---
title: "Respond to a request for access to personal information the practice holds"
url: "https://ailawframework.com/obligations/confidentiality-and-client-information/respond-to-a-request-for-access-to-personal-information-the-practice-hol"
type: "task"
site: "AI Law Framework"
id: "A51-MA20261022-12"
practice_area: "Confidentiality & client information"
tier: "red"
lawyer_review: "required"
last_reviewed: "2026-10-22"
---

# Respond to a request for access to personal information the practice holds

> List the personal information the practice holds about the person who has asked, including information a contractor stores where the practice still has the right to deal with the record.…

Canonical page: https://ailawframework.com/obligations/confidentiality-and-client-information/respond-to-a-request-for-access-to-personal-information-the-practice-hol  
Last reviewed: 2026-10-22

Site index for agents: https://ailawframework.com/llms.txt

## Key facts

| Fact | Value |
| --- | --- |
| Practice area | [Confidentiality & client information](https://ailawframework.com/obligations/confidentiality-and-client-information.md) |
| Human involvement | Red: Lawyer writes; AI may check, clarify or collect data |
| How AI is used | List the personal information the practice holds about the person who has asked, including information a contractor stores where the practice still has the right to deal with the record. Note what was used to check identity, and whether a document was sighted rather than copied. List the ten grounds in APP 12.3 without selecting one: serious threat to life, health or safety, or to public health or public safety; unreasonable impact on the privacy of other individuals; frivolous or vexatious request; existing or anticipated proceedings between the organisation and the individual where the information would not be obtainable on discovery; prejudice to negotiations; access would be unlawful; denial required or authorised by an Australian law or a court or tribunal order; suspected unlawful activity or serious misconduct where access would be likely to prejudice appropriate action; prejudice to an enforcement body's enforcement related activities; and evaluative information tied to a commercially sensitive decision. Do not choose a ground. Do not draft the notice. |
| What the lawyer must review | Decide whether to give access and write any refusal notice. APP 12.1 requires an APP entity that holds personal information about an individual to give that individual access on request. For an organisation the response is within a reasonable period. The guidelines say that, as a general guide, a reasonable period should not exceed 30 calendar days, and that the response is either access or notice of refusal. An organisation must not charge for the making of the request. It may charge for giving access if the charge is not excessive, and the charge must not be used to discourage the request. If access is refused, or not given in the manner requested, APP 12.9 requires a written notice of the reasons, except to the extent that giving reasons would be unreasonable having regard to the grounds, the complaint mechanisms, and any other matter prescribed by regulation. The guidelines give a breach of legal professional privilege as one example of access that would be unlawful. The lawyer decides whether that example applies. Consider redaction before a refusal. Confirm the practice is an organisation, and read the regulations, before the notice is sent. |
| Written for / versions | 1 jurisdiction versions below |

## Checking plan

**Lawyer-led judgement**

The lawyer makes the substantive assessment. Any permitted AI assistance remains supporting work with its own checks.

- What the AI does: List the personal information the practice holds about the person who has asked, including information a contractor stores where the practice still has the right to deal with the record. Note what was used to check identity, and whether a document was sighted rather than copied. List the ten grounds in APP 12.3 without selecting one: serious threat to life, health or safety, or to public health or public safety; unreasonable impact on the privacy of other individuals; frivolous or vexatious request; existing or anticipated proceedings between the organisation and the individual where the information would not be obtainable on discovery; prejudice to negotiations; access would be unlawful; denial required or authorised by an Australian law or a court or tribunal order; suspected unlawful activity or serious misconduct where access would be likely to prejudice appropriate action; prejudice to an enforcement body's enforcement related activities; and evaluative information tied to a commercially sensitive decision. Do not choose a ground. Do not draft the notice.
- What the lawyer does: Decide whether to give access and write any refusal notice. APP 12.1 requires an APP entity that holds personal information about an individual to give that individual access on request. For an organisation the response is within a reasonable period. The guidelines say that, as a general guide, a reasonable period should not exceed 30 calendar days, and that the response is either access or notice of refusal. An organisation must not charge for the making of the request. It may charge for giving access if the charge is not excessive, and the charge must not be used to discourage the request. If access is refused, or not given in the manner requested, APP 12.9 requires a written notice of the reasons, except to the extent that giving reasons would be unreasonable having regard to the grounds, the complaint mechanisms, and any other matter prescribed by regulation. The guidelines give a breach of legal professional privilege as one example of access that would be unlawful. The lawyer decides whether that example applies. Consider redaction before a refusal. Confirm the practice is an organisation, and read the regulations, before the notice is sent.
- Who reviews: Responsible lawyer with competence in the matter
- Basis: Practical workflow informed by the linked primary sources; the traffic light and working checks are editorial guidance, not a court classification.
- Why: The level reflects what the work is, the consequence of an error, and how much of the output the lawyer must independently re-derive.
- Restriction: The lawyer makes the substantive assessment. Any permitted AI assistance remains supporting work with its own checks.

## Checks the lawyer makes

1. Do not refer the person to a storage provider if the practice still controls the record.
2. Seek only the minimum identity information, and prefer sighting a document to copying it.
3. Do not select an APP 12.3 ground. The lawyer does, after considering redaction.
4. The lawyer writes the notice, including reasons and complaint mechanisms where access is refused.

## Notes

- These are suggested working checks. Confirm the required checking with the responsible lawyer before work starts; the checking approach does not establish permission to use AI.

## Sources

- [OAIC APP guidelines, chapter 12: access to personal information](https://www.oaic.gov.au/privacy/australian-privacy-principles/australian-privacy-principles-guidelines/chapter-12-app-12-access-to-personal-information) (checked 2026-10-22)

## Jurisdiction versions

| Jurisdiction | Level |
| --- | --- |
| [United States](https://ailawframework.com/obligations/confidentiality-and-client-information/respond-to-a-request-for-access-to-personal-information-the-practice-hol/united-states.md) | Yellow |

*Practice guidance for planning and review. Confirm current primary sources and the requirements of the actual matter. This is general information, not legal advice.*