How do I respond to a request to correct or delete information?

Individuals have a right to request the correction of any personal information(external link) you hold about them, including asking for their information to be corrected by removing or deleting it. If you decline to correct the information as requested, then the individual has the right to ask to have a statement of correction added to the information in question.

After receiving a request you must review the information in question and decide whether to make the correction requested. You don’t necessarily have to make the correction if you consider that the information is already accurate, or there might be a good reason why you can’t change a historic record. You may have obligations under other laws which you need to consider.

However, you should also keep in mind that you have an obligation to make sure personal information is accurate(external link) before using it and, as such, there could be issues leaving inaccurate or disputed information on someone’s file.

Once you’ve made a decision, you must tell the individual as soon as practical, and in any case no later than 20 working days after receiving the request. If you refused to correct the information, you need to let the individual know why you have made this decision and that they have the right to make a complaint to the Privacy Commissioner about this decision. In addition to this, you need to let them know they have the right to request the attachment of a statement of correction.

If you refuse the request to attach the statement of correction, you need to inform the requestor that they have the right to complain to the Privacy Commissioner about your decision. 

When you have made a correction, or attached a statement of correction to personal information, you must also, so far as is reasonably practicable, inform every other person your organisation has disclosed the information to. Read more guidance on access and correction requests for organisations.

Updated October 2025