Access
With the Access principle, your organization is required to provide individuals with access to their personal information for review and update. One of the access criteria (6.2.3) requires that personal information be provided to the individual in an understandable form, in a reasonable timeframe and at a reasonable cost, if any. If the personal information is stored by a third party, then your organization's responsibility is to facilitate the retrieval of the personal information in a reasonable timeframe.