GIPA Act 2009 · PPIP Act 1998 · New South Wales
Five working tools for getting information out of a NSW agency, across both statutes: choosing the right route, testing the public interest, counting the time, challenging a search that came back empty, and using the privacy regime where it reaches further than GIPA.
GIPA Act as at 30 July 2026 · PPIP Act as at 30 September 2026 · Plain-English path, statutory detail on expand
GIPA gives you four ways to get government information, and only one of them costs $30 and takes a month. Most people reach for a formal access application first. Work down the list instead — the cheaper routes are often faster and carry no fee.
s 41(1) — the formal requirements
An agency can reject an application outright if any of these is missing. All five must be satisfied.
0 of 5 met.
Section 41(1) provides that an application “is not a valid access application unless it complies with the following requirements (the formal requirements)”. Failure on any limb means there is no valid application at all.
Two softeners: s 41(1A) requires you to name any other agency you have asked for substantially the same information, but expressly provides that failure to comply with this subsection does not affect the validity of an application. And s 52 obliges an agency to help you fix an invalid application rather than simply refusing it.
An application is not treated as received until it is actually received: s 41(3). The clock in tab 03 runs from that date.
Separately, s 43 bars an application altogether for excluded information — information relating to a function listed in Schedule 2 for that agency. That is a jurisdictional bar, not a balancing exercise: see tab 02.
There is a presumption in favour of disclosure (s 5). Information is withheld only where considerations against disclosure, on balance, outweigh those in favour (s 13). Two gates come first — and if either closes, no balancing happens at all.
If what you want relates to a function listed in Schedule 2 for that particular agency, you cannot make a valid access application for it at all: s 43. This is agency-and-function specific — the Ombudsman's complaint-handling function is excluded, the Ombudsman's payroll is not.
1 — Judicial and prosecutorial information. A court (judicial functions); the Director of Public Prosecutions (prosecuting functions).
2 — Complaints handling and investigative information. A long list tied to each body's investigative functions: the Auditor-General; ICAC and its Inspector; the Judicial Commission; the Ombudsman; the Information Commissioner (review, complaint handling, investigative and reporting functions); the Privacy Commissioner; the Legal Services Commissioner; the Health Care Complaints Commission; the Law Enforcement Conduct Commission and its Inspector; the NSW Crime Commission; the Child Death Review Team and the Domestic Violence Death Review Team (all functions); the Office of Local Government; the Children's Guardian (reportable conduct); the Ageing and Disability Commissioner; the Inspector of Custodial Services; the Small Business Commissioner; the Public Service Commissioner (inquiry functions); the President of the Anti-Discrimination Board (complaints being dealt with); the NSW Independent Casino Commission and the Independent Liquor and Gaming Authority.
3 — Competitive and market sensitive information. Treasury Corporation; SAS Trustee Corporation; National Electricity Law bodies; the Superannuation Administration Authority corporation; the Workers Compensation Nominal Insurer.
4 — Other information. NSW Trustee and Guardian (as executor, administrator or trustee); the Department of Education and universities (HSC ranking and tertiary entrance assessment); the NSW Electoral Commission (complaint handling, audit, reporting, investigative and prosecuting functions).
Note the interlock: Schedule 1 clause 6 makes excluded information subject to the conclusive presumption as well, unless the agency consents to disclosure.
For information described in Schedule 1 it is conclusively presumed that there is an overriding public interest against disclosure: s 14(1). Nothing you put on the other side of the scale can move it. Schedule 1 is not a heavy weight — it removes the scale.
1 Overriding secrecy laws — a closed list of named provisions (among them the Criminal Records Act 1991 s 13, the Public Interest Disclosures Act 2022 s 64, the Witness Protection Act 1995, the ICAC Act 1988, the Jury Act 1977, the Law Enforcement Conduct Commission Act 2016, the Health Care Complaints Act 1993). Clause 1(2) carves out disclosure of a spent conviction to the person convicted.
2 Cabinet information — but not where the Premier or Cabinet has approved disclosure, or where ten years have passed since the end of the calendar year the document came into existence: cl 2(2). Purely factual material is generally not Cabinet information: cl 2(4).
