Jira & Confluence 
Bitrix24 New Zealand · Privacy Act 2020 · IPP 6 · 20 working days
Your details caught in a data breach? — ask what they hold, 20 working days counted
Short answer. Your request to the organisation's privacy officer is open below: it asks for your information and what exactly leaked. Your right to ask: Confirmation whether they hold information about you, and access to it (Privacy Act 2020, s.22, IPP 6; s.40).
- Last working day for their response, or for a notice extending the time (20 working days): type the date
- If this is instead the date you first learned of the breach: complain to the Privacy Commissioner before this date (after 12 months the Commissioner may decline): type the date
Working days: Monday to Friday; public holidays are not deducted. Check your own case.
An organisation must respond to a request for your personal information as soon as reasonably practicable and no later than 20 working days after the day it receives it (Privacy Act 2020, s.44(1)); an extension must be notified within the same 20 working days, with reasons (s.48). Our count skips Saturdays and Sundays only. Under the Act, public holidays (for example Labour Day, Monday 26 October 2026) and every day from 25 December to 15 January are not working days either, so the real deadline can be later than shown. The Commissioner may decide not to investigate if you have not tried to resolve it with the organisation first, or if you knew about the matter for 12 months or more before complaining (s.74(1)(a), (e)).
Start typing right in the document — no sign-up. It stays in this browser; save it to your free Layers account to keep it, open it on your phone and share it.
Lida, Layers template assistant
Enter the date the organisation received your request, and I will show the last working day for their answer.
If the deadline falls near Christmas, remember that 25 December to 15 January does not count, so their answer may legally come later.
An illustrated character, not a lawyer.
Deadlines
The rules, with the source
| What | Deadline | Source |
|---|---|---|
| Your right to ask | Confirmation whether they hold information about you, and access to it | Privacy Act 2020, s.22, IPP 6; s.40 |
| Their response | As soon as reasonably practicable, no later than 20 working days after the day the request is received | Privacy Act 2020, s.44(1) |
| Extension | Only for large volume, needed consultations or complexity; notice within 20 working days, with period, reasons and your right to complain | Privacy Act 2020, s.48 |
| Urgent request | You may ask for urgency and must say why | Privacy Act 2020, s.41 |
| Charges | A private company may charge for making information available; a public agency only if authorised | Privacy Act 2020, s.66 |
| Breach notice to you | As soon as practicable; must describe the breach, the steps taken and steps you may take | Privacy Act 2020, s.115, s.117(2) |
| Complaint to the Privacy Commissioner | Try the organisation first; the Commissioner may decline if you knew of the matter 12 months or more before complaining | Privacy Act 2020, s.70, s.74(1)(a), (e) |
'Working day' in the Privacy Act excludes weekends, Waitangi Day, Good Friday, Easter Monday, Anzac Day, the Sovereign's (King's) Birthday, Matariki, Labour Day and every day from 25 December to 15 January (s.7).
Step by step
What to do, in order
1
Find the privacy officer
Look for the privacy policy or the breach notice on the organisation's website; it lists a privacy e-mail address.
2
Fill in who you are
Name, date of birth and customer or patient number help them find all your records.
3
Ask the breach questions
What leaked, when, who may have it, and what you should do now.
4
Send and note the date
E-mail is fine. Keep the sent copy; the 20 working days run from the day after they receive it.
5
Protect yourself meanwhile
Change passwords, watch your bank account and ignore messages asking you to 'verify' your details.
6
No answer? Go to the Commissioner
After 20 working days without a response or extension notice, complain to the Office of the Privacy Commissioner.
Questions
Do I need special words or a form?
No. A letter or e-mail that asks for your personal information is a request under the Privacy Act. The letter below names the principle and section so nothing is missed.
Can they charge me?
Government agencies generally cannot unless authorised. A private company may charge for making the information available, so the letter asks them to tell you the amount first.
The breach was months ago. Is it too late?
You can ask for your information at any time. For a complaint, do not wait: the Commissioner may decline one made 12 months or more after you knew about the matter.
Official sources
Other documents
Keep the papers in one place
Letters, receipts and notices in one folder you can share with family or a lawyer. The templates and the editor are free; Layers is free for up to 20 people.
This is a ready document and a deadline calculation, not legal advice.