Handling and security Current

Handling a client's request to access or correct their information

A practical process for a request most firms eventually receive.

Clients have a right to ask what personal information you hold about them, and to ask you to correct it. This guide sets out a practical process for that request. It is general information, not legal or compliance advice.

Action plan

1 Recognise the request and respond within a reasonable time An access or correction request doesn't need special wording to count as one.

Under Australian Privacy Principles 12 and 13, a client who holds personal information with your firm has a right to request access to it and a right to request correction. Recognise the request as soon as it's made, however it's worded, and respond in a timely manner rather than treating it as a lower-priority task.

  • Treat any clear request to see or correct held information as an APP 12/13 request
  • Log the request with its date so your firm can track its own response time
  • Respond in a timely manner rather than letting the request sit unactioned

Done when: The request has been recognised, logged, and is being actioned within a reasonable time

OAIC: APP 12 access to personal information
2 Search your records and give access or make the correction The default is to give access or make the correction; refusal is the exception, not the starting point.

Search the records your firm holds or controls for the personal information the request concerns, then give access as covered in the previous step. For a correction request specifically, OAIC's guidance requires taking reasonable steps to ensure the information is accurate, up-to-date, complete, relevant, and not misleading, having regard to the purpose it's held for.

  • Search hard copy records, electronic records, and relevant staff knowledge for the requested information
  • Give access to the personal information found, unless a specific ground for refusal genuinely applies
  • For a correction request, update the record so it's accurate, up-to-date, complete, relevant, and not misleading

Done when: Records have been searched and access given or the correction made, unless refusal genuinely applies

OAIC: APP 13 correction of personal information
3 Give a written explanation if you refuse A refusal isn't the end of the process -- it comes with its own written obligation.

If access or correction is genuinely refused, OAIC's guidance requires giving the individual written notice setting out the reasons for the refusal, and, for a correction refusal, the complaint mechanisms available to them. Don't refuse a request silently or informally.

  • Give written notice of any refusal, including the reasons
  • For a correction refusal, include the complaint mechanisms available to the client
  • Don't charge the client for making a correction request or for making the correction itself

Done when: Any refusal has been explained to the client in writing with reasons and, for corrections, complaint options