Actions

1.

We record the date of the request.

2.

We check and record the identity of the requester (individual or representative).

3.

If we know information is held by another entity, we check with the requester to see if they want the request transferred to the appropriate entity. If yes, we transfer the request within 10 working days of the request being received.

4.

We consider the urgency of the request.

5.

As soon as practicable within 20 working days, we assess whether:

• the information requested is personal information
• there are any grounds for withholding the requested personal information (Privacy Act, s 49–53)
• there are any grounds for refusing access in the manner requested
• we will include a charge
• to give a notice of extension.

6.

We notify the requester whether the request has been approved. If approved, we explain how the information will be given and if there is a charge.

7.

We arrange for the requester to access information in the way they wish (if reasonable), unless this way causes grounds for withholding information.

Ways of accessing information can include providing:

• an opportunity to inspect the information (under supervision to protect the integrity of the file and to provide explanations if necessary)
• a copy of any document
• a verbal explanation about the information
• a summary of the personal information we hold.

8.

If the request is not granted or some information is withheld, we explain why and advise the requester of their right to complain to the Office of the Privacy Commissioner.

9.

If the requester says that information held is incorrect and we agree, or we are aware that information held is incorrect, we take all practicable steps to have the information corrected immediately. Any change is noted carefully to ensure that an adequate audit record of changes exists.

10.

If we do not agree with a request for correction, the requester is given an opportunity to have a statement of correction held with the information. The information and statement of correction are kept together so that anyone accessing the information sees both.

11.

If we receive a request to have the personal information we hold suppressed or deleted, we either:

• take reasonable steps as necessary to ensure that the record remains accurate with a clear audit trail of any changes to the information
• hold this information separately for audit purposes, responding to complaints, and complying with legislation (e.g. Public Records Act).

Hei mihi | Acknowledgement

SchoolDocs appreciates the professional advice of Kathryn Dalziel, senior barrister specialising in privacy law and certified seminar leader for the Office of the Privacy Commissioner.

Topic Number: 51933

Last Modified Date: 15/07/2025 15:55:23

Topic Version: 1

Published Date: 30/01/2026