Australian Privacy Laws — Privacy Act Access Request Requirements

Australia's primary privacy legislation is the Privacy Act 1988, which regulates how personal information is handled by Australian Government agencies and private-sector organizations. The Act contains 13 Australian Privacy Principles (APPs) that set out standards for the collection, use, disclosure, storage, and management of personal information.

The Office of the Australian Information Commissioner (OAIC) is the independent regulator responsible for privacy functions under the Act. The OAIC investigates complaints, conducts assessments, publishes guidance, and has the power to seek civil penalties through the Federal Court.

The Australian Privacy Principles

The 13 APPs are grouped into five categories and form the foundation of privacy compliance in Australia:

• APPs 1-2: Open and transparent management of personal information, and the option for individuals to interact anonymously or pseudonymously.
• APPs 3-5: Collection of personal information — including rules around solicited and unsolicited information, notification requirements, and dealing with sensitive information.
• APPs 6-9: Use and disclosure of personal information, including cross-border disclosure, adoption and use of government identifiers, and direct marketing.
• APP 10: Quality of personal information — organizations must take reasonable steps to ensure information is accurate, up-to-date, and complete.
• APPs 11-13: Security, access, and correction — including the requirement to protect personal information, the right of individuals to access their information, and the right to request correction.

APP 12 is the principle most directly relevant to access requests. It gives individuals the right to request access to personal information held about them by an organization or agency. Organizations must provide access unless a specific exception applies, such as where access would pose a serious threat to the life or health of any individual, or where the request is frivolous or vexatious.

The Small Business Exemption

One of the most distinctive features of Australian privacy law is the small business exemption. Organizations with an annual turnover of AUD 3 million or less are generally exempt from the Privacy Act, unless they fall into specific categories (such as health service providers, organizations that trade in personal information, or organizations related to a larger organization).

This exemption has been widely criticized as leaving millions of Australians without privacy protection when dealing with small businesses. The Attorney-General's Privacy Act Review Report (2023) recommended removing the small business exemption, and the Australian Government has committed to doing so as part of broader legislative reforms. As of early 2026, the removal is part of proposed amendments working through Parliament, though the exact timeline for enactment remains uncertain.

Notifiable Data Breaches Scheme

Since February 2018, the Notifiable Data Breaches (NDB) scheme requires organizations covered by the Privacy Act to notify affected individuals and the OAIC when a data breach is likely to result in serious harm. The notification must include a description of the breach, the kinds of information involved, and recommendations about the steps individuals should take.

The NDB scheme applies to all entities covered by the Privacy Act, including organizations that would otherwise be exempt if they hold tax file number information. Failure to comply with the notification obligation can result in civil penalties.

Access Request Process

Under APP 12, individuals have the right to request access to their personal information. The key requirements are:

• 30-day deadline: Organizations must respond to an access request within 30 calendar days of receiving it. This is a reasonable period prescribed by the OAIC's guidance, though the Act itself uses the language "within a reasonable period."
• Written request: The OAIC recommends that requests be made in writing, though organizations should accommodate verbal requests where reasonable.
• Manner of access: Organizations must provide access in the manner requested by the individual if it is reasonable and practicable to do so. This may include providing copies of documents, allowing inspection, or providing a summary.
• Fees: Organizations may charge a reasonable fee for providing access, but the fee must not be excessive and must not apply to the making of the request itself.
• Refusal grounds: Access may be refused where it would pose a serious threat to life, health, or safety; where it would unreasonably impact the privacy of others; where the request is frivolous or vexatious; where providing access would reveal the organization's commercially sensitive decision-making process; or where access would be unlawful or contrary to a court order.

When access is refused, the organization must provide written reasons for the refusal and inform the individual of their right to complain to the OAIC.

Enforcement and Penalties

The OAIC can investigate complaints, conduct Commissioner-initiated investigations, and accept enforceable undertakings. For serious or repeated interferences with privacy, the OAIC can seek civil penalties through the Federal Court. Current maximum penalties are AUD 50 million, three times the value of the benefit obtained, or 30% of adjusted turnover — whichever is greatest. These penalty levels were significantly increased in 2022 following high-profile data breaches.

Reform Timeline

The Australian Government has been undertaking a comprehensive review of the Privacy Act since 2020. Key proposed reforms include:

• Removal of the small business exemption — bringing all private-sector organizations under the Privacy Act
• A statutory tort for serious invasions of privacy — giving individuals a direct right to sue
• A children's privacy code — introducing specific protections for minors
• Enhanced enforcement powers for the OAIC
• Expanded individual rights, including a right to erasure similar to the GDPR's right to be forgotten

These reforms are progressing through Parliament in stages. Organizations operating in Australia should monitor the reform process closely, as the changes will significantly expand compliance obligations.

Guides

• Australian Privacy Act Access Request Requirements — full compliance breakdown including APPs, access rights, deadlines, exemptions, and penalties

Related Resources

• How to Respond to a DSAR — step-by-step response process
• DSAR Response Deadlines — deadline comparison across jurisdictions