Imagine this…
Your redundancy process is carefully planned.
Your consultation is genuine.
Your business case is well considered and defensible.
Then someone finds an email sent before the process even started:
“We need to make Greg redundant.”
Suddenly, the carefully managed process looks very different.
Or perhaps you’ve just completed a fair and reasonable disciplinary process, carefully considered all the information and reached an outcome you can clearly justify.
Then you receive a privacy request — and buried in the emails is a subject line that says:
“I need to fire John.”
That one sentence may raise questions about how predetermined the outcome really was.
And this is where privacy requests can get very interesting for employers.
What is a privacy request?
Under the Privacy Act, an employee can request access to personal information you hold about them. It’s easy to assume this means their personnel file. And yes, that’s part of it. But personal information can extend much further.
Depending on the circumstances, a request may capture things such as:
- Emails referring to the employee
- Meeting notes
- Performance or disciplinary records
- Recordings
- Photos or scans
- Messages and other correspondence
- Information held electronically or in hard copy
- In some circumstances, records of recollections about conversations or meetings
Suddenly, what seemed like an ordinary HR process can involve a lot of information — and a lot of scrutiny.
Why are we seeing more of them?
With the increasing use of AI, the volume of information organisations create and retain is growing rapidly. At the same time, we’re seeing more employment disputes and Personal Grievances.
That means privacy requests are becoming an increasingly important consideration for employers and HR teams.
A privacy request may simply be an employee exercising their rights and wanting to understand what information is held about them.
But in an employment-relations context, it can also become an important part of a wider dispute — particularly where an employee is looking to understand what happened, what decisions were made and when, and what was being said behind the scenes.
And that’s why the everyday emails, Teams messages and meeting notes you never expected anyone to read can suddenly matter.
So, what should you do when you receive a privacy request?
1. Acknowledge it – Confirm that you have received the request and are considering what information is covered.
2. Understand what you need to provide – The general timeframe for responding to a privacy request is 20 working days. Depending on the circumstances, you may provide the information, withhold information where there are lawful grounds to do so, or extend the timeframe where the request is complex or involves a substantial amount of information.
3. Get advice if the request is significant – If the request relates to an ongoing disciplinary, performance, redundancy or other employment-relations matter, it’s worth getting advice early. The way you search for, review and respond to the information can be important.
How can you protect your business?
You can’t stop employees from making privacy requests. But you can make sure your organisation is better prepared for them.
Have a clear privacy policy.
Make sure employees and managers understand how personal information is collected, stored, used and accessed.
Train your managers.
Remind managers that emails and messages are business records — not private conversations. Encourage clear, factual and professional communication, particularly when discussing sensitive employment matters.
Think before you hit send.
Would you be comfortable with that email appearing in a privacy request? If the answer is no, it may be worth reconsidering how you communicate.
Get advice early.
If you receive a privacy request during a sensitive employment process, don’t wait until you’re halfway through the response. Getting the right advice early can help you identify what information may be captured, what obligations apply and how best to respond.
The bottom line – A privacy request can uncover far more than an employee’s personnel file.
And sometimes, the most problematic document isn’t the formal HR record — it’s the casual email someone sent when they thought nobody else would ever see it.
So, before you press send, remember:
Write every email as though the person you’re writing about may one day read it.
Because they just might.
Positive People have over 30 years’ experience helping organisations to navigate complex employment problems and get their policies and systems right. Contact us now on 0800 00 00 49 or info@positivepeople.co.nz.