A customer asked what data you hold on them. Now what?

You have thirty calendar days, and acknowledging the request does not count as responding to it. The deadline is the part shops get caught by.

Individual access is one of PIPEDA's principles: a person can ask what personal information you hold about them, how it has been used, and who it has been disclosed to. For a plumbing company this is rare, and it usually arrives from someone already unhappy about something else — which is precisely why knowing the deadline in advance is worth the five minutes.

Thirty days, and it means answered

You must respond within 30 calendar days of receiving the request. The regulator is explicit that you cannot simply acknowledge receipt within thirty days and then take longer to deal with it, and that a partial response inside thirty days does not satisfy the limit either. The clock is on the answer, not the acknowledgement.

When you can take longer

PIPEDA allows an extension of up to a further thirty days in limited circumstances: where responding would interfere to an unreasonable degree with your activities, where it would require consultations that make thirty days impracticable, or where converting the information into an alternative format takes significant time.

The extension is not automatic. You have to contact the person within the first thirty days, explain the delay, and tell them they can complain to the Privacy Commissioner about it. Miss that and you have missed the deadline, extension or not.

What to actually send

The personal information you hold about them — contact details, job history, notes, photographs, recordings.
An account of how it has been used.
Who it has been disclosed to, including software vendors that process it on your behalf.

That third item is the one small businesses forget. If a scheduling tool, an accounting package or a lead system holds the customer's details on your behalf, those are disclosures you should be able to name. Your privacy policy should already list them; if it does not, the access request is not the moment to find out.

Preparing before it happens

The practical difficulty is almost never willingness. It is that a customer's information is spread across an inbox, a phone, an invoicing tool and somebody's notebook, and thirty days disappears while you work out where it all is. Knowing which systems hold customer data — the same list you need for retention — is most of the preparation.

This is a plain-language summary of published guidance, not legal advice. Every claim above is sourced below. For a decision that carries real consequence for your business, talk to a lawyer who practises privacy law in your province.

Sources

Checked against the Office of the Privacy Commissioner of Canada on 2026-08-09.