中文 Tiếng Việt العربية

Fact Sheet - External review by the Information Commissioner

Read the document below or download it here Fact Sheet - External Review by the Information Commissioner September 2026

Who is this information for?

If you are a member of the public and are dissatisfied with an agency’s decision about access to government information under the Government Information (Public Access) Act (GIPA Act) and want to have it reviewed by the Information Commissioner.

Why is this information important?

This Fact Sheet helps you to understand your rights of review of agency decisions made in relation to your GIPA application.

Relevant legislation

This Fact Sheet provides a simple summary of the following legislative provisions:

Government Information (Public Access) Act 2009 part 5 div 3 (GIPA Act)

Government Information (Information Commissioner) Act 2009 s 42 (GIIC Act)

 

What are my review options?

As explained in IPC Fact Sheet – Your Review Rights under the GIPA Act, you have three review options: internal review by the agency who made the decision, and two external review options: by the Information Commissioner or by NCAT. 

This Fact Sheet considers your review option of external review by the Information Commissioner.

What decisions can be reviewed?

You have the right to request a review of certain decisions made by government agencies about the release of information under the GIPA Act. These are listed in section 80, and in simple terms, include a decision:

(a)          that your application is not valid 

(b)          to transfer your access application to another agency

(c)           to refuse to deal with your application – including a ‘deemed refusal’ where the agency did not process your application in time

(d)          to provide access or to refuse to provide access to information 

(e)          that government information is not held by the agency

(f)            that information you applied for is already available 

(g)          to refuse to confirm or deny that information is held by the agency

(h)          to defer the provision of access to information in response 

(i)            to provide access to information in a particular way or not to provide access in the way you requested 

(j)            to impose a processing charge or to require an advance deposit

(k)          to refuse a reduction in a processing charge

(l)            to refuse to deal further with your access application because you failed to pay an advance deposit within the time required for payment

(m)        to include information in a disclosure log despite your objection or objection of someone consulted.

Can I apply to have a decision reviewed by the Information Commissioner?

You can apply to have the agency decision reviewed by the Information Commissioner if you are either the person applying for government information, or you are a person who was consulted under section 54 in relation to another person’s access application and object to the decision to release that information.

Do I have to seek an internal review by the agency before asking for review by the Information Commissioner?

Not always:

  • If you are the person who applied for access to information, you do not have to have an internal review of the decision before asking the Information Commissioner to review it

  • If internal review is not available in the circumstances.

But, if you are a person consulted under s 54, and not the access applicant, you must seek an internal review before applying for review by the Information Commissioner, unless that option is not available to you in the circumstances.

Internal review is not available in either case if:

  • a Minister or their personal staff, or the principal officer of an agency made the decision, you cannot ask for an internal review, but you can ask for an external review

  • the decision is being or has already been reviewed by the Information Commissioner or the NCAT – except if the internal review was recommended following an external review by the Information Commissioner.

Are there any restrictions on seeking external review by the Information Commissioner? 

Yes. You cannot ask for an external review by the Information Commissioner if: 

  • NCAT has already reviewed the decision, or is currently reviewing the decision

  • you made your initial GIPA application to the IPC itself, because the Information Commissioner is unable to undertake an external review of the IPC’s own decision. 

How long do I have to ask for an external review by the Information Commissioner?

You have 40 working days after you have been given the notice of decision by the agency to ask for external review by the Information Commissioner. 

There is no provision for the Information Commissioner to accept applications out of time. 

What is a working day?

A ‘working day’ is any day that is not a Saturday, Sunday, public holiday or any day during the period declared by the Premier of NSW as the Christmas closedown period.

When does the time limit start?

If the agency emails you the notice of decision, the time to ask for an external review begins from the date of the email. 

If the agency posts you the notice of decision, the time begins to run on the first working day after the notice was posted, even if you had not yet received the notice at that point.

Do I have to pay for the review? 

No. A review by the Information Commissioner is free.

How do I ask for a review? 

You can submit an application for review by contacting the IPC.

A common way of submitting an application for external review by the Information Commissioner is by completing the form for Application for External Review by the Information Commissioner. We can help you fill out the form if you would like us to, if you telephone or email us.

What should be included with a request for review? 

You should briefly outline the facts of your application, and include (where applicable) a copy of all relevant correspondence between you and the agency, such as:

  • your access application

  • the agency’s notice of decision about your application

  • your internal review application (if you made one)

  • the agency’s decision on your internal review request (if you received one).

