How Do I Respond to a Privacy Request?
Three questions. Get a ready-to-edit response letter for an access, correction, or automated decision explanation request — with the right legal grounds already filled in.
Under the Privacy Act 1988 (Cth), covered entities must respond to an access request (APP 12) or correction request (APP 13) within 30 days of receiving it. From 10 December 2026, individuals can also seek an explanation of an automated decision under APP 1.3. Refusal is only permitted on specific, narrow grounds — not for convenience or time pressure.
Last updated: 1 July 2026
What each request type covers
| Request type | Governing rule | Fee allowed? |
|---|---|---|
| Access — "what do you hold about me?" | APP 12 | Cost of providing access only, never for lodging |
| Correction — "fix what you hold about me" | APP 13 | No fee at any stage |
| Explanation of an automated decision | APP 1.3 (from 10 Dec 2026) | No fee — same 30-day expectation applies in practice |
How this is interpreted in practice
The most common mistake is treating "we're still gathering the records" as a valid reason to miss the 30-day deadline. It isn't. The correct response is to answer within 30 days with whatever you can confirm — even a partial answer — rather than staying silent until the file is complete. Silence, not a late or partial answer, is what generates OAIC complaints.
A second common error is refusing a request for a reason that isn't on the APP 12.3 list. "It's a lot of work" or "we don't have a system for this" are not grounds for refusal. Every refusal or partial refusal must cite one of the specific, named exceptions — and the letter must say which one applies.
For correction requests, businesses often forget the APP 13.4 fallback: even where you refuse to change the record, the individual can ask you to attach a statement noting they dispute its accuracy. You must do this at no charge if asked, regardless of your original decision.
Valid grounds for refusing access (APP 12.3)
| Ground | When it applies |
|---|---|
| Serious threat to life, health or safety | Providing access could endanger someone |
| Unreasonable impact on another's privacy | The record contains another individual's personal information |
| Frivolous or vexatious | The request is not made in good faith |
| Legal proceedings | Relates to proceedings and wouldn't be discoverable in them |
| Commercially sensitive decision-making | Would reveal a proprietary process, e.g. a scoring algorithm |
Rights request generator
Answer three questions. Get a response letter template with the correct legal references and grounds already filled in — ready to personalise, copy, and send.
Subject: Your access request under APP 12
Dear [Requester's name],
Thank you for your request for access to the personal information we hold about you. We are able to provide the following…
Plus a copy-to-clipboard letter with the correct legal references and refusal grounds pre-filled — generated from your three answers below.
When you need this
- — A customer, employee, or applicant has asked what personal information you hold about them
- — Someone has asked you to correct inaccurate or outdated information in their record
- — An individual has asked how an AI or automated system reached a decision affecting them
- — You need to refuse or partially refuse a request and want the correct legal grounds cited
- — You don't yet have a documented response process and the 30-day clock is already running
Frequently asked questions
How long do I have to respond to a privacy rights request?
30 days from when you receive the request, for both access (APP 12) and correction (APP 13) requests. The period is not extendable by choice — if you need more time, provide at least a partial response within 30 days and explain the delay.
Can I charge a fee to respond to an access request?
Yes, but only for the reasonable cost of providing access — never for lodging or processing the request. Correction requests under APP 13 must be handled free of charge at every stage.
On what grounds can I refuse an access request?
APP 12.3 lists specific grounds: serious threat to life, health or safety; unreasonable impact on another's privacy; frivolous or vexatious requests; legal proceedings; commercially sensitive decision-making; or unlawfulness. Inconvenience is not a valid ground.
What must a correction refusal letter include?
Under APP 13.4, if you refuse a correction, you must offer to attach a statement to the record noting the individual disputes its accuracy, at no charge, if they ask. Your letter should state the refusal reason and mention this right.
Do I have to explain an automated decision?
From 10 December 2026, APP 1.3 requires disclosure of ADM use in your privacy policy. An affected individual can ask how it worked and request human review. Full technical detail can be withheld only on narrow grounds such as commercial sensitivity — the right to request human review still applies.
Run the free response letter generator to get a compliant reply — with the right APP references and refusal grounds already filled in.
Get my response letter →