Basic guide to NPPs 5-8 - Access, amendment and anonymity


Health agencies1 must have policies regarding their management of personal information and these policies must be available upon request.

Where an individual specifically requests, a health agency must also take reasonable steps to let the individual know what sort of personal information the agency holds, for what purposes and how the agency collects, holds, uses and discloses that information.2

Access and amendment

In addition to the right of access and amendment under chapter 3 of the Information Privacy Act 2009 (Qld) (IP Act),3 National Privacy Principles (NPPs) 6 and 7 provide that where a health agency has control of a document containing personal information about an individual, it must:

  • give the individual access to the document upon request, unless the health agency is authorised or required to refuse access, or the document is expressly excluded from the operation of an access law; and
  • take all reasonable steps (including amendment) to ensure that personal information is accurate, relevant, complete, up to date and not misleading (subject to any legal limitation on amendment).

However, if:

  • a health agency considers that it is not required to amend the personal information in the manner requested; and
  • no decision or recommendation has been made under a limitation in a law of the State providing for the amendment of personal information held by the health agency

then the health agency must, if the individual asks, take all reasonable steps to attach to the document any statement provided by the individual concerning their requested amendment. 4


Under NPP 8, a health agency must allow individuals the option of not identifying themselves when entering into transactions with the agency, wherever this is lawful and practicable.

  • 1 All references to health agencies in this document include bound contracted service providers for health agencies. [up]
  • 2 As required by NPP 5. [up]
  • 3 Note that bound contracted service providers are not required to comply with chapter 3 of the IP Act. [up]
  • 4 NPP 7(4). [up]

Current as at: July 9, 2012