How access requests under the Privacy Act work

Most Australian businesses hold personal information without thinking much about it: customer names and email addresses, purchase histories, support tickets, account details. Under the Privacy Act 1988 (Cth), any individual whose information you hold can ask to see what you have, and in most cases you must give it to them. That request, and the process it sets in motion, is what privacy lawyers call an access request.

An access request form is the practical tool businesses use to manage that process: a standard way for someone to ask for the personal information you hold about them, and a consistent route for your team to verify who is asking, find the records and respond in time. The underlying mechanism matters because it carries real consequences. Get the process right and access requests become a low-cost exercise in trust. Get it wrong and they become complaints, regulator investigations and reputational damage.

This guide explains how the access request mechanism actually operates: who is involved, what triggers it, the stages a business works through, when access can be refused, what you can charge, and where businesses most often trip up.

Who is involved

Three parties drive the mechanism:

The individual: anyone whose personal information your business holds. They have the right to request access under APP 12, and the related right to request correction under APP 13.
Your business: the APP entity that holds the information and must respond. Under s 15 of the Privacy Act, an APP entity must not do an act or engage in a practice that breaches an Australian Privacy Principle, so the obligation is legally binding rather than aspirational.
The Office of the Australian Information Commissioner: the regulator (OAIC) that receives complaints about APP breaches and can investigate conduct, with powers that include making determinations and seeking civil penalties.

First, check whether the mechanism applies to your business

The access right applies to APP entities: Australian Government agencies, and organisations. For most businesses the question is whether you count as an organisation under the Act, and the key carve-out is the small business exemption. Under s 6D of the Privacy Act, a business with an annual turnover of $3 million or less for the previous financial year is a small business, and small business operators are generally outside the Privacy Act's reach.

The exemption does not protect everyone. Small businesses that are health service providers, that trade in personal information, or that fall into a handful of other categories, including credit reporting, are still covered, as the OAIC explains in its guidance for organisations. And the exemption is not a reason to ignore the mechanism entirely. Adopting a standard access process costs little, builds customer confidence, and means you are ready the day your turnover crosses the threshold or a new obligation lands.

If the Act does not apply to you, the rest of this article still describes good practice. If it does apply, the following stages are legally required.

What triggers the mechanism: the request

The mechanism starts with a request, and there are no formal requirements about how it must be made. An individual can ask for access by email, letter, phone, in person, or through a lawyer. The OAIC's guidance on dealing with access requests is explicit that you may ask an individual to follow a particular procedure, such as filling out a form, but you cannot require them to do so. An access request form is therefore a convenience for you and the requester, not a legal gate that lets you ignore requests arriving through other channels.

The request must be for personal information that you hold. Personal information is information or an opinion about an identified or reasonably identifiable individual. You hold information if it is in your possession or control, which includes records stored for you by a third party such as a cloud provider. Importantly, the right is not a right to documents in general: an individual cannot demand your internal files wholesale, only the personal information about them contained in those files.

A well-designed form captures what you need to act: the individual's identity, the scope of what they want (all data, a date range, a particular system), their preferred format, and any context such as order numbers that will help you locate records. But treat the form as an intake tool, not a precondition.

Stage one: verify who is asking

Before you release anything, you must be satisfied the request comes from the individual concerned, or from someone authorised to act on their behalf, such as a legal guardian, power of attorney holder or authorised agent. The OAIC's guidance is to ask for whatever evidence you reasonably need to confirm identity, while keeping enough flexibility that someone without standard identification can still get their own information.

Two practical rules come out of the regulator's guidance. First, it is preferable to sight identity documents rather than copy and retain them: every copy you keep is personal information you then have to store, protect and eventually disclose. Second, if you are not sure of the individual's identity, do not disclose the information. An identity failure can turn a routine request into a data breach of someone else's information.

Stage two: locate the information

You only have to give access to information you hold, but working out what you hold is often the hardest part. The OAIC expects you to search the records in your possession or control, including hard copy files, electronic databases, emails and calendars, and to make enquiries of staff and contractors with relevant knowledge. Records held by an outsourced provider still count if you retain the right to deal with them.

This is where a data map earns its keep. If you know which systems hold customer data, who owns each system and how to extract from it, a request that would otherwise take weeks of archaeology takes hours. If you discover you cannot locate records that should exist, that is usually a sign of a bigger problem: retention practices that an individual's access and correction rights will eventually expose.

Stage three: respond within the clock

APP 12 requires you to respond to a request within a reasonable period, and to give access in the manner requested where it is reasonable and practicable to do so. Government agencies have a hard statutory deadline of 30 days under APP 12.4. For organisations, the OAIC takes the position that in most cases a reasonable period will not exceed 30 calendar days. Treat 30 days as your operating benchmark, and set internal deadlines that leave buffer for review and delivery.

The manner of access matters. If someone asks for an electronic copy, or to inspect records, or to have information read out, you should accommodate them unless it is unreasonable or impracticable. Where the requested manner genuinely cannot work, APP 12 requires you to take reasonable steps to give access another way that meets both your needs and the individual's: a summary, a redacted copy, supervised inspection of hard copy records, or access through a mutually agreed intermediary. Refusing the requested manner without offering a workable alternative is a common and avoidable breach.