3 Executive Council information. 4 Contempt. 5 Legal professional privilege. 5A Privilege generally. 6 Excluded information (the Schedule 2 interlock). 7 Documents affecting law enforcement and public safety. 8 Transport safety. 9 Adoption. 10 Care and protection of children. 11 Ministerial Code of Conduct. 12 Aboriginal and environmental heritage. 13 Complaints to the Judicial Commission. 14 and 15 Authorised transactions (electricity network assets; Land and Property Information NSW). 16 Information provided to the High Risk Offenders Assessment Committee. 17 Cyber security and data breaches under the Privacy and Personal Information Protection Act 1998. 18 Cyber security and data compromises under the Identity Protection and Recovery Act 2025.
Clauses 17 and 18 are the recent additions — worth checking against the current consolidation before relying on the list. Clause 17 picks up the mandatory notification of data breaches scheme in Part 6A of the PPIP Act (ss 59A–59ZJ); tab 05 covers how that Act fits alongside this one.
ss 12, 13, 14 and 15
Tick what actually applies. The tool will not give you a score, because the Act does not work that way — the exercise is “a question of fact and degree… not amenable to mathematical calculation”. What it will do is set out your considerations in the structure a reviewer expects.
Section 13 sets the test: there is an overriding public interest against disclosure “if (and only if) there are public interest considerations against disclosure and, on balance, those considerations outweigh the public interest considerations in favour of disclosure”.
Section 14(2) closes the list: the considerations in the Table “are the only other considerations that may be taken into account”. Section 14(3) lets the Information Commissioner issue guidelines but expressly forbids adding to the list. By contrast s 12(2) provides that nothing in the Act limits the considerations in favour of disclosure — the two sides are not symmetrical.
Section 15 supplies four principles, two of which are the most commonly overlooked in agency reasoning:
(c) The fact that disclosure of information might cause embarrassment to, or a loss of confidence in, the Government is irrelevant and must not be taken into account.
(d) The fact that disclosure of information might be misinterpreted or misunderstood by any person is irrelevant and must not be taken into account.
Section 15 also requires agencies to promote the object of the Act (para (a)) and to have regard to the Information Commissioner's guidelines (para (b)), and makes it relevant that disclosure under an access application cannot be made subject to conditions on use (para (e)).
How the balance is struck. In Webster v Bayside Council [2024] NSWCATAD 226 at [65] the Tribunal adopted the formulation in Callawadda Pty Ltd v Department of Planning, Industry and Environment [2021] NSWCATAD 248 at [19]:
The test in section 13 requires the Tribunal as decision-maker to attribute weight to each consideration for and against disclosure, and determine whether the balance of the public interest lies in favour of, or against, disclosure… The GIPA Act provides no set formula for calculating the weight of considerations… “any reasonable approach that follows section 15 principles seems to be acceptable … it is really a matter of placing identified considerations in order of priority or importance”… The balance is always weighted in favour of disclosure.
Citing Hurst v Wagga Wagga City Council [2011] NSWADT 307; Flack v Commissioner of Police, NSW Police [2011] NSWADT 286; Place v Department of Finance, Services and Innovation [2016] NSWCATAD 278 at [96]; Taylor v Destination NSW [2017] NSWCATAD 272 at [17]. The same approach was taken in Commissioner of Police, New South Wales Police Force v Camilleri (GD) [2012] NSWADTAP 19 at [23]–[30].
In Sicard v The Hills Shire Council [2024] NSWCATAD 162 at [27] the Tribunal put it this way, quoting Battin v University of New England [2013] NSWADT 73 at [74]: the balancing exercise “is a question of fact and degree, requiring the weighing of competing matters, and is a task not amenable to mathematical calculation”. Access is restricted only where there is an overriding public interest against disclosure: Taylor v Destination NSW [2020] NSWCATAD 137 at [6].
Sicard v The Hills Shire Council is also a useful worked example of a single weak consideration failing: the only applicable consideration was cl 5(e) of the Table, it was given “minimal weight” (at [141], [143]), and the decision was set aside with the withheld information ordered released.
Every deadline in GIPA is counted in working days, not calendar days — and a working day excludes weekends, public holidays and any day in the Christmas closedown period declared by the Premier (Sch 4, cl 1).