What is the review process?

  • When we receive an external review application we will:

  • contact you to confirm that we have received your application and give a reference number for the review

  • notify the agency that made the decision that we have received your application for review

  • conduct a preliminary assessment to determine whether we have jurisdiction to accept your request for review – we may need to ask you or the agency to provide us with information or copies of documents

  • allocate the review request to one of our regulatory officers who acts as a delegate of the Information Commissioner in conducting the external review: see Information Commissioner – Executed Instrument of Delegation 

  • notify you and the agency when the review is allocated and ready to be progressed – this is when the officer assesses the matter to ensure that we have all information required to conduct the review 

  • notify you when the review period has commenced (once they are satisfied that the IPC has all required information) and the date the review is to be completed – i.e. within 40 working days.

In reviewing your application, the regulatory officer will review the decision made by the agency and decide whether that decision was justified in accordance with the requirements set out in the GIPA Act.

The regulatory officer will look at a range of factors, such as the process that the agency followed and its decision, to form a view about whether the agency correctly followed and applied the provisions of the GIPA Act.

The regulatory officer may ask you and the agency for further information or a submission.

The regulatory officer will write a report outlining the Information Commissioner’s view and any recommendations for you and/or agency.

In some cases, the regulatory officer may contact you and the agency and provide a ‘provisional view’. This will only happen if we need to check facts or seek further submissions. A provisional view is not the Information Commissioner’s final view and report. It is used to provide an opportunity for us to ask additional information or to check facts if this is required.

We will usually ask that any additional information be provided within ten (10) working days.

Once the regulatory officer is satisfied that all relevant information has been properly considered, a final review report will be sent to both you and the agency. The review report may contain recommendations for the agency to consider. This may include a recommendation that the agency reconsider and make a new decision on the access application.

Some final review reports are published on the IPC website. However, consent will be obtained from you and any other relevant person before we publish any personal information online.

What if I have a question about my review?

You will be provided with the name of the regulatory officer handling your case at the time the file is allocated. 

Please feel free to contact them via our general email ipcinfo@ipc.nsw.gov.au or our freecall number 1800 472 679 if you have any questions throughout the review process.

How long will the Information Commissioner take?

The Information Commissioner must complete the review and make any recommendations within 40 working days from the day on which all necessary information relating to a review application has been gathered from both you and the agency. This may take some time. You can also agree with the Information Commissioner to extend this timeframe and the Information Commissioner will notify the agency about this.

You must be notified when the review is completed and advised of any recommendations made by the Information Commissioner.

What if the Information Commissioner does not complete the review in this timeframe?

In this case, the Information Commissioner is deemed to have made no recommendations to the agency. The agency decision is then deemed to be justified. 

What if I disagree with the conclusions and recommendations in the final review report?

It is important to note that the Information Commissioner’s final review report is not the relevant agency decision. 

If you disagree with the final review report of the Information Commissioner, you may seek a review of the agency’s decision with the NSW Civil and Administrative Tribunal (NCAT). 

Are there any restrictions on seeking external review by NCAT?

Yes. If you made your initial GIPA application to the IPC itself. While the GIPA Act div 4 includes a review pathway to NCAT, NCAT has held that s 42 of the GIIC Act requires you first to obtain leave (permission) from the Supreme Court of NSW before NCAT can review the IPC’s decision:

What if I have other concerns about an agency?

You have the right to complain to the Information Commissioner about how an agency exercises its functions under the GIPA Act. See the IPC Fact Sheet – Complaints about the actions of agencies. 

If you decide to make a complaint to the Information Commissioner, you can either:

  • complete and submit the ‘Complaint to the Information Commissioner webform’ on the website. 

  • submit your complaint in writing via email to ipcinfo@ipc.nsw.gov.au.

Other useful resources

Other resources that may be useful on this topic include:

For more information

Contact the Information and Privacy Commission NSW (IPC):

Freecall:              1800 472 679
Email:                   ipcinfo@ipc.nsw.gov.au 
Website:             www.ipc.nsw.gov.au 

NOTE: The information in this fact sheet is to be used as a guide only. Legal advice should be sought in relation to individual circumstances.

How easy did you find it to understand this resource?
Have you used the information in this resource to assist you?
Fact Sheet - External Review by the Information Commissioner September 2026