Fact sheet - How to access your personal information from government agencies

Personal information is defined under the legislation as: information or an opinion (including information or an opinion forming part of a database and whether or not recorded in a material form) about an individual whose identity is apparent or can reasonably be ascertained from the information or opinion. 

Personal information includes an individual’s fingerprints, retina prints, body samples and genetic characteristics.^[1]

For the purposes of the PPIP Act, personal information does not include health information (including medical information).^[2]

There are also other exceptions to the definition of personal information under section 4 of the PPIP Act. Examples include:

• information about an individual that is contained in a publicly available publication

• information which may have been obtained or accessed for law enforcement or public safety purposes

• certain adoption information

• Cabinet information

• public interest disclosures, and

• information relating to the suitability for employment of a public servant.

The GIPA Act allows you to apply for government information, which includes any personal information (including health information) that agencies might hold about you. The definition of personal information is the same as the definition under the PPIP Act, however, different exceptions apply. The only exceptions to personal information under the GIPA Act are:

• information about an individual who has been dead for more than 30 years; or

• information about an individual that reveals nothing more than that the person is employed as a public servant (comprising the individual’s name and non-personal contact details, including the individual’s position title, public functions and the agency in which the individual works);^[3]

Contact the government agency that holds your personal information and check if an application needs to be in a particular form. 

The agency may also ask you for some identification to prove that you have the right to access the information. 

If you request your personal information under the GIPA Act, you can make the request informally or formally. 

Agencies are encouraged to process a request for access informally wherever possible unless:

• there is an overriding public interest consideration against disclosure. Relevant considerations might include: if it contains the personal information of a third party, or the information might prejudice law enforcement processes. The list of considerations is contained in section 14 and schedule 1 of the GIPA Act

• you want to be able to request a review of the decision if you are unhappy with the agency’s decision. Under the GIPA Act, a right of review only applies to formal applications.^[4]

If you would like to make a formal application, it must:

• be in writing, 

• sent by post, lodged in person with the agency, or sent by another method approved by the agency (eg some agencies make electronic forms available), 

• make clear that it is an access application under the GIPA Act, and 

• include your name and a postal or email address where all correspondence relating to your application can be sent.^[5]

• provide sufficient information to allow the agency to find the personal information that is being applied for, and 

• include a $30 application fee, unless it is waived or reduced by the agency.^[6]

Your application must also state whether you have applied to another agency for substantially the same information and, if so, which agency you previously applied to. Your application will still be valid if the information is not included.^[7]

An agency may require you to prove your identity before you are given the personal information you requested.^[8]

You may be able to authorise another person to access your personal information regardless of whether the application is made under the PPIP Act or GIPA Act. However, the agency can request written proof of your authorisation and a proof of identity.

The law also recognises that certain people are able to act on behalf of someone else, for example:

• a person acting under an enduring power of attorney; or

• a guardian or person responsible within the meaning of the Guardianship Act 1987.  

In each case, your authorised representative can only access personal information that is within the scope of their authorisation. 

An agency may have a policy about authorised representatives in their Privacy Management Plan (PMP). You should check with the agency that holds the personal information about their policy on this issue and what information they may require before they provide your authorised representative with access.

If you apply for your personal information under the GIPA Act, there is an application fee of $30. 

There are also processing fees that apply under the GIPA Act. The first 20 hours are free, but if a request for personal information takes more than 20 hours to process, the agency is entitled to impose processing charges.^[10]

Agencies also have the discretion to waive the application fee and other fees and charges under section 127 of the GIPA Act. For further information, refer to the IPC Fact Sheet GIPA Act fees and charges.

The government agency must provide access to your personal information without excessive delay.^[11] However, specific processing times are not set by the PPIP Act.

If you decide to apply for personal information under the PPIP Act, you should ask the government agency how long it is likely to take for your application to be processed. You should ask the agency to confirm the processing time in writing in case the application takes longer than advised. 

If you believe the agency is taking too long to provide you with access to your personal information, you can make a complaint to the NSW Privacy Commissioner. Contact the Information and Privacy Commission NSW (IPC) on 1800 472 679 or at ipcinfo@ipc.nsw.gov.au for advice about what to do next.

If you apply under the GIPA Act, the government agency must process your request within the following time frames. 

The agency:

• must notify you whether the application is a valid application within 5 working days of the date it receives the application;^[12]
• must make a decision on whether to provide access to your personal information and notify you of their decision within 20 working days of the date agency receives your application.^[13]
• If the agency does not decide your application within 20 working days (unless an extension is validly made), the application is treated as a deemed refusal and you have the right to seek a review of this deemed refusal;^[14]
• the agency can extend the period for making a decision by up to 10 working days to consult another party as required by the GIPA Act, or to retrieve records from archive.^[15]

Alternatively, if you agree, the agency can extend the period for making a decision.^[16]

The GIPA Act does not specify the maximum amount of time the decision-making period can be extended by agreement between you and the agency. However, you are not required to agree to an extension.

In certain situations, an agency can extend the period for making a decision (without your agreement) for a maximum of 15 working days.^[17] This is usually when consultation with a third party is required, or records need to be retrieved from a records archive.   

This means the maximum period for processing your application, if an extension is applied by the agency, is 35 working days.

