Do I have to provide information we got from another agency?

A person is entitled to ask for any personal information you hold about them, and it doesn’t matter how you got the information, or where you got it from.

However, if you know that another organisation also holds the information, and you think it would be more appropriate for that organisation to decide whether to provide the information (for example, because they created the information, or because they have a closer relationship with the individual), then you should transfer the request (or the relevant part) to that organisation.

If you want to transfer the request either in whole or in part, you will need to do so promptly (within 10 working days of receiving it), and let the person know that their request has been transferred. However, you shouldn’t transfer a request if you know the person wouldn’t want you to.

Note: you can only transfer an IPP 6 request to another organisation that has an obligation to respond to the request under the Privacy Act.

Updated September 2024