---
title: "Response to a request for access to personal information (APP 12), with refusal notice and correction options (APP 13)"
url: "https://ailawframework.com/precedents/privacy-data-protection-and-cyber/app-12-access-request-response-letter"
type: "precedent"
site: "AI Law Framework"
id: "a25-app-12-access-request-response-letter"
area_id: "A25"
kind: "letter"
ai_level: "yellow"
version: 1
task_ids: ["A25-A20260923-2"]
law_stated_as_at: "2026-10-18"
---

# Response to a request for access to personal information (APP 12), with refusal notice and correction options (APP 13)

> Letters for an organisation or agency answering an APP 12 access request: acknowledgment and identity check, giving access, refusing in whole or part on a listed ground with the written notice APP 12.9 requires, and…

Canonical page: https://ailawframework.com/precedents/privacy-data-protection-and-cyber/app-12-access-request-response-letter  
Law stated as at: 2026-10-18

Site index for agents: https://ailawframework.com/llms.txt

Letters for an organisation or agency answering an APP 12 access request: acknowledgment and identity check, giving access, refusing in whole or part on a listed ground with the written notice APP 12.9 requires, and the APP 13 correction and statement options.

## Key facts

- Kind: Letter. A letter or email you adapt and send.
- Practice area: [Privacy, Data Protection & Cyber](https://ailawframework.com/precedents/privacy-data-protection-and-cyber.md)
- Jurisdictions: Australia, Commonwealth
- AI level: Yellow. AI can help in set ways. A lawyer checks specific points before use.
- Law stated as at: 2026-10-18
- Status: Maintained. Checked on 2026-10-18 against the 4 authorities it cites, for Australia and Commonwealth.

## When to use it

Use when an APP entity receives a request from an individual (or their authorised representative) for the personal information it holds about them, including requests made as a step before litigation or a complaint. Agencies should also check whether the request is better handled under the FOI Act. Credit reporting requests follow Part IIIA instead.

## Used for these tasks

- [Assemble an access, deletion or correction response pack](https://ailawframework.com/practice/privacy-data-protection-and-cyber.md#A25-A20260923-2)

## How AI may be used

AI may locate and collate the records found by the search, draft the cover letter and prepare a redaction list for review; the lawyer or privacy officer decides what is personal information about the requester, which exceptions apply and what is released.

**AI may:**

- Collate the records returned by the system searches into an index with dates, sources and record types
- Mark passages that appear to contain other individuals’ personal information or privileged material, for human review
- Fill the acknowledgment and cover letters with the dates, request details and the response deadline

**AI must not:**

- Must not decide that an APP 12.2 or 12.3 exception applies, or apply redactions without human review
- Must not tell the individual that information does not exist unless the search record supports it
- Must not process the requester’s records in a tool that retains or trains on them, or outside the entity’s approved environment

**The lawyer checks:**

- The requester’s identity, or the representative’s authority, has been verified in a way proportionate to the sensitivity of the information
- The search covered every system that holds personal information about the individual, and the search is recorded
- Each refusal or redaction rests on a listed ground, and the refusal notice gives reasons (unless unreasonable) and the complaint mechanisms
- The response is sent within 30 days for an agency, or a reasonable period (generally no more than 30 calendar days) for an organisation

## Authorities

- [Privacy Act 1988 (Cth) Sch 1 APP 12 (access: exceptions for agencies and organisations; 30 days for agencies, a reasonable period for organisations; manner of access; charges; written notice of refusal)](https://www.legislation.gov.au/C2004A03712/latest/text)
- [Privacy Act 1988 (Cth) Sch 1 APP 13 (correction; notice of refusal; associating a statement)](https://www.legislation.gov.au/C2004A03712/latest/text)
- [Privacy Act 1988 (Cth) ss 36 and 40(1A) (complaint to the Commissioner; complainant must usually complain to the entity first)](https://www.legislation.gov.au/C2004A03712/latest/text)
- [OAIC, Australian Privacy Principles Guidelines, Chapter 12: APP 12 Access to personal information, paras 12.15 to 12.17 (verifying identity) and 12.66 to 12.68 (timing: 30 calendar days for agencies; a reasonable period for organisations should generally not exceed 30 calendar days)](https://www.oaic.gov.au/privacy/australian-privacy-principles/australian-privacy-principles-guidelines/chapter-12-app-12-access-to-personal-information)

## Full text and drafting notes

The full text and the drafting notes are not part of this public page. Signed-in firm accounts can read them at https://ailawframework.com/precedents/privacy-data-protection-and-cyber/app-12-access-request-response-letter and through the signed-in MCP connector https://ailawframework.com/mcp/firm.

*Practice guidance for planning and review. Confirm current primary sources and the requirements of the actual matter. This is general information, not legal advice.*