The PPIP Act provides that you have a right to access personal information held by an agency about you.^[18]

The agency must provide access to your personal information without excessive delay or expense.^[19]

If an agency has a lot of information that is responsive to your request, the agency may determine that providing you with access to the information would be an unreasonable and substantial diversion of the agency’s resources.[20]

If the agency refuses to give you access to your personal information, for any reason, you have a right to seek an internal review of this decision from the agency.^[21]

If the agency decides to grant you access, the agency can provide access to the information in a form the agency considers appropriate. This might mean you can take home a copy of the information or that you can only view the information but not photocopy it.

The agency must provide access to your personal information by:

• allowing you to inspect the record containing the information, together with any facilities to enable the information to be read, viewed or listened to as appropriate; or

• providing a copy of the information; or

• providing a written transcript of the information.^[22]

The agency must provide access in the form you requested unless it would unreasonably interfere with the operations of the agency, require the agency to incur unreasonable additional costs, be detrimental to the proper preservation of the record, breach copyright, or would result in an overriding public interest against disclosure if provided in the form requested.^[23]

The GIPA Act requires that agencies must provide access without placing a condition on how to use the personal information once released. However, agencies can impose conditions on how the right of access is exercised if it is necessary for the purposes of avoiding an overriding public interest against disclosure of the information.^[24] This means that an agency can limit access to inspection only and prevent you from taking notes or making a copy of the information.

See the IPC Fact Sheet – What is the public interest test? for further information.

If you have made an application under the PPIP Act and are unhappy with the government agency’s decision, you can request an internal review of an agency’s decision or conduct within six months from being notified of the decision. In some circumstances, an agency may extend this time. If you have missed this six-month period, you should ask the agency if they will still accept your request for an internal review and provide your reasons.^[25]

An internal review is free of charge. 

The agency must complete the internal review as soon as reasonably practicable and, at the latest, within 60 days from the day the application for internal review is received by the agency.^[26]

Once you have sought an internal review and if the review is not completed within 60 days as required by legislation, or you are not happy with the decision made, or actions taken in the internal review, you can go to NCAT and request a review.^[27]

You must lodge your application with NCAT within 28 days of receiving the agency’s decision.^[28]

See IPC Fact Sheet – Privacy complaints: Your review rights for further information.

NCAT can review the conduct of the agency in processing and making a decision on the original application for access.

There is a filing fee charged by NCAT for lodging an application with them. For more information, see www.ncat.nsw.gov.au. 

You can also make a complaint to the NSW Privacy Commissioner about a breach of, or interference, with your privacy rights. 

This includes if you experienced difficulty attempting to access your personal information.^[29]

The Privacy Commissioner does not usually deal with a complaint that is more appropriately dealt with by an application for internal review.

The Privacy Commissioner accepts complaints from:

• the individual whom the personal information is about; or

• a third party with:

• evidence of the consent of the person who the personal information relates to; or

• if consent has not been obtained from the person who the personal information is about, evidence of the legal incapacity and contact details of the person to whom the personal information relates.

You have six months from the date of the agency’s decision or after finding out about the agency’s conduct to make a complaint to the Privacy Commissioner. However, the Privacy Commissioner has the discretion to extend the time for making a complaint beyond six months.^[30]

Please see the Privacy Commissioner’s Protocol for Handling Complaints for more information on your rights and the procedures for making a complaint or contact the IPC on 1800 472 679 or at ipcinfo@ipc.nsw.gov.au.

If you are unhappy with the agency’s decision about your request to access your personal information, you can:

1. request an internal review within 20 working days after the notice of a decision has been posted to you;^[31] or
2. request a review by the Information Commissioner within 40 working days of being notified of the decision;^[32] or
3. request a review by NCAT within 40 working days of being notified of the decision.^[33]

There is a $40 fee for an internal review application unless the decision is a ‘deemed refusal’ because the agency did not process your application in time, or it is an internal review as recommended by the Information Commissioner under section 93(6).^[34]

The agency must acknowledge your application within five working days of receiving it.^[35]

The agency must decide the internal review within 15 working days (this can be extended by 10 working days if the agency has to consult with a third party, or by agreement with you).^[36]

The agency can make any decision or take any action in regard to the internal review as they believe appropriate.  

Review by the Information Commissioner and NCAT

If you are the access applicant, you do not need to request an internal review first before requesting a review from the Information Commissioner or NCAT. You have 40 working days in which to request a review after being notified of the agency’s decision.^[37]

If you are unhappy with the Information Commissioner’s review decision, you can apply to NCAT within 20 working days from being notified of the Information Commissioner’s review outcome.^[38]

However, if you have requested NCAT to review the agency’s decision, you cannot later ask the Information Commissioner to review a decision.^[39]

You may request a review of the agency’s decision by the Information Commissioner free of charge. For more information about reviews by the Information Commissioner, please see our Fact Sheet on External Review by the Information Commissioner.

If you request a review by NCAT, there is a filing fee charged by the Tribunal for lodging an application. For more information on NCAT, visit www.ncat.nsw.gov.au.

For more detailed information about your review rights under the GIPA Act, please see our Fact Sheet on your review rights under the GIPA Act.