Counting forward in working days
| Deadline | Falls on | Authority |
|---|
Deciding the application. Twenty working days from receipt: s 57(1). That can be extended by up to 10 working days where consultation is required under the Act or records must be retrieved from an archive — with a maximum extension of 15 working days for any one application, even if both reasons apply: s 57(2). The Act's own note is pointed: the decision period can only be extended to allow for mandatory consultation, not just consultation that the agency chooses to do. The agency must notify you of any extension within 5 working days of it being made: s 57(5). It may also be extended by agreement: s 57(4).
The clock can stop. It stops while you are being given an opportunity to amend an application that would otherwise be refused as an unreasonable and substantial diversion of resources: s 60(4). It also stops from the making of a decision to require an advance deposit until that deposit is received: s 68(2).
Missing the deadline has consequences for the agency. If the application is not decided in time, the agency is deemed to have refused to deal with it, the application fee must be refunded, and no processing charge can be imposed at all — whether or not a late decision is later made: s 63(1), (3), (4). The deemed refusal is itself reviewable, and no fee is payable for internal review of it: s 85(2).
Access does not stay open forever. Once access is granted you have 6 months to exercise it, running from notice of the decision (or the end of any deferral), after which the entitlement lapses: s 77.
Part 5 — who reviews what, and in what order
Access granted; information not held; already available to you (s 59); refused on overriding public interest grounds; refused to deal with (s 60); or a refusal to confirm or deny that the information is held.
Section 80 lists thirteen kinds of reviewable decision — including a decision that information is not held (s 80(e)), a decision on the way access is provided (s 80(i)), and a decision to impose a processing charge or require an advance deposit (s 80(j)).
Conducted by someone no less senior than the original decision-maker. Not available where the decision was made by the principal officer of the agency or by a Minister: s 82(2). The agency must acknowledge your application within 5 working days: s 83(3).
If the agency does not decide within the review period, it is deemed to have made the original decision again and your fee is refunded: s 86(5).
The Commissioner must complete the review within 40 working days of receiving everything needed to do so: s 92A(1). The outcome is a recommendation, not an order — typically a recommendation that the agency reconsider and make a new decision as if the original had not been made: s 93(1). No fee is payable for that reconsideration: s 93(6).
The Commissioner may decline to review an application that is frivolous, vexatious, misconceived or lacking in substance, or that would require an unreasonable and substantial diversion of resources: s 96.
Apply within 40 working days of notice of the decision: s 101(1). But if the decision has been through the Information Commissioner, you have until 20 working days after you are notified the Commissioner's review is complete: s 101(2). NCAT may extend time where you provide a reasonable excuse for the delay, even after time has expired: s 101(4), (6).
The onus again lies on the agency: s 105, in the same terms as s 97.
The nature of an internal appeal. In Wojciechowska v Commissioner of Police, NSW Police Force [2026] NSWCATAP 297 at [1] the Appeal Panel confirmed that in determining an appeal under the GIPA Act NCAT exercises administrative power, not judicial power, following Wojciechowska v Secretary, Department of Communities and Justice [2023] NSWCA 191. But it rejected the submission that the Court of Appeal's decision confines NCAT to a merits review of the primary decision:
NCAT may exercise all the statutory powers and functions available under its internal appeal jurisdiction including the power to determine an appeal which identifies a question of law as the ground of appeal.
Wojciechowska v Commissioner of Police, NSW Police Force [2026] NSWCATAP 297 at [1], referring to the Civil and Administrative Tribunal Act 2013 (NSW), ss 32 and 80. The appeal was dismissed as misconceived because no question of law was identified, and costs were awarded against the appellant.
Standing to appeal. In Cameron Hotels Pty Ltd v Liquorland (Australia) Pty Ltd [2026] NSWCATAP 295 the Appeal Panel held that applicants refused joinder were not a “party to the proceedings in which the decision is made” under s 80(1) of the Civil and Administrative Tribunal Act 2013, so had no standing to bring an internal appeal and the appeal was incompetent. The proceedings under review were a liquor licensing review rather than a GIPA access decision, but the reasoning on s 80(1) standing applies to an internal appeal from any Division.
Two powers worth knowing about. NCAT may refer any matter indicative of a systemic issue to the Information Commissioner: s 111. And if satisfied that an officer has failed to exercise a function in good faith, it may bring that to the attention of the responsible Minister or the Commissioner: s 112. On the limits of raising s 112 allegations mid-review, see Joseph v Kiama Municipal Council (No 3) [2023] NSWCATAD 243.
