Privacy Access Request: How to Respond Without Tipping Off

A client emails: “Please send me everything you hold about me.” Another rings to say the address on their file is wrong. This guide explains how to respond to a privacy access request under APP 12 (the rule about letting people see their information) and a correction request under APP 13 (the rule about fixing it) at a firm with AML/CTF obligations. It also covers what makes these requests harder for you than for most businesses: when a client asks for their file, nothing you send or say may tip them off about a suspicious matter report.

Why APP 12 and APP 13 apply to your client files

The Privacy Act applies to the personal information you handle for your AML/CTF obligations, even if your firm is a small business that would otherwise be outside it. The OAIC's privacy guidance for reporting entities (August 2026) says so, and our guide to the Privacy Act for AML/CTF businesses explains how it came about. On a client file that is almost everything: contact details, dates of birth, ID document details, screening results, risk ratings and staff notes.

Under APP 12, if you hold personal information about someone, you must generally give them access to it when they ask, unless there are grounds to refuse. Your collection notice should already point clients to the access and correction process in your privacy policy (see collection notices for KYC clients).

The OAIC's Privacy Essentials Checklist asks whether you have processes for privacy enquiries, complaints and requests: “This should also include access and correction requests.” It suggests a key privacy officer, who in a small firm can be one person who also does other work.

How to respond to a privacy access request, step by step

1. Pass it to your privacy officer the day it arrives, and note the date you received it.
2. Check who is asking. You must verify that the request comes from the person concerned, or from someone authorised to act for them, such as a legal representative. The identity checks you did for customer due diligence often settle this, because you already know who they are. The OAIC's example: if a regular client asks during an appointment, there is no need to verify further.
3. Check for anything you must not reveal. Before anything is gathered or sent, the privacy officer speaks to your AML/CTF compliance officer. If any part of the file would reveal a suspicious matter report or a suspicion, that part cannot be given.
4. Find the information, wherever it is kept: your AML/CTF software, practice software, email and paper files.
5. Decide: give access, or refuse on one of the grounds in APP 12.3 (below).
6. Reply within a reasonable time. A refusal needs a written notice, with rules of its own.
7. Keep a record of the request, how you checked identity, what you decided and why, and when you replied.

The usual 30 days for an APP 12 access request

APP 12 asks you to respond to an access request within a reasonable period. The OAIC's guidance for reporting entities says that is usually 30 days. Treat 30 days as your deadline, counted from the day the request arrived, and start early: finding everything and checking it with your compliance officer takes time.

Complaints work in a similar way. A person with a privacy complaint usually has to raise it with your firm first, and the OAIC recommends you respond within 30 days. Make sure staff can recognise a complaint, so it reaches the privacy officer.

When you may refuse an access request (APP 12.3)

APP 12.3 lists the grounds on which you may refuse access. The OAIC says the most common ones for AML/CTF businesses include, but are not limited to:

• giving access would be unlawful, for example because it may be tipping off under the AML/CTF Act;
• there is reason to suspect unlawful activity, or misconduct of a serious nature, relating to your firm's functions or activities, and giving access would be likely to prejudice taking appropriate action;
• giving access would be likely to prejudice enforcement related activities by, or on behalf of, an enforcement body;
• denying access is required or authorised by or under an Australian law.

If you refuse access, or refuse to give it in the way the person asked, you must give them a written notice setting out:

• the reasons, except to the extent it would be unreasonable to give them, such as where that would be inconsistent with your tipping-off obligations;
• how they can complain about the decision, how you will deal with the complaint, and the outside options, such as the OAIC.

A client asks for their file and you have reported them: how not to tip them off

This is the hard case. The OAIC describes tipping off as disclosing information that would or could reasonably be expected to prejudice an investigation, and it is an offence under section 123 of the AML/CTF Act. The OAIC is plain about access requests: you must not give access, or explain why you are refusing, if that would breach section 123. And if you refuse because giving access is inconsistent with a legal obligation such as tipping off, your written notice must not explain why.

You still deal with the request: a refusal is a reply, with its written notice. A few habits keep that reply safe:

• Keep it with the privacy officer and the compliance officer. Nobody else discusses it with the client.
• Do not hint. Lines like “your file is under review” or “we cannot release it yet” point to exactly what must not be said.
• Use the same wording for every refusal you cannot explain. If the letter reads the same whatever the reason, the letter itself cannot signal that a report exists.
• Record the real ground internally, in your record of the request, never in the letter.
• Read AUSTRAC's guidance on tipping off, which the OAIC points to, and get legal advice if you are unsure.

When a client asks you to correct their information (APP 13)

Under APP 13, your firm should give people a way to have incorrect personal information fixed, and take reasonable steps to correct the information it holds. APP 10, the rule about quality, also asks you to take reasonable steps to make sure the information you collect is accurate, up to date and complete.

The OAIC points out that APP 13 sits alongside your AML/CTF duties rather than replacing them. As part of ongoing customer due diligence, you already have to review and update KYC information, and correcting a record under APP 13 helps you meet that duty. It works the other way too: keeping KYC information up to date means fewer correction requests.

In practice, check the new detail, update the file, and note what changed and when. If the change matters for your customer due diligence, such as a new name or address, handle it the way your AML/CTF program says you update KYC information. And whatever the request, nothing in your reply may reveal a report or a suspicion.

How CompliDesk helps

CompliDesk's Privacy Hub records requests to see or fix information and counts the days for you, alongside anything lost or stolen. It walks your firm through five steps: answer questions to get your privacy policy and collection notice, download the policy, check the list of client information it builds from your CompliDesk records, write your plan for when information is lost or stolen, and work through the OAIC's 14-question checklist, five of which CompliDesk ticks itself. Staff training includes a 15-minute privacy lesson that covers requests and tipping off. The Privacy Hub is included in every CompliDesk monthly plan at no extra cost: see pricing. This is general information, not legal advice; your firm makes its own decisions.

Frequently Asked Questions

Related reading: Privacy Act guide for AML/CTF businesses · Data breach response plan template · Privacy training for staff · The OAIC privacy checklist for AML/CTF firms · Suspicious matter reports guide · Customer due diligence explained · Frequently asked questions