CRA access to information request: $5, 30 days, or ask the auditor

As of October 2026, a CRA access to information request costs $5 for a corporation under the Access to Information Act and nothing for an individual under the Privacy Act; the CRA has 30 days to answer. Ask the auditor informally first: it's free while the audit is open or closed under 12 months, with no objection filed.

Which route gets your client's audit file fastest?

Start with the auditor. The CRA's Informal Disclosure Guidelines let your client, or you as authorized representative, ask for audit information verbally or in writing, with no form and no cost, as long as the audit is open or was closed within the last 12 months and no notice of objection or appeal has been filed canada.ca. A request is treated as informal unless it names the Access to Information Act or the Privacy Act or uses Form RC378.

Route	Who asks	When it works	Cost	CRA deadline
Informal request to the auditor	Your client, or you within your authorization	Audit open, or closed within 12 months, and no objection or appeal filed	Free	None in law
Documents from the appeals officer	Your client, or you as representative	After the notice of objection is filed	Part of the objection	None stated
Privacy Act request	Individual client, or you with the client's signed authorization	Any time	No fee	30 days, plus up to 30 more
Access to Information Act request	Corporation, partnership or trust, signed by an officer, partner or trustee	Any time	$5	30 days, plus a reasonable extension

The guidelines say there are no legislated deadlines for an informal request; the CRA only commits to answering in a timely manner canada.ca. A formal request starts a legal clock instead: 30 days under section 14 of the Privacy Act laws-lois.justice.gc.ca and 30 days under section 7 of the Access to Information Act laws-lois.justice.gc.ca.

Once an objection is filed, the informal route at the audit level closes, but the Appeals Branch can send documents related to the dispute. P148 lists the auditor's reports supporting the assessment, the auditor's working papers on the issues in dispute, records of discussions between the appeals officer and the auditor, and valuations the auditor relied on canada.ca.

What will the auditor hand over, and what stays back?

Most of the working papers, once each procedure is done. The guidelines let auditors disclose most information in their working papers, but not procedures or tests that haven't been completed, and they bar releasing the audit report or any position paper until it's finalized canada.ca. The Income Tax Audit Manual confirms that auditor's reports, including Form T20, Audit Report, can reach your client through an informal request or under the Access to Information Act canada.ca.

Usually released informally	Never released informally
Completed working papers	Procedures and tests not yet performed, and the audit plan
Correspondence sent to your client	Risk assessment reports
Outstanding audit issues	Information from an informant or confidential source
Your client's own records, including bank statements obtained by requirement	Legal opinions protected by solicitor client privilege
Referrals to most compliance programs	Referrals to Criminal Investigations, and GAAR referrals before approval
The audit report, once finalized	Third party information without consent, treaty exchange information

The table follows the CRA's guidelines, which also say that anything the CRA would release under a formal request can be released informally canada.ca. Two levels of supervisors approve each release, and the files come as watermarked PDFs, so expect a short wait even on a willing auditor.

Check your authorization before you ask. The auditor discloses only what your level and type of authorization allow canada.ca. For an individual client, the audit enquiries and Submit documents services in Represent a Client need Level 2; Level 1 has no access to either canada.ca. The Represent a Client page covers how to change the level.

What does a formal request need when you file it for a client?

Use the Privacy Act for an individual's own information and the Access to Information Act for a corporation, partnership, trust or charity canada.ca. The Privacy Act right of access belongs to Canadian citizens and permanent residents, and can be extended to others by order laws-lois.justice.gc.ca.

Requester	What the CRA asks for
Individual client, filed by you	Two IDs of the client (one with a photo), proof of authorization signed and dated by the client within the last 30 days, name, date of birth, SIN, a description and date range
Corporation	$5, an authorization signed and dated within 30 days by an officer or director on the corporate registry, that person's two IDs, a corporate summary profile generated within 30 days, the business number and the program accounts (RC, RT, RP)
Partnership	$5, two IDs of an authorized partner, the full partnership agreement for a limited or limited liability partnership, the business number and accounts
Trust	$5, two IDs for each trustee, the complete trust agreement or deed, the trust account number
Deceased client	SIN, the will or court appointment, the death certificate, two IDs for each executor; joint executors all sign

All of these come from the CRA's Step 2 page canada.ca. Name the files precisely: the audit years, the program account and the description of the records (the auditor's working papers, the T20, the proposal letter and your client's replies). The page says you don't have to give a reason, but an explanation helps staff find the records.

File through the ATIP Online Request Service, which gives you electronic delivery, status tracking and card payment of the fee canada.ca canada.ca. By mail, use Form RC378, Access to Information and Personal Information Request Form canada.ca, and send it to the Director General, ATIP Directorate, Canada Revenue Agency, 555 MacKenzie Avenue, 5th Floor, Ottawa ON K1A 0L5, with a cheque or money order to the Receiver General for Canada canada.ca. For a deceased client, see represent a deceased client.

