Privacy Ready
← Learn

APP 12: Access to Personal Information

Last updated 22 July 2026 · Reviewed by The PrivacyReady compliance team

The short answer

Australian Privacy Principle 12 gives individuals the right to request access to the personal information your business holds about them, and requires you to respond within 30 days. A reasonable fee may be charged for the cost of providing access, but never for lodging the request. Access can only be refused on the specific, narrow grounds listed in APP 12.3 — inconvenience or workload are not valid reasons to decline.

Governing provision Privacy Act 1988 (Cth), Schedule 1, APP 12
Response deadline 30 days from receiving the request
Fees Reasonable cost of providing access only — not for lodging
Refusal grounds Limited — specifically listed in APP 12.3
Format Preferred format of the individual must be considered where practicable

What triggers an access request

Any communication from an individual asking what personal information you hold about them activates APP 12 — it does not need formal language or a specific form. "Can you tell me what information you have on me?" sent to a general support inbox is an access request the moment your team reads it.

What you must do within 30 days

  1. Verify the requester's identity using reasonable steps proportionate to the sensitivity of the information.
  2. Search all systems where you might hold data about them — CRM, email history, accounting software, paper files, backups.
  3. Assess whether any of the narrow APP 12.3 refusal grounds apply.
  4. Provide access in the individual's preferred format where reasonably practicable.
  5. Respond in writing within 30 days — even a refusal must be communicated in writing, citing the specific ground relied on.

When you can refuse

APP 12.3 lists specific, narrow grounds for refusal, including: a serious threat to life, health, or safety would result; it would have an unreasonable impact on another individual's privacy; the request is frivolous or vexatious; the information relates to existing or anticipated legal proceedings; providing access would reveal a commercially sensitive decision-making process; or access would be unlawful or would prejudice enforcement-related activities. "It would take too long" is not a valid ground.

Frequently asked questions

What if the requester is not a current customer, just someone who contacted us once?

The right applies to anyone whose personal information you hold, regardless of whether they are a current, former, or prospective customer. If you no longer hold their information, you must tell them that within the 30-day window.

Can I charge a fee for compiling the response?

Yes, but only the reasonable cost of providing access — not for lodging or processing the request itself, and the fee must not be set at a level that deters people from exercising their rights.

What if I genuinely can't compile everything within 30 days?

The 30-day limit is not extendable by choice. If more time is genuinely needed, communicate with the individual promptly, explain why, and aim to provide at least a partial response within the 30 days. Silence generates the most OAIC complaints — a late but communicated response is far better than none.

Does an access request cover backups and archived emails?

Technically, APP 12 applies to all personal information you "hold," which can include backups. The OAIC's guidance on "reasonable steps" acknowledges that searching every backup may be disproportionate — document what you searched and be transparent with the requester about the scope (check current OAIC guidance for the precise position).

Use the free Rights Request Response Letter Generator to build a ready-to-edit APP 12 response letter with the correct grounds already filled in.

Generate my response letter →

Explore more of the Privacy Act