The restraint order. Section 110 allows NCAT to bar a person from making access applications without approval, where at least three applications in the previous two years lacked merit. “Lacking merit” is defined mechanically in s 110(2) — it includes applications the agency refused to deal with in their entirety, and applications where the entitlement to access simply lapsed. An application made in contravention of a restraint order is not a valid access application: s 110(7).
ss 41, 64–71, 85
| Item | Amount | Authority |
|---|---|---|
| Application fee | $30Counts towards any processing charge | s 41(1)(c), s 64(3) |
| Processing charge | $30 / hourFor processing time as defined in s 64(2) | s 64(1) |
| Your own personal information | No chargeFor the first 20 hours of processing time | s 67 |
| Financial hardship | 50% offProcessing charge only, not the application fee | s 65 |
| Special benefit to the public | 50% offFull waiver if the agency publishes the information within 3 working days of giving you access | s 66(1), (2) |
| Both discounts together | Still 50%A charge must not be discounted by more than 50% even if both sections apply | s 64(5) |
| Advance deposit | Max 50%Of the estimated total charge; at least 20 working days to pay | ss 68(3)(c), 69(1) |
| Internal review | $40Nothing where the review is of a deemed refusal for lateness | s 85 |
| Information Commissioner review | No fee | Part 5, Div 3 |
| Late decision | $0Fee refunded and no processing charge may be imposed | s 63(1), (4) |
“We don't hold it” is the single most contested answer in NSW. In the Information and Privacy Commission's own figures for 2024–25, information not held / searches was recorded 116 times in GIPA external reviews — the most frequent entry in the table, ahead of personal information at 115.
s 53 — searches for information held by agency
| Sub-section | The obligation | Where it bites |
|---|---|---|
| s 53(1) | Limited to information held when the application was received | Nothing created afterwards is captured. Date your application carefully. |
| s 53(2) | Such reasonable searches as may be necessary, using the most efficient means reasonably available | The core duty. “Most efficient means” is an objective standard about the agency's systems, not its habits. |
| s 53(3) | Extends to any resources reasonably available, including those that retrieve information stored electronically | Email, document management, SharePoint, Teams, operational databases, network drives — and information held by a contractor to which the agency has an immediate right of access. |
| s 53(4) | No obligation to search electronic backup systems… | …unless the record was lost through destruction or transfer in contravention of the State Records Act 1998 or contrary to the agency's own record management procedures. That exception is the lever. |
| s 53(5) | No obligation where searching would require an unreasonable and substantial diversion of resources | Both words must be satisfied. Compare s 60(3A)–(3B), which requires any such consideration to outweigh the general public interest in disclosure and the demonstrable importance of the information to you. |
Schedule 4, clause 12 defines information “held by” an agency to include information in a record held by a private sector entity to which the agency has an immediate right of access, information held by the State Records Authority to which the agency has an immediate right of access, and information in the possession or control of an officer or member of staff — including, for a Minister, the Minister's personal staff.
Section 121 requires an agency contracting with a private sector entity to provide services to the public on behalf of the agency to ensure the contract gives the agency an immediate right of access to information relating directly to performance of the services, information collected from members of the public, and information the agency supplied to the contractor. Section 121(2) carves out the contractor's financing arrangements, financial modelling, cost structure and profit margins.
The practical significance was worked through in O'Brien v Secretary, Department of Communities and Justice [2022] NSWCATAD 100, which considered whether information was held, what “provision of services” means, whether the agency had a right of access, and whether the GIPA Act applies to a contract predating it.
The five-step review task
A decision that information is not held is a reviewable decision in its own right (s 80(e)), and the agency carries the burden of justifying it (ss 97, 105). The reasonableness of the search under s 53 is, as the Appeal Panel put it, a “plainly relevant factor” in discharging that burden.
In summary, the task for the Tribunal when reviewing a decision that the requested information is not held by the agency, is to:
(1) identify on the basis of the agency's reasons and the applicant's submissions, any relevant factual issues including those derived from s 53(1)–(5);
(2) determine whether the agency has proved any relevant factual issues on the balance of probabilities;
(3) consider any evidence which may have emerged since the agency made its decision, which might tend to prove that the requested information is held by the agency;
(4) applying those findings, decide what the correct or preferable decision is;
(5) affirm, set aside or vary the agency's decision: s 63(3) of the Administrative Decisions Review Act.