How long does the CRA have, and what if it runs late?

Both Acts give 30 days, but the extensions differ. Under section 15 of the Privacy Act, the CRA can extend by up to 30 days for workload or consultations, and for a reasonable period for translation or an alternative format laws-lois.justice.gc.ca. Under section 9 of the Access to Information Act, an extension is for a reasonable period with no fixed cap, and one longer than 30 days must also be reported to the Information Commissioner laws-lois.justice.gc.ca.

	Privacy Act	Access to Information Act
Used for	An individual's own information	Corporations, partnerships, trusts, charities
Fee	None	$5 application fee
First deadline	30 days	30 days
Extension	Up to 30 days (longer only for translation or format)	A reasonable period
Notice of extension	Within 30 days of receipt	Within 30 days of receipt
Complaint goes to	Privacy Commissioner	Information Commissioner, within 60 days

Either way, the notice of extension has to arrive within 30 days after the request is received and must tell your client they can complain about it laws-lois.justice.gc.ca laws-lois.justice.gc.ca. An access complaint must be made within 60 days after your client receives a refusal, gets the records, or becomes aware of grounds for the complaint laws-lois.justice.gc.ca. The CRA asks you to try its ATIP Directorate first, then lists both commissioners' contact details canada.ca. A complaint about how the CRA handled your client's file in general, rather than the access request, goes on Form RC193 as a CRA service complaint.

On fees, section 11 of the Access to Information Act provides for an application fee of up to $25, and the regulations set it at $5 laws-lois.justice.gc.ca laws-lois.justice.gc.ca. The CRA's FAQ still describes hourly search and photocopy charges, but section 11 as it reads now contains only the application fee and the power to waive or refund it.

Will a formal request come back before a corporation has to object?

Your client is a corporation. The audit ends with a notice of reassessment dated December 1, 2026, so its 90 day objection deadline is March 1, 2027. You file an Access to Information Act request for the audit file, and the CRA receives it December 7, 2026.

Event	Date	Rule
Notice of reassessment	December 1, 2026	Informal request still allowed: case closed under 12 months, no objection
Formal request received	December 7, 2026	Clock starts
CRA response due	January 6, 2027	30 days, ATIA s. 7
Due with a 30 day extension	February 5, 2027	ATIA s. 9
Objection deadline	March 1, 2027	90 days from the notice date
Due with a 90 day extension	April 6, 2027	Past the objection deadline

A 30 day extension still lands before March 1, but section 9 caps nothing, so a longer one can run past the objection deadline laws-lois.justice.gc.ca. The objection deadline doesn't wait for the file: P148 counts it from the date of the notice canada.ca.

So run the routes in order. Ask the auditor informally the day the reassessment arrives, while that's still allowed. File the objection on time with the grounds you have. Then ask the appeals officer for the auditor's report and working papers, which P148 lists among the documents Appeals can send canada.ca. The audit process page has the earlier dates, including the 30 days on the proposal letter.

Why do pages come back blacked out, and how does cross consent help?

Section 241 of the Income Tax Act bars CRA officials from disclosing taxpayer information, but subsection 241(5) lets them give a taxpayer's information to that taxpayer and, with the taxpayer's consent, to anyone else laws-lois.justice.gc.ca. Information about other people in the file, such as a supplier, a related corporation or a spouse, is withheld unless those people consent.

The fix is cross consent. The CRA accepts written consent from anyone who may appear in the file, signed and dated within the last 30 days, with that person's two IDs, or a corporate profile and the signer's IDs for a corporation canada.ca. The informal guidelines need the same written, informed consent before an auditor releases third party information canada.ca. For a group audited together, get consent from every related entity when you file.

Don't use either route for routine documents. The ATIP Directorate no longer processes requests for proof of income statements from the last 10 years, notices of assessment or benefits information canada.ca. Those come from My Account or My Business Account canada.ca, and the CRA suggests representatives ask clients to download proof of income statements themselves canada.ca.

Not on your own. A request for an individual needs proof of authorization signed and dated by the client within the last 30 days, plus two of the client's IDs; a corporation's needs an officer or director on the registry to sign canada.ca. An informal request to the auditor is different: you can make it directly, within your authorization canada.ca.

No. The Privacy Act covers an individual's own information; a corporation's records go under the Access to Information Act with the $5 fee and an authorization from an officer or director listed on the corporate registry canada.ca.

No. P148 counts the deadline from the date of the notice, with no exception for a pending request canada.ca. If the deadline has passed, the one year extension rules are on the objection deadline page.

Up to 12 months after the case is closed, and only if no objection or appeal has been filed. After that the CRA tells you a formal request is needed canada.ca.