Allied Health NDIS Audit Checklist: worksheet
Privacy Act: the Australian Privacy Principles and notifiable data breaches. Edition held: Privacy Act 1988 (Cth), Compilation No. 104 (C2026C00227), in force 4 June 2026, registered 17 June 2026 (Schedule 1, the Australian Privacy Principles; Part IIIC, notifiable data breaches); checked current on 6 October 2026 (Federal Register of Legislation Versions API: the latest and current compilation on 6 October 2026).
Under review, not in force: From 10 December 2026, APP 1.7 to 1.9 add automated-decision content to the privacy policy (Privacy and Other Legislation Amendment Act 2024, Schedule 1 items 87 and 88). Not in force yet.
Standards library: https://compliance.theartofservice.com/frameworks/australian-privacy-principles-apps. Page: https://allied-health-ndis-audit-checklist.theartofservice.com/rules/privacy-act/app-12-13-client-access-and-correction/
| Ref | Requirement (our statement of the clause) | Evidence an auditor or the regulator asks for | Common gap to check | Held (yes, partly, no, not applicable) | Where it is kept | Owner | Last reviewed | Next review |
|---|---|---|---|---|---|---|---|---|
| APP 12.1, 12.4 | On request, give the person access to their information; respond within a reasonable period and give access in the manner requested where reasonable and practicable. Source: https://www.legislation.gov.au/C2004A03712/latest/text | An access request procedure with a target response time; A log of requests and responses | Requests answered only when chased; No log of requests | ☐ yes ☐ partly ☐ no ☐ n/a | ||||
| APP 12.3, 12.5, 12.9 | Refuse access only to the extent a ground in APP 12.3 applies (for example a serious threat to life, health or safety, or an unreasonable impact on another person's privacy); consider other means of access such as an agreed intermediary; give a written notice with the reasons and how to complain. Source: https://www.legislation.gov.au/C2004A03712/latest/text | Refusal notices with the APP 12.3 ground and complaint options | Access refused with no written reasons | ☐ yes ☐ partly ☐ no ☐ n/a | ||||
| APP 12.8 | A practice may charge for giving access, but the charge must not be excessive and must not apply to making the request. Source: https://www.legislation.gov.au/C2004A03712/latest/text | The practice fee for providing copies, if any | A fee charged for lodging the request | ☐ yes ☐ partly ☐ no ☐ n/a | ||||
| APP 13.1, 13.2 | Take reasonable steps to correct information that is inaccurate, out of date, incomplete, irrelevant or misleading, on request or when the practice is satisfied it needs correcting, and notify another entity it was disclosed to if the person asks. Source: https://www.legislation.gov.au/C2004A03712/latest/text | A correction procedure and log, including notices sent to other practitioners | Corrections made without telling the practitioner who received the earlier report | ☐ yes ☐ partly ☐ no ☐ n/a | ||||
| APP 13.3 to 13.5 | If correction is refused, give a written notice with reasons and complaint options, associate the person's statement with the record if asked, respond within a reasonable period and charge nothing. Source: https://www.legislation.gov.au/C2004A03712/latest/text | Refusal notices and associated statements on file | A client's statement not attached to the record | ☐ yes ☐ partly ☐ no ☐ n/a |
Completing this worksheet records what your practice holds and where. It does not make a practice compliant or ready for audit, and it is not legal advice.