How to Get a Copy of Everything a Company Holds on You (and Force Them to Correct It)

You asked the insurer for the file notes behind the decision to decline your claim. You asked the recruitment agency what the reference-checker wrote. You asked your former employer for the investigation report that ended your job, and the real estate agency for whatever it told the tenancy database. The answers were, in order: “we don’t release internal notes”, silence, “that’s confidential”, and “you’ll need a lawyer”.

None of those is a lawful refusal. Under the Privacy Act 1988, an organisation that holds personal information about you must give you access to it on request, and must correct it if it’s wrong. The exceptions are specific and must be stated. A properly framed request, with the deadline and the escalation named, is what turns “we don’t do that” into a bundle of documents.

Your rights

• Access (APP 12). An APP entity that holds personal information about you must, on request, give you access to it. It must respond within a reasonable period (30 days for organisations; agencies have 30 days in practice too) and in the manner you request if reasonable. It can charge only a reasonable cost of giving access, not a fee for making the request.
• Limited refusal grounds. An organisation can refuse only on listed grounds, such as a serious threat to life or safety, unreasonable impact on someone else’s privacy, a frivolous or vexatious request, legal proceedings on foot where the information wouldn’t be discoverable, commercially sensitive decision-making processes, or unlawfulness. If it refuses, it must give you written reasons and tell you how to complain. If a listed ground covers only part of the file, it must give you the rest.
• Correction (APP 13). If information is inaccurate, out of date, incomplete, irrelevant or misleading, the entity must take reasonable steps to correct it, notify any other entity it disclosed it to, and, if it refuses, attach a statement from you to the record so anyone reading it sees your version.
• Health records from private providers are covered by these principles; state laws add rights in some states (below).
• Enforcement. A refusal or non-response is a breach you can complain about to the OAIC after complaining to the entity, and the Commissioner can order access, correction and compensation (s 52).

By state

For private companies and Commonwealth agencies the federal Act applies in every state. For state government bodies, and for health records in some states, the local law is the one to cite:

• New South Wales. Privacy and Personal Information Protection Act 1998 (access and amendment from state agencies); Health Records and Information Privacy Act 2002 (access to health records from New South Wales public and private providers); Government Information (Public Access) Act 2009 for formal document access from agencies.
• Victoria. Privacy and Data Protection Act 2014 for state agencies (via Freedom of Information Act 1982 (Victoria) for access); Health Records Act 2001 gives access to health records from private and public providers, with the Health Complaints Commissioner enforcing.
• Queensland. Information Privacy Act 2009: access and amendment applications to state agencies; Office of the Information Commissioner reviews refusals.
• Western Australia. Freedom of Information Act 1992 (Western Australia) for personal information held by state agencies; the Privacy and Responsible Information Sharing Act 2024 is being phased in and adds a privacy complaints framework as it commences.
• South Australia. Freedom of Information Act 1991 (South Australia) for access to and amendment of personal records held by state agencies; South Australia Ombudsman for review.
• Tasmania. Personal Information Protection Act 2004 and Right to Information Act 2009; Tasmanian Ombudsman.
• Australian Capital Territory. Information Privacy Act 2014 (Territory Privacy Principles mirror the APPs); Health Records (Privacy and Access) Act 1997 gives a direct right of access to health records from any Australian Capital Territory provider.
• Northern Territory. Information Act 2002 combines FOI and privacy: access and correction applications to public-sector organisations, reviewed by the Northern Territory Information Commissioner.

The Claim Done document asks your state first and drafts the request to the federal Act or, for a state body, to that state’s access and correction provisions.

What to do right now

1. Define what you want precisely. “All personal information you hold about me” is the legal formulation; then list the specific items you know exist: file notes, call recordings, emails mentioning you, the investigation report, references, the tenancy database listing, decision records.
2. Send it to the privacy officer, in writing. Every APP entity must have a privacy policy naming how to make an access request. Use that channel and copy the general contact so the date is undeniable.
3. Set the 30 days. State that you expect a response within 30 days, that any refusal must state the APP 12.3 ground relied on and give reasons, and that partial refusal requires release of the balance.
4. When it arrives, audit it. Gaps are common. Ask for the missing categories by name and ask whether any information was withheld and on what ground.
5. Request correction of anything wrong. Identify each inaccurate item, say what the correct information is, attach proof, and ask that the correction be notified to anyone the information was given to.

When access is really about a dispute

Most access requests are made because something else is going on: an insurance decline, a dismissal, a tenancy blacklisting, a credit decision. The entity knows that too, and “legal proceedings” is the refusal ground it reaches for. That ground only applies where proceedings are actually on foot or anticipated and the information would not be accessible through discovery; it does not let an organisation refuse simply because you might complain later. Nor does “commercially sensitive” cover the facts about you; it covers the entity’s evaluative decision-making process, and the facts must still be released. Say this in the request. Organisations that would rather not hand over an unflattering file often do so once it is clear the alternative is an OAIC complaint that will examine the refusal itself.

Who to complain to

The entity’s privacy officer first. Then the OAIC (free; after the entity has had 30 days; within 12 months of the refusal). For state bodies, the state regulator listed above. AFCA if it’s a bank or insurer, which must also give you access to claim documents under its rules. The Tenancy database operators (TICA, NTD) have their own listed correction processes that run alongside the Act.

Get the access and correction request drafted — $49

Stop reading. Start doing. Claim Done drafts your Privacy Access and Correction Request: the APP 12 access demand with the specific categories named, the 30-day deadline, the limits on refusal grounds, the APP 13 correction request with the evidence, and a note on the OAIC or state escalation if they refuse or ignore it.

Request My Personal Information — $49 →

You review every word before it’s sent.