Stage four: when access can be refused

Access is the default; refusal is the exception. For organisations, APP 12.3 sets out ten grounds on which access can be refused, to the extent the ground applies:

Serious threat: you reasonably believe access would pose a serious threat to the life, health or safety of any individual, or to public health or public safety.
Others' privacy: giving access would have an unreasonable impact on the privacy of other individuals.
Frivolous or vexatious: the request itself is frivolous or vexatious.
Legal proceedings: the information relates to existing or anticipated proceedings between you and the individual and would not be accessible by discovery.
Negotiations: access would reveal your intentions in negotiations with the individual in a way that prejudices them.
Unlawful: giving access would be unlawful.
Required by law: denying access is required or authorised by an Australian law or a court or tribunal order.
Serious misconduct: you have reason to suspect unlawful activity or serious misconduct relating to your functions or activities, and access would prejudice appropriate action.
Enforcement: access would prejudice enforcement related activities conducted by or on behalf of an enforcement body.
Commercial evaluation: access would reveal evaluative information generated within your entity in connection with a commercially sensitive decision-making process.

Note the words "to the extent that". A ground rarely justifies refusing everything: it justifies withholding what the ground actually protects. If a document contains third-party information, for example, you redact that portion and provide the rest. The OAIC's guidance lists alternatives such as deleting the protected material and providing a redacted version, or giving a summary.

If you do refuse, in whole or in part, APP 12.9 requires a written notice setting out the reasons and the mechanisms available to complain about the refusal, including the OAIC. A refusal made without a supporting ground, or without that notice, is itself a breach, and it is the most common way a request escalates into a formal complaint.

Stage five: what you can charge

Two fee rules are easy to remember. First, you must never charge for the making of the request: no application fee at the front door. Second, if you charge for giving access, the charge must not be excessive, as APP 12.8 provides. The OAIC's guidance explains what can be included: staff time spent searching, retrieving, reproducing and sending the information, and the cost of postage or materials. Labour should generally be charged at a clerical rate for clerical work.

What you cannot do is use the fee as a deterrent or a cost-recovery vehicle for your own problems. The OAIC treats as potentially excessive a charge that includes the cost of legal advice about how to respond, a charge that reflects shortcomings in your information management systems, or a charge that ignores the individual's circumstances and capacity to pay. If you intend to charge, tell the individual up front what the work will cost before you do it.

Correction: the sibling right

The access mechanism has a close relative. Under APP 13, an individual who believes information about them is inaccurate, out of date, incomplete, irrelevant or misleading can ask you to correct it, and you must take reasonable steps to do so. You must respond within a reasonable period, you must not charge for the making of the request or for the correction, and if you refuse to correct, the individual can ask you to associate a statement with the information recording their view.

In practice the two rights arrive together. Someone who requests access is frequently checking whether what you hold is right. Handling the correction side as part of the same workflow, with the same logging and deadlines, is simpler than treating them as separate processes.

Where the mechanism typically goes wrong

Most problems trace back to a handful of recurring mistakes:

Treating the form as mandatory: refusing to process a request made by email or phone breaches APP 12 and turns a reasonable request into a regulator complaint.
Over-collecting identification: copying passports and driver licences just in case creates new holdings of sensitive information that you then have to protect and disclose, and it sits awkwardly with APP 3.2, which stops organisations collecting personal information unless it is reasonably necessary.
Missing the clock: no register, no deadline tracking, and a request quietly sits unanswered. The OAIC's 30-day benchmark is not a target you can miss by much.
Not knowing where data lives: if records sit in a departed staff member's inbox or an unindexed legacy system, you cannot respond within a reasonable period no matter how hard you try.
Refusing wholesale instead of redacting: a ten-ground refusal list tempts businesses to refuse everything. The law expects you to refuse only to the extent of the ground, and to give a written notice with reasons and complaint avenues.
Confusing access with document production: the right is to personal information, not to every document your business holds. Drawing responses along that line, and getting advice when a file mixes personal, third-party and confidential material, is where the real skill lies.

When a lawyer helps

Three points in the mechanism justify professional help. Before anything happens, a lawyer can draft an access request form and privacy policy that match your actual systems, and can check that your collection practices do not over-reach. APP 1 requires your privacy policy to explain how individuals can access and correct their information, and the form and the policy need to tell a consistent story.

During a live request, legal input is most valuable exactly where the risk concentrates: deciding whether a refusal ground applies, working out what to redact when a file contains third-party or privileged material, and responding to a complaint or an OAIC investigation if things have already escalated. Refusals are decisions you cannot easily walk back, and the notice you give under APP 12.9 is scrutinised by the regulator.

Finally, an advisor can stress-test the process itself: whether your data map is current, whether your team knows the escalation path, and whether your response times survive a busy quarter. Privacy enforcement in Australia has become markedly more serious in recent years, with higher penalties and a statutory tort for serious invasions of privacy now in the Privacy Act itself, so the cost of a sloppy process is no longer theoretical.

The refusal decision is where the risk concentrates

If there is one part of the mechanism to get right, it is the refusal decision. Everything else, verification, searching, the response clock, is process you can build and improve. A refusal, by contrast, is a judgment call that ends the cooperative phase of the relationship and invites scrutiny. Refuse on a ground that does not actually apply, or refuse without the written notice APP 12.9 requires, and you have converted a manageable request into a breach of the Privacy Act with a regulator one complaint away.

The leverage sits on your side early. A standard form, a data map, a register with deadlines and a short escalation playbook cost little to put in place, and they make access requests routine rather than frightening. When a hard call does arrive, whether a ground applies or how much to redact, that is the moment to spend a modest amount on legal advice rather than defend a refusal later. A short consultation to set the process up, or to assess a specific request, is usually far cheaper than the alternative.