Customers requesting access to their information is now a routine consequence of operating in a data‑driven economy. Under the Privacy Act 1988 (Cth) and the Australian Privacy Principles (APPs), individuals are entitled to request access to personal information held about them by organisations. While the right of access is fundamental to transparency and accountability, it poses significant legal challenges where personal information is embedded within documents that also contain legally privileged communications, confidential commercial material, internal deliberations, or information about third parties.
Similar rights to access personal information exist under the various information privacy and health records legislation in each State and Territory in Australia. While those rights are like those under the APPs, there are nuances and subtle differences which amplify the risks when navigating and responding to requests for access to information that is governed by both