Letter · Privacy, Data Protection & Cyber
Response to a request for access to personal information (APP 12), with refusal notice and correction options (APP 13)
Letters for an organisation or agency answering an APP 12 access request: acknowledgment and identity check, giving access, refusing in whole or part on a listed ground with the written notice APP 12.9 requires, and the APP 13 correction and statement options.
- Kind
- Letter. A letter or email you adapt and send.
- Where it applies
- Australia, Commonwealth
- AI use
- Yellow AI can help in set ways. A lawyer checks specific points before use.
- Law stated as at
- 18 October 2026
- Status
- Maintained. Checked on 18 October 2026 against the 4 authorities it cites, for Australia and Commonwealth.
- Version
- 1
- Source
- Written for this library
When to use it
Use when an APP entity receives a request from an individual (or their authorised representative) for the personal information it holds about them, including requests made as a step before litigation or a complaint. Agencies should also check whether the request is better handled under the FOI Act. Credit reporting requests follow Part IIIA instead.
How AI may be used
AI may locate and collate the records found by the search, draft the cover letter and prepare a redaction list for review; the lawyer or privacy officer decides what is personal information about the requester, which exceptions apply and what is released.
AI may
- Collate the records returned by the system searches into an index with dates, sources and record types
- Mark passages that appear to contain other individuals’ personal information or privileged material, for human review
- Fill the acknowledgment and cover letters with the dates, request details and the response deadline
AI must not
- Must not decide that an APP 12.2 or 12.3 exception applies, or apply redactions without human review
- Must not tell the individual that information does not exist unless the search record supports it
- Must not process the requester’s records in a tool that retains or trains on them, or outside the entity’s approved environment
The lawyer checks
- The requester’s identity, or the representative’s authority, has been verified in a way proportionate to the sensitivity of the information
- The search covered every system that holds personal information about the individual, and the search is recorded
- Each refusal or redaction rests on a listed ground, and the refusal notice gives reasons (unless unreasonable) and the complaint mechanisms
- The response is sent within 30 days for an agency, or a reasonable period (generally no more than 30 calendar days) for an organisation
Method: how the Green, Yellow and Red levels are decided. This is guidance for planning, not legal advice.
Read the full text
The full text is for signed-in accounts. It is free. When you sign in you can:
- read the whole precedent, with its drafting notes beside it;
- copy it, or download it as a Word file or Markdown;
- add it to your firm’s knowledge base, so colleagues can find it;
- let the AI tools you connect read it from that knowledge base.
The summary, the law it rests on and the AI-use guidance above stay public. Privacy.
More in Privacy, Data Protection & Cyber
- Data breach response plan (Notifiable Data Breaches scheme, with cyber reporting clocks)
- Notification of an eligible data breach to affected individuals (Privacy Act s 26WL), with the public-notice option
- Notifiable data breach statement to the OAIC: completion guide for the online form
- APP privacy policy with AI and automated-decision disclosures (APP 1.4 and APP 1.7 to 1.9)
- Letter of demand for a serious invasion of privacy (statutory tort, Privacy Act Sch 2): take-down, undertakings and remedies
- Collection notice (APP 5) for forms, websites, apps and call scripts
- Serious invasion of privacy (statutory tort, Privacy Act Sch 2): claim assessment checklist
- Data protection clause for service providers, including AI vendors (no training, retention, offshore disclosure)
- AI and automated decisions clause for privacy policies and collection notices
- Privacy impact assessment checklist for an AI tool (supplement to the OAIC PIA tool)
All precedents for Privacy, Data Protection & Cyber · Tasks and AI use in this area