Respond to a request for access to personal information
Key facts
- Human involvement
- YellowClose supervision
- How AI is used
- From the request and the file index, list what was asked for, the date received, and whether the client is recorded as an agency or an organisation. Leave the grant or refusal, any charge, and the form of access blank. The tool does not write the refusal notice.
- What the lawyer must review
- OAIC Chapter 12 says an APP entity that holds personal information must, on request, give the individual access unless a refusal ground applies. An agency must respond within 30 calendar days, starting the day after the request is received, by giving access or notifying a refusal. An organisation must respond within a reasonable period. The chapter says that, as a general guide, a reasonable period should not exceed 30 calendar days. Access is given in the manner requested if reasonable and practicable. If access or that manner is refused on a permitted ground, reasonable steps are taken to give access another way, within 30 calendar days where practicable. An agency cannot charge for the request or for giving access. An organisation cannot charge for making the request, and may charge for giving access only if the charge is not excessive. A refusal is given in writing with the reasons and the complaint mechanisms. For an organisation, APP 12.3 lists ten grounds, including a serious threat to life, health or safety, an unreasonable impact on another person's privacy, a frivolous or vexatious request, information for existing or anticipated proceedings that would not be available on discovery, prejudice to negotiations, unlawfulness, a law or order requiring or authorising refusal, prejudice to action on suspected unlawful activity or serious misconduct, prejudice to an enforcement related activity, and evaluative information in a commercially sensitive decision. Redaction should be considered before a refusal. The detailed tests for several of those grounds sit in later paragraphs and in Chapter C, which was not applied beyond the list and the unreasonable-impact factors that were read. This is not a notifiable-breach assessment.
- Written for / version
- US
Open a jurisdiction version of this task to see which instruments apply: US
Who does what
| Role | What they do |
|---|---|
| Assistance | From the request and the file index, list what was asked for, the date received, and whether the client is recorded as an agency or an organisation. Leave the grant or refusal, any charge, and the form of access blank. The tool does not write the refusal notice. |
| Lawyer | Set the scope, supervise the work closely, verify every part relied on, resolve omissions and exceptions, and approve the exact output. |
Checklist
- Diary 30 calendar days as the agency period, or as the chapter's general outer guide for an organisation. The organisation period is a reasonable period, not a fixed 30 days.
- Do not add a charge for making the request. An organisation's charge for giving access must not be excessive. An agency charges nothing.
- Consider redaction before a refusal. The lawyer chooses any ground. The tool does not write the refusal notice.
- Do not treat this as a data-breach assessment or as a collection notice.
Sources
These are suggested working checks. Confirm the required checking with the responsible lawyer before work starts; the checking approach does not establish permission to use AI.