---
title: "Respond to a request to correct personal information the practice holds"
url: "https://ailawframework.com/obligations/confidentiality-and-client-information/respond-to-a-request-to-correct-personal-information-the-practice-holds"
type: "task"
site: "AI Law Framework"
id: "A51-MA20261022-17"
practice_area: "Confidentiality & client information"
tier: "red"
lawyer_review: "required"
last_reviewed: "2026-10-22"
---

# Respond to a request to correct personal information the practice holds

> From the request, record the date it was received, whether it asks for correction or for a statement to be associated, the personal information concerned, and what the individual says is inaccurate, out of date,…

Canonical page: https://ailawframework.com/obligations/confidentiality-and-client-information/respond-to-a-request-to-correct-personal-information-the-practice-holds  
Last reviewed: 2026-10-22

Site index for agents: https://ailawframework.com/llms.txt

## Key facts

| Fact | Value |
| --- | --- |
| Practice area | [Confidentiality & client information](https://ailawframework.com/obligations/confidentiality-and-client-information.md) |
| Human involvement | Red: Lawyer writes; AI may check, clarify or collect data |
| How AI is used | From the request, record the date it was received, whether it asks for correction or for a statement to be associated, the personal information concerned, and what the individual says is inaccurate, out of date, incomplete, irrelevant or misleading. Record whether any charge was requested. Do not decide that the information is incorrect. Do not write a refusal notice or a correction. |
| What the lawyer must review | The lawyer decides whether to correct the information and writes any refusal notice. OAIC Chapter 13 says APP 13.1 requires an APP entity to take reasonable steps to correct personal information it holds so that, having regard to the purpose for which it is held, it is accurate, up-to-date, complete, relevant and not misleading. The entity holds personal information if it has possession or control of a record containing it, citing section 6(1), including a record stored by someone else if the entity retains the right to deal with it. Correction is required on the entity's own initiative and on request. A request need not be in writing and need not be labelled as an APP 13 request. The entity must be satisfied the request is made by the individual or by a person authorised to make it. If the entity refuses, APP 13.3 requires a written notice setting out the reasons, except to the extent it would be unreasonable to give them, the complaint mechanisms available, and any other matters prescribed by regulations. Those regulations were not opened. Paragraph 13.54's notice is the lawyer's. Paragraph 13.55 says the reasons should explain, where applicable, that the entity does not hold the information, that it is satisfied the information is accurate, up-to-date, complete, relevant and not misleading for the purpose for which it is held, or that the steps requested are not reasonable. Paragraph 13.57 says the complaint mechanisms should explain a written complaint to the entity first, citing section 40(1A), a reasonable time to respond, usually 30 days, then a recognised external dispute resolution scheme of which the entity is a member, if any, and a complaint to the Information Commissioner, citing section 36. Paragraph 13.58 says the individual should be told of the right to ask that a statement be associated. APP 13.4 requires reasonable steps, if that request is made, to associate a statement that the individual believes the information is inaccurate, out-of-date, incomplete, irrelevant or misleading, in a way apparent to users of the information. APP 13.5 says an agency must respond to a correction or statement request within 30 calendar days, starting on the day after the day the request is received. An organisation must respond within a reasonable period. As a general guide, a reasonable period should not exceed 30 calendar days. The response is either the correction or notice of refusal. APP 13.5(b) says the entity cannot charge for the request, the correction, or associating a statement. The lawyer confirms the Privacy Act applies. This is not a credit-reporting correction under Part IIIA, and it is not a request for access. |
| Written for / versions | 1 jurisdiction versions below |

## Checking plan

**Lawyer-led judgement**

The lawyer makes the substantive assessment. Any permitted AI assistance remains supporting work with its own checks.

- What the AI does: From the request, record the date it was received, whether it asks for correction or for a statement to be associated, the personal information concerned, and what the individual says is inaccurate, out of date, incomplete, irrelevant or misleading. Record whether any charge was requested. Do not decide that the information is incorrect. Do not write a refusal notice or a correction.
- What the lawyer does: The lawyer decides whether to correct the information and writes any refusal notice. OAIC Chapter 13 says APP 13.1 requires an APP entity to take reasonable steps to correct personal information it holds so that, having regard to the purpose for which it is held, it is accurate, up-to-date, complete, relevant and not misleading. The entity holds personal information if it has possession or control of a record containing it, citing section 6(1), including a record stored by someone else if the entity retains the right to deal with it. Correction is required on the entity's own initiative and on request. A request need not be in writing and need not be labelled as an APP 13 request. The entity must be satisfied the request is made by the individual or by a person authorised to make it. If the entity refuses, APP 13.3 requires a written notice setting out the reasons, except to the extent it would be unreasonable to give them, the complaint mechanisms available, and any other matters prescribed by regulations. Those regulations were not opened. Paragraph 13.54's notice is the lawyer's. Paragraph 13.55 says the reasons should explain, where applicable, that the entity does not hold the information, that it is satisfied the information is accurate, up-to-date, complete, relevant and not misleading for the purpose for which it is held, or that the steps requested are not reasonable. Paragraph 13.57 says the complaint mechanisms should explain a written complaint to the entity first, citing section 40(1A), a reasonable time to respond, usually 30 days, then a recognised external dispute resolution scheme of which the entity is a member, if any, and a complaint to the Information Commissioner, citing section 36. Paragraph 13.58 says the individual should be told of the right to ask that a statement be associated. APP 13.4 requires reasonable steps, if that request is made, to associate a statement that the individual believes the information is inaccurate, out-of-date, incomplete, irrelevant or misleading, in a way apparent to users of the information. APP 13.5 says an agency must respond to a correction or statement request within 30 calendar days, starting on the day after the day the request is received. An organisation must respond within a reasonable period. As a general guide, a reasonable period should not exceed 30 calendar days. The response is either the correction or notice of refusal. APP 13.5(b) says the entity cannot charge for the request, the correction, or associating a statement. The lawyer confirms the Privacy Act applies. This is not a credit-reporting correction under Part IIIA, and it is not a request for access.
- Who reviews: Responsible lawyer with competence in the matter
- Basis: Practical workflow informed by the linked primary sources; the traffic light and working checks are editorial guidance, not a court classification.
- Why: The level reflects what the work is, the consequence of an error, and how much of the output the lawyer must independently re-derive.
- Restriction: The lawyer makes the substantive assessment. Any permitted AI assistance remains supporting work with its own checks.

## Checks the lawyer makes

1. The lawyer writes any refusal notice. The extraction does not become that notice.
2. A request need not be in writing. Record the date it was received, including an oral request the lawyer has noted.
3. For an organisation, the guide is a reasonable period not exceeding 30 calendar days. Do not treat the agency's 30-day rule as if it were the organisation rule without the lawyer saying so.
4. Do not ask the individual to pay for the request, the correction, or a statement.

## Notes

- These are suggested working checks. Confirm the required checking with the responsible lawyer before work starts; the checking approach does not establish permission to use AI.

## Sources

- [OAIC APP guidelines, Chapter 13: APP 13 correction of personal information](https://www.oaic.gov.au/privacy/australian-privacy-principles/australian-privacy-principles-guidelines/chapter-13-app-13-correction-of-personal-information) (checked 2026-10-22)

## Jurisdiction versions

| Jurisdiction | Level |
| --- | --- |
| [United States](https://ailawframework.com/obligations/confidentiality-and-client-information/respond-to-a-request-to-correct-personal-information-the-practice-holds/united-states.md) | Yellow |

*Practice guidance for planning and review. Confirm current primary sources and the requirements of the actual matter. This is general information, not legal advice.*