Wojciechowska v Commissioner of Police [2020] NSWCATAP 173 at [44], quoted in Webster v Bayside Council [2024] NSWCATAD 226 at [72]. The “plainly relevant factor” formulation is at [41] of Wojciechowska, quoted in Webster at [71].
There is no fixed standard. “What constitutes a reasonable search will vary with the circumstances of each matter and depends upon the agency to whom the access application is made and on what terms it is made”: Webster v Bayside Council [2024] NSWCATAD 226 at [73]. The terms of your own application shape the obligation — which is why s 41(1)(e) drafting matters.
Volume found later proves inadequacy earlier. In Webster v Bayside Council the Tribunal held at [76] that it was “clear from the volume of information located following the IPC Report that the Council's original search was not reasonable for the purposes of s 53” — though the searches eventually undertaken did comply (at [77]). If a second round of searching produces materially more, say so.
The evidence that wins is systems evidence. In Webster the searches were upheld because the agency's witness “adequately explained to the Tribunal the functionalities and limitations of the Council's electronic record keeping systems” (at [77]). So ask for that explanation early, in writing. Compare Vinciguerra v Commissioner of Police [2020] NSWCATAD 284, where the agency's decision was affirmed on the officer's evidence that all reasonable searches had been undertaken.
What the Tribunal will not do. Administrative review is not a vehicle for collateral review of the merits or validity of other official action: Sheehy v Commissioner of Police; Rapisarda v Commissioner of Police; McDonald v Commissioner of Police; Housego v Commissioner of Police [2018] NSWCATAD 73 at [62], citing Raven v University of Sydney [2015] NSWCATAD 104 at [44]–[45] and Crewdson v Central Sydney Area Health Service [2002] NSWCA 354 at [24], as applied in Webster v Bayside Council [2024] NSWCATAD 226 at [62]. Keep the argument on the search, not on the underlying grievance.
Wording you can adapt — replace the bracketed parts
ACCESS APPLICATION UNDER THE GOVERNMENT INFORMATION (PUBLIC ACCESS) ACT 2009 (NSW)
To: [agency, right to information unit]
This is a formal access application made under section 9 of the
Government Information (Public Access) Act 2009 (NSW). The $30
application fee required by section 41(1)(c) is enclosed.
Applicant: [name]
Address for correspondence: [postal or email address]
Information sought
[Describe the information, not the documents, and fix the boundaries:]
(a) subject matter: [topic]
(b) date range: [from] to [to]
(c) business units or officers likely to hold it: [names or roles]
(d) form: correspondence, file notes, briefing minutes, and records
of decisions, including material held in email and in any
document or records management system.
This description is provided to satisfy section 41(1)(e). If any part
of it is insufficient to enable the information to be identified,
please contact me under section 52(3) before treating the application
as invalid, and I will amend it under section 49.
Searches
I ask that searches be conducted in accordance with section 53(2) and
(3), using the most efficient means reasonably available, and extending
to all resources reasonably available to the agency that facilitate the
retrieval of information stored electronically. [If relevant: This
includes information held by [contractor] to which the agency has an
immediate right of access under section 121 and clause 12 of
Schedule 4.]
Form of access
I request copies under section 72(1)(b), provided electronically.
Charges
[If personal information:] This application is for personal information
about me, so no processing charge may be imposed for the first 20 hours
of processing time: section 67.
[If applicable:] I seek a 50% reduction under section [65 — financial
hardship / 66 — special benefit to the public] on the following
grounds: [grounds].
If you decide to impose a processing charge or require an advance
deposit, please provide the statements required by section 68(3) before
doing so.
[name]
[date]
REQUEST FOR PARTICULARS OF SEARCHES
Re: [reference number] — decision that information is not held
Before deciding whether to seek review, I ask the agency to confirm, in
writing, the following particulars of the searches undertaken:
1. Which systems, repositories and physical holdings were searched —
naming each (email, document and records management system,
shared drives, collaboration platforms, operational databases,
archived and legacy systems).
2. The search terms used in each system, and the date ranges applied.
3. Which business units and individual officers were asked, and what
each of them said.
