Rules
Part of Personal privacy rights guide: an overview
Privacy request problems: a reply that is partial, redacted or refused
A privacy request reply with missing records, redactions or a refusal: how to find the gap, ask what was searched and answer a cited exemption.
What to take away
- A reply that arrives is not always a reply that answers. Compare it with what you asked for, item by item.
- A search can miss an account, read a date range too narrowly, or hit records already deleted.
- Redaction of other people's details is not a refusal. Ask the organization to say which one it is.
- If an exemption is cited, ask which one, and what the organization processes the data for.
- Keep every reply with its date, and take an unresolved gap to a regulator only after the organization has had a chance to answer.
Read what came back
Each kind of incomplete reply has a different cause and needs a different question. Work out which one you hold before you write back, because a blanket complaint that "the reply is wrong" gives the organization nothing to fix.
| What came back | Possible cause | What to ask |
|---|---|---|
| Fewer records than you expected | A search missed an account | Which accounts and systems were searched |
| Records start late or stop early | A date range was read too narrowly | Which date range was applied |
| "Those records no longer exist" | Records were deleted | When, and under which retention rule |
| Pages with blocks of text removed | Another person's details were redacted | Whether this is redaction or refusal |
| "An exemption applies" | An exemption was applied | Which exemption, and why it fits |
| "We are not the right company" | Another organization holds the data | Where the request is forwarded |
Find the gap with an item table
Build a table before you reply. List each item you requested, what arrived, what is missing, and why you believe the missing item exists. The last column carries the argument, so give it a concrete reason such as an account, an order or a message you know you made.
A short example shows the habit. You asked for your account history, support chats and marketing profile. The reply holds the history and the profile but no chats, and you know you used the chat window. The gap is one row: support chats, missing, because you used the chat window on a named product.
Send that table with a request to confirm which systems and date ranges were searched. Name identifiers, products, departments and events you do know, and label any narrowing as your own choice.
A redaction is not a refusal
Another person's details can be removed from a page you are entitled to see. That is a redaction, and the rest of the page should still arrive. A full refusal withholds the whole record, and the organization should say so and give a reason.
Ask for a plain statement of which pages are redacted and why. If whole documents are missing without comment, that is a different problem from a blacked-out line. Treat the two separately in your letter, because the remedy for each is different.
The organization says it is not the right one
The brand you deal with may be a reseller, a platform, an employer or a processor acting for someone else. Support staff rarely see the contract that decides who controls a record.
Find the right controller
- Check notice, contract, receipt, app listing
- Ask provider: acting for another organization?
- Ask where rights requests are forwarded
- Preserve first delivery and routing response
Ask the provider in writing whether it acts for another organization and where it forwards rights requests. Keep the first delivery and any routing reply. A redirect is not a fresh start, so the original date still counts as evidence that you asked.
The organization says the records were deleted
Deletion is a fair answer only when the organization can say when and why. Ask when the records were deleted, under which retention rule, and whether a copy survives in a backup or with another party.
The answer also tells you something about the organization. Weak deletion practice, such as keeping data for longer than any purpose needs, is covered in personal data lifecycle problems. A deletion date that falls after your request needs a particular explanation.
The reply cites an exemption
In the UK, data protection exemptions are set out in the UK GDPR and the Data Protection Act 2018, and whether one applies often depends on why the organization processes the data. Similar exemptions exist in US and Canadian law.
Ask which exemption is relied on and which part of your request it covers. The gap between sensitive and inferred data matters here, because an exemption usually bites on one category of data rather than all of it. A partial exemption should still leave the rest of the record to you.
Keep a dated record of every reply
A dispute about what was sent, and when, is hard to win without evidence. Keep each reply as it arrived, with its date and the route it came by.
Keep proof of receipt
- Completed form or confirmation
- Sent email with headers
- Postal tracking or call note
- Follow up via verified route
- Ask for reference, avoid duplicate
- Save the reply and what it contained, with the date it arrived.
- Note your item table and the date you sent it back.
- Record any answer about searches, deletion or exemptions in the organization's own words.
- Give a date by which you expect an answer before you escalate.
Take an unresolved gap to a regulator
Raise the gap with the organization first. If it stays open, the route depends on where you live.
Canada: the Office of the Privacy Commissioner handles PIPEDA complaints, and provincial commissioners cover Alberta, British Columbia and Quebec. A privacy complaint with the OPC works best once your dated record is complete.
United States: no single regulator covers everything. Most individual complaints go to a state attorney general or, in California, to the Privacy Protection Agency. The FTC takes reports and acts on deceptive practice. Read your state statute for the exact rule.
United Kingdom: raise the problem with the organization first, then complain to the ICO if that fails.
Common questions
Should I resend if the first request went to customer support?
Preserve the original and ask for routing. Whether the first delivery counts depends on the rules that apply and the recipient.
Is a redacted document the same as a refusal?
No. A redaction removes part of a page, often because it holds another person's details, while a refusal withholds the record. Ask the organization to say which it is.
What if the organization says the records were deleted?
Ask when they were deleted and under which retention rule. Keep the answer with your dated record.
Can a regulator award compensation?
Powers differ by body. The FTC and the OPC do not pay damages the way a court can. Take advice on court claims.
