Request letter templates
Australian Privacy Act access request template (APP 12)
Quick answer
Copy the letter below, fill in the [brackets] and send it to the organisation or agency that holds your information. Under APP 12 of the Privacy Act you can ask for access to your personal information, including health information. Making the request is free, organisations should respond within about 30 days, and agencies must respond within 30 days and can't charge.
All privacy laws“An organisation or agency must give you access to your personal information when you request it, except where the law allows them to refuse your request.”
- Applies in
- Australia (Commonwealth)
- Companies must answer within
- Agencies: within 30 days (APP 12.4(a)(i)). Organisations: within a reasonable period (APP 12.4(a)(ii)), which the OAIC considers to be 30 days.
- Last updated
Head of Product & Co-Founder
Reviewed by Ludwig Sandgren
Head of Legal
Serus is a privacy company with paid tools to find and remove your personal data. This page is free and based on official sources.
Sources checked: oaic.gov.au, legislation.gov.au
Last verified against the official page:
Australian Government agencies and organisations covered by the Privacy Act, which generally means businesses with annual turnover over $3 million plus some others. Small businesses with turnover of $3 million or less are generally not covered.
Your rights
-
Right of access
A general right to access the personal information an agency or covered organisation holds about you, including health information (APP 12).
-
Charges kept in check
Asking is free. An organisation may charge for giving access, but not excessively, and agencies can't charge at all (APP 12).
-
Reasons if refused
A refusal must generally be in writing, with the reasons and how to complain (APP 12).
-
Right to correction
Ask for incorrect information to be corrected, free of charge; correction can include deleting information (APP 13).
General information, not legal advice.
How to use it
- 1
Contact the organisation or agency that holds the information
Send the letter to its privacy contact, usually listed in its privacy policy. Only you or someone you've authorised, such as a legal guardian or an authorised agent, can request access. Police records go to the AFP or your state police.
- 2
Put it in writing and be ready to prove who you are
You can ask in other ways, but you may be asked to make the request in writing and to provide identifying information. The organisation has to be satisfied the request comes from you or someone you've authorised.
- 3
Expect a response in about 30 days
Access should be given the way you asked, if that's reasonable and practical, or in a way that meets both sides' needs. If there's a charge, ask for an estimate first and whether email instead of post would lower it.
- 4
Ask for corrections
If something's wrong, ask the organisation to correct it under APP 13. It's free, and according to the OAIC, correction can include deleting information.
- 5
Complain to the organisation, then the OAIC
If there's no response within 30 days or you're unhappy with it, complain to the organisation first, then lodge a written complaint with the OAIC. Our Privacy Act page covers what happens next.
No answer in time? Complain to Office of the Australian Information Commissioner (OAIC) .
The letter
Fill in the parts in [brackets] before you send it.
Subject: Request for access to my personal information (APP 12) [Your full name] [Your postal address] [Your email address and phone number] [Date] To: Privacy Officer, [Organisation or agency name] [Postal address or privacy email address] Dear Privacy Officer, Under Australian Privacy Principle 12 of the Privacy Act 1988, I am requesting access to the personal information you hold about me. The information I am asking for: [Describe it as precisely as you can, for example "my customer file, including notes of calls between [date] and [date]" or "all personal information you hold about me".] To help you find it: - Name(s) I have used with you: [current and any previous names] - Customer, account or reference number: [number, if any] - Other contact details you may hold: [email addresses, phone numbers or previous addresses] How I would like to receive it: [a copy by email to the address above] [a copy by post] [over the phone] [by inspecting it in person]. [If someone else will receive it for you: I authorise [name of person or organisation] to access this information on my behalf.] If you intend to charge for giving me access, please tell me the likely charge before you proceed, and any way to reduce it, such as sending the information by email rather than post. If you need to confirm my identity, please tell me what you need. I understand that you should respond within a reasonable period, which the OAIC considers to be 30 days. Yours sincerely, [Your name]
What to put in it
The OAIC lists four things to include: your name and contact details, the information you want, how you want to get it, and whether you've authorised someone else to receive it for you. The letter covers all four. The more precisely you describe the information, the easier it is to find.
You can choose how you get access: a copy by email or post, the information read to you over the phone, or a visit in person to look at it. If the organisation charges, asking for email rather than post can reduce the cost.
Access, then deletion
The Privacy Act has no standalone right to erasure. Once you know what's held, you can ask for corrections, which can include deleting information, and point out that organisations must destroy or de-identify information they no longer need (APP 11.2). Our guide to removing your personal information in Australia covers the next steps, and what to do when a company won't delete your account covers pushing back.
Where Serus fits
An access request works one organisation at a time, and it generally doesn't reach small businesses. Serus finds the data brokers and people-search sites that list you where you live, sends the removal requests, follows up and checks for relistings. For one company, this letter does the job. Run a free scan to see where else you're listed.
Data brokers that list people in Australia
Each guide shows how to opt out of that site, step by step.
- Remove yourself from Equifax
- Remove yourself from InfoTracer
- Remove yourself from LiveRamp
- Remove yourself from RecordsFinder
- Remove yourself from Experian Marketing Services
- Remove yourself from Adstra (American List Counsel)
- Remove yourself from Anteriad
- Remove yourself from Experian Australia
Let Serus send the requests for you
Serus finds the data brokers that list you where you live and removes you from them.
Related
Frequently asked
Why can an organisation refuse access?
For reasons the law allows, such as a risk to someone's life, health or safety, an unreasonable impact on other people's privacy, frivolous or vexatious requests, or legal proceedings between you and the organisation.
What can an organisation charge for?
Staff time to find, retrieve and assess the information, reproducing and sending it, postage or materials, and using an intermediary. The charge can't be excessive, and making the request itself is free.
How do I get government records about me?
Agencies must respond under APP 12 within 30 days and can't charge. You also have rights under the Freedom of Information Act 1982.
Can I also get information corrected or deleted?
Yes. Under APP 13 correction is free, and it can include adding, changing or deleting information.
Sources
- oaic.gov.au/privacy/your-privacy-rights/your-personal-information/access-your-personal-information
- oaic.gov.au/privacy/your-privacy-rights/your-personal-information/correct-your-personal-information
- oaic.gov.au/privacy/privacy-complaints/lodge-a-privacy-complaint-with-us
- oaic.gov.au/privacy/privacy-legislation
- legislation.gov.au/C2004A03712/latest/text
Something wrong or out of date? Tell us and we'll re-check it.