4. Whether any responsive record has been destroyed, transferred or
otherwise dealt with, and if so, under what disposal authority —
noting section 53(4) and the State Records Act 1998.
5. Whether any information was held by a contractor to which the
agency has an immediate right of access: section 121 and clause 12
of Schedule 4.
6. If any search was not undertaken on the basis of section 53(5),
the basis on which the diversion of resources was assessed as both
unreasonable and substantial.
I ask for this because the reasonableness of the agency's search under
section 53 is a plainly relevant factor in discharging the burden,
which rests on the agency under sections 97 and 105, of establishing
that information is not held: Wojciechowska v Commissioner of Police
[2020] NSWCATAP 173 at [41].
[name]
[date]
APPLICATION FOR INTERNAL REVIEW UNDER SECTION 82 Re: [reference number] — decision dated [date], notice given [date] I apply under section 82 of the Government Information (Public Access) Act 2009 (NSW) for internal review of the decision identified above. This application is made within the 20 working days allowed by section 83(1). [Include the $40 fee under section 85(1) — OR, where the decision was a deemed refusal because the application was not decided within time: No fee is payable: section 85(2).] Grounds 1. [Where the decision was to refuse access:] The notice does not comply with section 61, in that it does not state [the findings on material questions of fact / the sources of information on which those findings are based / the general nature and format of the records held]. 2. [Where considerations against disclosure were applied:] The decision relies on [consideration], which is not a consideration listed in the Table to section 14, and section 14(2) provides that the listed considerations are the only ones that may be taken into account. 3. [Where reasoning discloses an irrelevant consideration:] The decision takes into account [embarrassment to government / the possibility that the information may be misinterpreted], which section 15(c) and (d) provide is irrelevant and must not be taken into account. 4. [Where the balance was struck against disclosure:] The decision does not attribute weight to each consideration and order them by priority or importance, and does not give effect to the presumption in section 5. The balance is always weighted in favour of disclosure: Callawadda Pty Ltd v Department of Planning, Industry and Environment [2021] NSWCATAD 248 at [19], applied in Webster v Bayside Council [2024] NSWCATAD 226 at [65]. 5. [Where information was said not to be held:] The searches described do not satisfy section 53(2) and (3), for the reasons set out above. The burden of establishing that the decision is justified lies on the agency: section 97. [name] [date]
APPLICATION FOR REVIEW BY THE INFORMATION COMMISSIONER Re: [agency] — [reference number] — decision dated [date] I apply under section 89 of the Government Information (Public Access) Act 2009 (NSW) for review of the decision identified above. The application is made within the 40 working days allowed by section 90. No fee is payable. [Where no internal review was sought:] I am the access applicant, so internal review is not a precondition to this review: section 89(2)(a). Decision under review [Identify which of the section 80 decisions it is — for example, a decision that government information is not held: section 80(e).] Issues [Set out the grounds, as above.] Relief sought I ask the Commissioner to recommend under section 93(1) that the agency reconsider the decision and make a new decision as if the decision reviewed had not been made. I note that the burden of establishing that the decision is justified lies on the agency: section 97(1). [name] [date]
Check the current IPC forms and lodgement addresses before sending any of these — the Commissioner publishes standard forms, and using them avoids an argument about form.
The Privacy and Personal Information Protection Act 1998 (NSW) is a different statute doing a different job. GIPA is about getting documents out; PPIP governs how an agency may collect, hold, use and disclose personal information about you — and it carries two things GIPA does not have at all: a right to have information corrected, and a tribunal power to award compensation.
