal information?

Once you have received and reviewed the information, you can check that it is accurate and complete. If it is not, you may ask the department or agency to make the corrections, additions or deletions. Where a requested correction is not made, you can ask that your personal information be so annotated. Corrections will not normally be made to opinions about you given by other individuals; in this case, a note may be added to set out your views on the matter.

To make a correction request, complete a Record Correction Form. Send your request to the Access to Information and Privacy Coordinator of the institution.

Can I obtain access to the personal information of someone else?

To obtain the personal information belonging to someone else, you must submit their written consent authorizing you to receive their personal information. The consent must be signed and dated by the person giving the consent.

Can I receive the personal information of someone who has died?

Personal information can be released if an individual has been deceased for 20 years or more. (Reasonable proof of death must be provided.)

In cases where a person has been dead for less than 20 years, only the executor or administrator of the estate, or liquidator of the succession may request the personal information. However, the liquidator of the succession, executor or administrator may only access information which will allow them to fulfill their legal responsibilities.

Can a federal government institution deny my request for access to my personal information?

There are limited and specific exemptions to the general right of access provided by the Privacy Act.  For example, the head of an institution may refuse to provide access to personal information obtained in confidence from another government, or that relates to a police investigation.

What can I do if the institution denies part or my entire access request?

If you have run into a problem with your application, or think that your personal information is being improperly collected, used or disclosed by the federal government, you may wish to discuss your concerns with the institution’s Access to Information and Privacy Coordinator.

You can also contact the Office of the Privacy Commissioner of Canada for information on how to file a complaint under the Privacy Act.

Date modified: