What to Do When a Client Asks What Data You Hold

An email arrives asking what personal information your business holds about somebody, and requesting a copy.

The legal position is straightforward. The operational position, for most businesses, is that answering honestly would take a week and still miss things.

Where it actually lives

Trace one individual through a typical company and the list is longer than anybody expects.

The CRM. The accounting system. A project tool. Two or three shared drives, including folders created by people who have left. The marketing platform. A scheduling tool. Form submissions. And the inboxes of everybody who has ever corresponded with them, which is where most of it sits and where none of it is searchable centrally.

Possibly a spreadsheet somebody built. Almost certainly a backup nobody has thought about since it was configured.

Why the fire drill happens

Faced with a request, most businesses ask several people to search several systems and hope nothing was missed.

That is slow, it is incomplete, and it produces an answer nobody can stand behind. It is also entirely predictable, because the capability required is an inventory, and nobody builds an inventory in response to a request. It has to exist beforehand.

The same absence explains why retention obligations get ignored. You cannot delete on a schedule what you cannot locate.

The obligation in Quebec

Law 25, previously Bill 64, finished phasing in on 22 September 2024, having arrived in three stages from September 2022. Among its requirements are a named privacy officer, an incident response plan and log, meaningful consent tied to purposes you described, retention only as long as the purpose requires, and the ability to answer requests from individuals about the information you hold.

Most of that is operational rather than legal. A policy on your website satisfies none of it if the underlying capability does not exist.

This is not legal advice. Take the specifics to a Quebec privacy lawyer. What follows is about what it means for how your business runs.

Where AI makes the inventory possible

This is the part that was genuinely impractical before and is now straightforward.

Locating personal information means reading unstructured material. Free text notes, attachments, email threads, scanned documents. Keyword search was never sufficient, because personal information does not announce itself in a consistent format and a name appears in a hundred places that are not records about that person.

AI reads that material and identifies what constitutes personal information, which individual it relates to, and where it sits. That turns an inventory from a consulting project into something that runs continuously.

Once it exists, a request is answered by searching one index rather than six systems, retention schedules can actually run because you know what you have and when it arrived, and an incident can be assessed quickly because you know what was in the affected system.

What to prepare before you get asked

• A list of every system holding personal information, including the ones nobody thinks of as systems.

• A named owner who receives these requests and knows what to do.

• A written process, so the first request is not also the first time anybody has thought about it.

• Retention periods per category, applied from a recorded date rather than agreed in principle.

• Supplier list. Information you passed to somebody else is still your responsibility and part of the answer.

The upside worth mentioning

Businesses that do this properly end up with something more valuable than compliance.

Knowing where client information lives, keeping it current and being able to find anything on request is the definition of clean data. Clean data is the precondition for reporting that agrees with itself and for any system built on your own material.

Firms that treated this as an operational project generally came out with better systems than they started with. Firms that produced a policy have a document and the same mess underneath it.

Inboxes are the hardest part

Of everywhere personal information hides, individual mailboxes are the most awkward, and every business has this problem.

Correspondence with a client sits in the account of whoever handled it. It is not searchable centrally, it may include attachments that exist nowhere else, and when that person leaves it becomes either inaccessible or forgotten.

Two things reduce it. Client correspondence that matters should reach the client record rather than living only in a thread, which is a capture problem rather than a discipline one. And offboarding should transfer rather than only disable, because a disabled account still holds everything.

Backups are part of the answer

The question nobody thinks about until a lawyer raises it.

If you delete something under a retention rule, it frequently still exists in a backup, potentially for months. That is normal and defensible, and it needs to be understood rather than discovered. Know your backup retention period and be able to state it.

The same applies to systems you have stopped using. A platform you migrated away from two years ago may still hold a full copy of everything, under an account nobody checks.

Practise once before it is real

Pick a client from three years ago and run the exercise as though a request had arrived.

Time it. Note everywhere you found something, and everywhere you suspect something exists but could not confirm. That afternoon produces a more useful picture of your exposure than any policy document, and it is considerably cheaper than doing it for the first time under a deadline with somebody waiting.

Sources

• Fasken, Law 25 resource centre, covering the phased implementation of An Act to modernize legislative provisions as regards the protection of personal information, Quebec, in force in stages from 22 September 2022 to 22 September 2024.

AI Optimize builds the inventory that makes these requests answerable in an afternoon rather than a week. That work sits under Document Intake & Validation.