GIPA Act 2009 compared with PPIP Act 1998
| GIPA Act 2009 | PPIP Act 1998 | |
|---|---|---|
| What it gives you | Access to government information held by an agency, whoever it is about | Control over personal information about you — how it is collected, held, used and disclosed |
| The access right | s 9A legally enforceable right, subject to overriding public interest | s 14Access “without excessive delay or expense” |
| Fee | $30Plus $30 per hour processing; first 20 hours free for your own personal information (s 67) | NoneNo application fee under the Act; s 14 requires access without excessive expense |
| Time to respond | 20 working dayss 57(1), extendable under s 57(2) | No fixed period“Without excessive delay”: s 14. The 60-day figure in s 53(6) governs review, not the original request |
| Correction or amendment | Nones 75(2)(b) expressly says the agency need not update or verify information it holds | s 15The agency must make appropriate amendments — corrections, deletions or additions |
| Who reviews | Agency, then the Information Commissioner, then NCAT | Agency (with the Privacy Commissioner notified), then NCAT |
| Time to seek review | 20 working daysInternal review: s 83(1) | 6 monthsFrom when you first became aware of the conduct: s 53(3)(d) |
| Remedy available | Release of the information; NCAT may set aside and order access | Up to $40,000Plus orders to correct, to refrain, to perform a principle, or to remedy loss: s 55(2) |
| Who bears the onus | The agency, expresslyss 97 and 105 | No equivalent provisionPPIP contains no express onus section; the review is of the agency's conduct |
You cannot use PPIP s 14 to route around a GIPA refusal. Section 20(5) of the PPIP Act provides that the provisions of the GIPA Act which impose “conditions or limitations (however expressed)” on any matter referred to in ss 13, 14 or 15 “are not affected by this Act, and those provisions continue to apply… as if those provisions were part of this Act”.
So GIPA's overriding public interest test travels with the information. What PPIP adds is not a wider door to the same documents — it is a different set of obligations, a correction right, and a remedy. Section 5 says the same thing from the other direction: nothing in PPIP affects the operation of GIPA, and PPIP does not lessen any GIPA obligation.
ss 8–19 — what an agency must and must not do
Collect personal information only for a lawful purpose directly related to a function of the agency, where collection is reasonably necessary for that purpose. Never by unlawful means.
Collect directly from the individual, unless you authorised collection from someone else, or the person is under 16 and a parent or guardian supplied it.
Make you aware, before or as soon as practicable after collection, of the fact and purposes of collection, intended recipients, whether supply is required by law, your rights of access and correction, and who is collecting and holding it.
Take reasonable steps to ensure what is collected is relevant, not excessive, accurate, up to date and complete, and that collection does not intrude unreasonably on your personal affairs.
Keep it no longer than necessary, dispose of it securely, protect it by reasonable safeguards against loss, unauthorised access, use, modification, disclosure or other misuse, and guard it when handing it to a service provider.
Take reasonable steps to let a person find out whether the agency holds personal information about them, its nature, the main purposes it is used for, and their entitlement to access it.
At the individual's request, provide access to their personal information without excessive delay or expense.
Make appropriate amendments so the information is accurate and, having regard to its purpose, relevant, up to date, complete and not misleading. If the agency refuses, it must on request attach your statement of the amendment sought (s 15(2)), and where practicable notify prior recipients of amendments made (s 15(3)).
Do not use the information without reasonable steps to ensure it is relevant, accurate, up to date, complete and not misleading for the purpose proposed.
Do not use it for a purpose other than collection, unless you consented, the other purpose is directly related, or use is necessary to prevent a serious and imminent threat to life or health.
Do not disclose to anyone else unless the disclosure is directly related to the collection purpose and the agency has no reason to think you would object; or you were reasonably likely to be aware such disclosure usually occurs; or it is necessary to prevent a serious and imminent threat to life or health.
Do not disclose information about ethnic or racial origin, political opinions, religious or philosophical beliefs, trade union membership or sexual activities unless necessary to prevent a serious and imminent threat to life or health. Separate limits apply to disclosure outside NSW (s 19(2)).
Compliance. Section 20(1) applies the principles to public sector agencies, subject to modification by a privacy code of practice (s 20(2)(a)). Section 21(1) prohibits an agency from doing anything, or engaging in any practice, that contravenes a principle applying to it — and s 21(2) makes a contravention “conduct to which Part 5 applies”, which is what opens the review route below. Sections 8–11 do not apply to personal information collected before Part 2 commenced: s 20(3).
The exemptions. Division 3 of Part 2 carries a long list, and in practice an agency will usually point to one of them before it argues the principle was met. Section 22 is the overarching limit: nothing in the Division authorises an agency to do something it is otherwise prohibited from doing. The specific exemptions are: s 23 law enforcement and related matters; s 23A ASIO; s 24 investigative agencies; s 25 where non-compliance is lawfully authorised or required; s 26 where non-compliance would benefit the individual concerned; s 27 certain law enforcement agencies; s 27A information exchanges between public sector agencies; s 27B research; s 27C credit information; s 27D emergency situations; s 27E BOCSAR; and s 28 other exemptions.
