Document text
Date: [DD MONTH YYYY]
Sent by [E-MAIL TO THE DATA PROTECTION OFFICER / REGISTERED POST]
To:
[ORGANISATION'S NAME]
Attn: Data Protection Officer / Personal Data Privacy Officer
[ADDRESS OR E-MAIL FOR DATA ACCESS REQUESTS]
From:
[YOUR FULL NAME]
[ADDRESS]
[PHONE] · [E-MAIL]
[CUSTOMER / STUDENT / STAFF / MEMBERSHIP NUMBER, IF ANY]
Subject: Data access request under section 18 of the Personal Data (Privacy) Ordinance (Cap. 486) — [NAME OF THE INCIDENT, E.G. "DATA BREACH NOTIFIED ON (DATE)"]
Dear Sir or Madam,
On [DATE] I learned that personal data held by your organisation may have been affected by [a data security incident / unauthorised access / a leak] ([HOW YOU LEARNED: YOUR NOTICE TO ME / NEWS REPORT / OTHER]).
1. My data access request
I enclose a completed Data Access Request Form (OPS003) specified by the Privacy Commissioner for Personal Data, together with [A COPY OF MY IDENTITY DOCUMENT WITH THE NUMBER PARTLY MASKED / OTHER PROOF OF IDENTITY YOU MAY REASONABLY REQUIRE].
Under section 18(1) of the Ordinance, please:
1. inform me whether you hold personal data of which I am the data subject; and
2. supply me with a copy of that data.
To help you locate the data, it may be held in: [SYSTEMS OR SERVICES — E.G. ONLINE ACCOUNT, LEARNING PLATFORM, MEMBERSHIP DATABASE, CCTV, HR FILE], for the period [FROM DATE] to [TO DATE].
Under section 19(1), you must comply within 40 days after receiving this request, that is by [DATE RECEIVED + 40 DAYS]. If you cannot comply in time, please tell me in writing before that date, with reasons, and supply what you can.
If you intend to charge a fee, please tell me the amount and how it is calculated before you proceed.
2. Questions about the incident
Separately from the request above, I ask you to tell me in writing:
Question Your answer
Which of my personal data were affected (e.g. name, e-mail, ID number, account details, messages)?
When did the incident happen and when did you discover it?
Has the incident been reported to the Privacy Commissioner?
What have you done to contain it and to prevent it happening again?
What should I do to protect myself (e.g. change passwords, watch for phishing)?
Who can I contact about this?
3. Correction and use of my data
If any of my data are inaccurate, I will ask for correction after I receive the copy. Please do not use my personal data for direct marketing.
Yours faithfully,
______________________________
[YOUR FULL NAME]
Enclosures:
1. Data Access Request Form (OPS003), completed and signed.
2. Proof of identity (as required by the form).
3. Copy of the incident notice I received (if any).
BEFORE SENDING — delete this part
Use the official form. An organisation may refuse a data access request that is not made in the form specified by the Privacy Commissioner. Download form OPS003 from the PCPD website, fill it in and attach it to this letter. Send it to the organisation, not to the PCPD.
40 days. The organisation must reply within 40 days after receiving the request. Keep proof of the date it was received.
Fees. A fee may be charged, but it must not be excessive. The organisation may wait for payment before it complies.
Complaint. If you get no reply or a refusal, you can complain to the PCPD. The PCPD may refuse to investigate if you knew about the matter for more than 2 years before complaining.
Field labels in [SQUARE BRACKETS, CAPITALS] must be completed or deleted. Alternatives are separated by a slash. © Layers (layers.md), licensed under CC BY 4.0 (https://creativecommons.org/licenses/by/4.0/). Template, not legal advice.
Reply to this document or get a deadline reminder: https://layers.md/hk/data-access-request-letter?from=reply-hk-rez-data-access