Requesting or disclosing personal information

Asking the right questions helps agencies comply with the Privacy Act when making or receiving an information sharing request.

Both the requesting and disclosing agencies are responsible for making sure any personal information is authorised for sharing.

Agencies are required to share personal information for a range of reasons, including to provide services to their customers and clients.

Questions to ask

Agencies requesting or disclosing personal information should be able to answer the following questions:

  • Is the scope of the request clear? It’s important to understand:
    • what personal information is being requested
    • why the personal information is being requested
    • under what authority is the information being requested (for example, IPP 11 (e))
    • how the personal information will be transferred
    • how the personal information will be used
    • how the personal information will be updated or corrected.
  • When will the personal information will be deleted?
  • On what basis is your agency authorised to share the personal information?
  • Does the authorisation cover the sharing of historic information or just new information collected?
  • Do you have an existing agreement that enables the proposed sharing or is a new agreement required?
  • Do your relevant privacy notices describe the proposed sharing?
  • Did the relevant privacy notices describe the proposed sharing at the time the personal information was collected? 
  • Is the information sharing to a foreign person or entity (IPP12 may apply)?

More information

IPP 11

IPP 12 and model contract clauses 

Utility links and page information

Was this page helpful?
Thanks, do you want to tell us more?

Do not enter personal information. All fields are optional.

Last updated