One exemption that does not reach s 15. Section 15(4) provides that s 15, and any provision of a privacy code of practice relating to it, apply to public sector agencies despite s 25 of this Act and s 21 of the State Records Act 1998. So the “lawfully authorised or required” exemption does not defeat a correction request, and neither does the State Records Act. Section 15(6) extends s 15 to a Minister and a Minister's personal staff.
Part 5 — review of conduct, on calendar time
Note the unit change. GIPA counts in working days; PPIP counts in calendar months and days. And PPIP reviews conduct, not a decision — so the thing you complain about is the agency's handling of your personal information, not a particular refusal.
A contravention of an information protection principle, or of a privacy code of practice, is conduct to which Part 5 applies: s 21(2). Section 52 sets out what the Part covers.
You can also make a privacy complaint directly to the Privacy Commissioner under s 45, which is a separate route from internal review — the Commissioner may conciliate under s 49 and report under s 50.
Apply in writing to the agency, giving an address in Australia for the notice, within 6 months from when you first became aware of the conduct — or later if the agency allows: s 53(3). The reviewer must, so far as practicable, be someone not substantially involved in the conduct, an employee or officer of the agency, and suitably qualified: s 53(4).
The agency must notify the Privacy Commissioner of your application as soon as practicable, keep the Commissioner informed, and tell the Commissioner the findings and proposed action: s 54(1). The Commissioner may make submissions (s 54(2)) and may, at the agency's request, conduct the review on its behalf (s 54(3)).
Outcomes open to the agency under s 53(7): take no further action; make a formal apology; take remedial action including the payment of monetary compensation; give undertakings; or implement administrative measures.
If you are not satisfied with the findings of the internal review, or with the action the agency took, you may apply to NCAT for administrative review under the Administrative Decisions Review Act 1997: s 55(1).
The orders available under s 55(2) are considerably wider than anything in GIPA: damages up to $40,000 as compensation for loss or damage (para (a)); an order to refrain from conduct contravening a principle or code (b); an order requiring performance of a principle or code (c); an order that disclosed personal information be corrected (d); an order to take specified steps to remedy loss or damage (e); an order not to disclose personal information in a public register (f); and ancillary orders (g).
A practical rule of thumb
Use GIPA when you want documents — whether about you or about anything else the agency does. It has deadlines, reasons, a free external review, and an express onus on the agency. It is the stronger instrument for extracting material.
Use PPIP when the complaint is about handling rather than access: information collected without telling you, used for something else, disclosed to someone who should not have it, held insecurely, or simply wrong and the agency will not fix it. It is also the only route to money.
The two are often run together. A GIPA application obtains the file; what the file reveals about collection, use or disclosure then founds a PPIP internal review under s 53. Nothing in either Act prevents that, and s 5 of the PPIP Act and s 10 of the GIPA Act both preserve the other's operation.
Two places. Clause 3(b) of the Table to s 14 of the GIPA Act makes it a consideration against disclosure that release would contravene an information protection principle under the PPIP Act or a Health Privacy Principle under the Health Records and Information Privacy Act 2002 — so the twelve principles above are the content of that consideration. And clause 17 of Schedule 1 to the GIPA Act gives a conclusive presumption against disclosure of information relating to cyber security and data breaches under the PPIP Act, which is the Part 6A mandatory notification scheme (ss 59A–59ZJ).
Sources. Government Information (Public Access) Act 2009 (NSW), consolidated as at 30 July 2026. Privacy and Personal Information Protection Act 1998 (NSW), consolidated as at 30 September 2026. Information and Privacy Commission NSW, Annual Report 2024–25, Table 4 (GIPA external reviews) for the 116 “information not held / searches” figure. Tribunal decisions as cited in the text.
Three things this page does not do. It does not compute a public interest outcome, because s 13 of the GIPA Act is not amenable to that. It does not know the Christmas closedown period declared by the Premier, which affects every working-day count under Sch 4 cl 1. And it does not cover the Health Records and Information Privacy Act 2002, which governs health information and is excluded from “personal information” under PPIP by s 4A.
Not legal advice. This is a navigational aid to two statutes, prepared for general use. Section references should be checked against the current consolidations before being relied on, and fee amounts and prescribed matters against the regulations in force.