Document text
Date: [DD MONTH YYYY]
Sent by [E-MAIL TO THE PRIVACY OFFICER / POST]
To:
The Privacy Officer
[ORGANISATION NAME]
[POSTAL ADDRESS OR PRIVACY E-MAIL ADDRESS]
From:
[YOUR FULL NAME]
[ADDRESS]
[PHONE] · [E-MAIL]
[CUSTOMER / PATIENT / ACCOUNT / STUDENT NUMBER, IF ANY]
Subject: Request for my personal information (information privacy principle 6) and questions about the [NAME OF INCIDENT] privacy breach
Dear Privacy Officer,
I am writing about the privacy breach that [ORGANISATION NAME] announced / told me about on [DATE] ([E.G. YOUR E-MAIL OF (DATE), NEWS REPORT OF (DATE), NOTICE ON YOUR WEBSITE]).
1. Who I am
Detail Information
Full name [FULL NAME]
Other names you may hold my information under [PREVIOUS NAMES / NONE]
Date of birth [DD/MM/YYYY]
Customer / patient / account number [NUMBER]
Contact details you hold for me [E-MAIL / PHONE / ADDRESS]
I can provide proof of identity in the way you reasonably require.
2. My request for access
Under information privacy principle 6 of the Privacy Act 2020, please:
1. confirm whether you hold personal information about me; and
2. give me access to that personal information, including [KEEP WHAT APPLIES: account records / health records / identity documents I supplied / call recordings / notes about me / records held for you by service providers].
I would like to receive the information by e-mail in electronic form / [OTHER FORMAT].
3. About the breach
So that I can protect myself, please also tell me in writing:
Question Your answer
Which of my information was accessed, copied or disclosed in the breach (for example name, date of birth, address, ID numbers, bank details, IRD number, health information, passwords)
When the breach happened and when you became aware of it
Whether you know who may now have my information
What you have done, and will do, in response
Whether you have notified the Privacy Commissioner
What steps you recommend I take to reduce the risk of harm
A contact person for my questions
4. Urgency
[DELETE IF NOT NEEDED] I ask that this request be treated as urgent because [REASON — E.G. MY ID DOCUMENTS WERE INCLUDED AND I NEED TO REPLACE THEM / I HAVE RECEIVED SCAM MESSAGES USING MY DETAILS].
5. Timing and charges
Please respond as soon as reasonably practicable and in any case within 20 working days after the day you receive this request (Privacy Act 2020, section 44). If you need to extend that time, please tell me within the same 20 working days, with the length of and reasons for the extension (section 48).
If you intend to charge for providing the information, please tell me the amount before you incur it.
If any of my information is wrong, I will ask you to correct it under information privacy principle 7.
If I do not receive a response, I may make a complaint to the Privacy Commissioner.
Yours sincerely,
______________________________
[YOUR FULL NAME]
Attachments:
1. Copy of your breach notice or e-mail (if any).
2. Proof of identity: [TYPE OF DOCUMENT] — send only if you ask for it, by a secure method.
BEFORE SENDING — delete this part
Write down the date the request is received. The 20 working days start the day after that date. Weekends, public holidays and 25 December to 15 January are not working days.
Do not send a copy of your passport or driver licence by ordinary e-mail unless the organisation asks and offers a secure way.
If there is no answer after 20 working days, or you disagree with the answer, you can complain to the Office of the Privacy Commissioner. Keep a copy of this letter and their reply.
Watch for scams. Messages that quote your leaked details and ask you to "verify" or pay are a common follow-up to a breach.
Field labels in [SQUARE BRACKETS, CAPITALS] must be completed or deleted. Alternatives are separated by a slash. © Layers (layers.md), licensed under CC BY 4.0 (https://creativecommons.org/licenses/by/4.0/). Template, not legal advice.
Reply to this document or get a deadline reminder: https://layers.md/nz/privacy-act-request-data-breach?from=reply-nz-rez-data-breach