Data subject requests under Law 25: how to answer within 30 days

A former customer writes to you. They ask for a copy of everything you hold about them, in a format they can take to another company. Do you know where that information sits, and who will answer?

What a data subject request is

A data subject request is a written demand from a person who wants to use a right over their personal information. Think of it as a formal letter with a date on it. It needs a clear answer, in writing, within a set time.

The request can come from anyone whose information you hold. That includes customers, website visitors, job applicants and former employees. Each of them has the same rights. The request can arrive by email, by letter or through an online form, so check every channel.

Law 25 gives people five rights:

• Access: the person can see the personal information you hold about them.
• Correction: the person can ask you to fix information that is wrong or incomplete.
• Withdrawal of consent: the person can take back their consent to how you use their information.
• De-indexing: the person can ask you to stop the spread of their information and to remove links that expose it.
• Portability: since September 2024, the person can ask for a copy of their information in a structured, commonly used technological format.

Portability is the newest of these rights. Choose the format before the first request arrives. The copy covers the person’s own information, not your whole database, and it must be a format another company can read.

Why it matters for an SMB

People can sue you for damages, and punitive damages apply to intentional or grossly negligent breaches. A late answer is easy to prove, because the request carries a date. The 30-day limit is also short when personal information sits in several tools. Each tool needs a named owner, or the search stalls. If the search runs late, the answer runs late too.

A late or partial answer damages trust. Trust is hard to rebuild, and a small business depends on it.

A request also tests your records. If you cannot find the information, you learn that your records are incomplete. Fix that gap before the next request, not during it.

Your person in charge of the protection of personal information is the natural owner of this process. By default, that is the person with the highest authority, often the CEO. The role can be delegated in writing.

PIPEDA, the federal private-sector privacy law, may also apply if your business works outside Québec. It sets ten fair information principles, and individual access is one of them. In practice, a person can ask what personal information you hold about them, and you must answer. The same principle covers correction. Ask your adviser how PIPEDA applies to your business.

Records help during an audit too. An auditor who asks how you handled the last request gets a dated answer, not a memory.

How to answer a request

Prepare the steps before the first request arrives. Write them on one page, name an owner, and walk through a practice request once. The steps below cover one request from start to finish.

1. Log the request on the day it arrives. Note the date, the right asked for and the channel used. Give the request a reference number, so you can find it again.
2. Confirm who is asking. Ask only for what you need to confirm the identity. Do not collect new personal information just to check it. If someone asks on behalf of another person, check that they have the authority to act.
3. Search every tool that may hold the information. Check email, customer records, payroll, shared drives and data that your vendors hold for you. A list of your software shows which tools to check. Ask each tool’s owner to confirm what they hold.
4. Review what you found. Keep only information about the requester. Remove information about other people before you send anything.
5. Answer in writing, within 30 days. Use plain language. For a portability request, send the copy in a structured, commonly used technological format. Say what you did, and attach what you sent. A good answer confirms what you hold, gives the copy or the correction, and states the date.
6. Keep a record. Store the request, your search, your answer and the date you sent it. This record is your proof.
7. If you refuse, give your reasons. Explain the reason in plain words, in the written answer, and keep it on file. A refusal is still an answer, so it follows the same rules: in writing, dated and recorded.

A request handled well takes time the first time. Once the owner, the steps and the tools are known, the next request follows the same path.

Common mistakes

• Starting late. The request sits in a sales representative’s inbox for a week. Send every request to one named person on the day it arrives.
• Searching one tool only. The email is checked, but the customer file and the shared drive are not.
• Forgetting a source. The first answer misses a tool, so the person has to ask again.
• Forgetting the format. A scanned page cannot be reused easily by the person somewhere else.
• Asking for too much to verify identity. Every extra detail you collect is one more thing to protect.
• Sending data to the wrong person. A copy sent to an unverified address is a privacy incident. Record it in your incident register.
• Answering by phone only. A call leaves no written answer, and Law 25 requires one.

How NextIT helps

Portability Requests handles data subject requests through a public request link. The data subject requests guide explains the module. The software inventory lists the tools you use, which helps you find where personal information sits. To see the module with your own data, book a demo.