The most common complaints we investigate relate to individuals trying to access their personal information. Some of these requests are “empty-your-pocket” requests to the agency – in other words, requests for all the information held about the person concerned by the agency.

When a person makes a request for personal information, the agency responding to the request is entitled to withhold the information, if one of the exceptions to principle 6 of the Privacy Act applies.

Updated by our Guidance team in March 2025.

Organisations sometimes get it wrong when they respond to a person’s request for their personal information. Information is sometimes lost, displaced or accidentally deleted. A recent privacy case dealt with by the Human Rights Review Tribunal considers when an organisation can call it quits when it comes to searching for personal information in responding to an access request.

We live in an age where agencies collect and hold a lot of information about us. When we then request access to that information, this places demands on the time and resources of agencies to meet their obligations under the Privacy Act. Agencies sometimes feel a bit overwhelmed when responding to requests for personal information -  especially where a high volume of information is held.

Applying for a job can be a nerve-wracking ordeal and, more likely than not, it ends in disappointment. It can be devastating to miss out on that dream job and not knowing why you missed out can be incredibly frustrating.

Mrs Patel was outraged. She’d visited her GP for a follow-up check after her hand surgery, and he’d asked her about her history of depression. She didn’t think she’d had anything of the sort, and decided to ask the receptionist for a copy of all her medical notes to see what else was in there. The young receptionist assured her that the doctor owned the notes so she couldn’t have them.