Can the Office of the Privacy Commissioner make an agency give me my information?

You can ask our Office to review whether an organisation has a proper basis for a decision to withhold information from you. If our investigation finds a reason to believe there was no proper basis, we would recommend the agency release the information to you. In most cases organisations comply with our advice.

If an access complaint is not resolved, and the Privacy Commissioner determines the complaint has substance we may issue an access direction to the business or organisation concerned.

An access direction is a binding written notice issued to a business or organisation by the Privacy Commissioner. The notice directs the business or organisation to release personal information to an individual. 

If an organisation does not comply with an access direction, an individual may apply for an enforceable access order from the Human Rights Review Tribunal. The Commissioner may support an individual to make an application to the Tribunal for an access order. If the Tribunal issues an access order requiring the organisation to comply with the access direction and an organisation fails to comply with the access order, the agency commits an offence and is liable on conviction to a fine of up to $10,000. If an organisation disagrees with an access direction, it can appeal all or part of the access direction in the Tribunal.

Find out more about Access Directions.  

If the Privacy Commissioner investigates, but doesn't make an access direction, individuals are able to take their complaint to the Human Rights Review Tribunal(external link) to see a review of the agency's decision. The Tribunal may order release of the information if it upholds the complaint.

An individual can also bring proceedings in the Tribunal within six months for other remedies, (including damages) whether an access direction has been issued or not.  

The Tribunal may order release of the information if it upholds the complaint.

Updated October 2025