Letter · Privacy, Data Protection & Cyber
Response to a direct marketing opt-out or source request (APP 7.6 and 7.7)
Standard replies for an organisation that receives a request to stop direct marketing, to stop using or disclosing information to facilitate others’ marketing, or to name the source of the information: no charge, given effect within a reasonable period, and a handling record.
- Kind
- Letter. A letter or email you adapt and send.
- Where it applies
- Australia
- AI use
- Green AI can do most of the drafting. A lawyer still reviews the result.
- Law stated as at
- 18 October 2026
- Status
- Maintained. Checked on 18 October 2026 against the 2 authorities it cites, for Australia.
- Version
- 1
- Source
- Written for this library
When to use it
Use when an individual asks an organisation to stop sending direct marketing, to stop sharing their information for other organisations’ marketing, or to say where it got their details. Check first whether the Spam Act 2003, the Do Not Call Register Act 2006 or another law listed in APP 7.8 applies instead.
Used for these tasks
Each task page says how far AI may help with the task and what the lawyer must review.
How AI may be used
With these replies settled by the firm, AI may pick the right reply, fill it from the request and the marketing system records, and log it; the privacy officer checks each source statement and any refusal to name a source.
AI may
- Classify the request as an opt-out, a do-not-share request, a source request or a combination
- Fill the reply from the request and the CRM or marketing list records, including the source recorded for the individual
- Record the request, the date given effect and the systems updated in the log
AI must not
- Must not decide that naming the source is impracticable or unreasonable
- Must not charge, or ask the individual to justify the request
- Must not tell the individual their details have been removed until every marketing system and list provider has been updated
The lawyer checks
- The opt-out has been applied across all channels and lists, including lists shared with other organisations, within a reasonable period
- The source named matches the organisation’s records; any decision not to name it is recorded with reasons
- Whether the Spam Act, the Do Not Call Register Act or another APP 7.8 law applies to the channel has been checked
Method: how the Green, Yellow and Red levels are decided. This is guidance for planning, not legal advice.
Read the full text
The full text is for signed-in accounts. It is free. When you sign in you can:
- read the whole precedent, with its drafting notes beside it;
- copy it, or download it as a Word file or Markdown;
- add it to your firm’s knowledge base, so colleagues can find it;
- let the AI tools you connect read it from that knowledge base.
The summary, the law it rests on and the AI-use guidance above stay public. Privacy.
More in Privacy, Data Protection & Cyber
- Response to a request for access to personal information (APP 12), with refusal notice and correction options (APP 13)
- Data breach response plan (Notifiable Data Breaches scheme, with cyber reporting clocks)
- Notification of an eligible data breach to affected individuals (Privacy Act s 26WL), with the public-notice option
- Notifiable data breach statement to the OAIC: completion guide for the online form
- Does the Privacy Act apply? Small business exemption assessment checklist and advice note (Privacy Act ss 6C to 6EA)
- Employee records exemption: assessment checklist for a planned use of staff information (Privacy Act s 7B(3))
- APP privacy policy with AI and automated-decision disclosures (APP 1.4 and APP 1.7 to 1.9)
- Letter of demand for a serious invasion of privacy (statutory tort, Privacy Act Sch 2): take-down, undertakings and remedies
- Collection notice (APP 5) for forms, websites, apps and call scripts
- De-identification assessment record before a dataset is shared or released (Privacy Act s 6 definitions)
- Serious invasion of privacy (statutory tort, Privacy Act Sch 2): claim assessment checklist
- Data protection clause for service providers, including AI vendors (no training, retention, offshore disclosure)
- AI and automated decisions clause for privacy policies and collection notices
- Privacy impact assessment checklist for an AI tool (supplement to the OAIC PIA tool)
All precedents for Privacy, Data Protection & Cyber · Tasks and AI use in this area