Data access request made to a dental clinic
The Enquiry
An enquirer would like to know whether it is necessary to state the reason when making a data access request (DAR) to the dental clinic, whether the DAR fees charged by the clinic may be considered excessive, and whether the requester may specify the format in which the data should be provided.
Our Response
According to section 18 of the Ordinance, a data subject may make a DAR to a data user to be informed whether the data user holds personal data of which the individual is the data subject and if the data user holds such data, to be supplied by the data user with a copy of such data. However, the Ordinance does not require the data subject to provide a reason for requesting a copy of the personal data from the data user in order to make a DAR.
Regarding the charging of DAR fee by data users, section 28 of the Ordinance allows a data user to impose a fee for complying with such requests, which should not be excessive, a data user is allowed to charge a requestor only for costs which are “directly related to and necessary for” complying with a DAR, and should not charge a fee on a commercial basis. Any fee that exceeds the costs of compliance may be considered excessive.
Moreover, a requestor may request the data user to provide the requested data in a specified form (e.g. computer disk, microfilm etc.). Such request can be made in Part VII of the “Data Access Request Form”. However, if it is not reasonably practicable for the data user to supply the copy in the form specified by the requestor, the data user may provide the copy in another form.
For more details regarding making a DAR, please refer to Exercising Your Data Access Rights Under the Personal Data (Privacy) Ordinance (Frequently Asked Questions and Answers) issued by this Office.
(Uploaded in February 2026)