Fact Sheet - Your review rights under the GIPA Act

Read the document below or download it here Fact Sheet - Your review rights under the GIPA Act, updated July 2026
 

What decisions can be reviewed?

You have the right to request a review of certain decisions made by government agencies about the release of information under the GIPA Act. These are listed in section 80, and in simple terms include a decision:

1. that your application is not valid 
2. to transfer your access application to another agency
3. to refuse to deal with your application – including a ‘deemed refusal’ where the agency did not process your application in time
4. to provide access or to refuse to provide access to information 
5. that government information is not held by the agency
6. that information you applied for is already available 
7. to refuse to confirm or deny that information is held by the agency
8. to defer the provision of access to information in response 
9. to provide access to information in a particular way or not to provide access in the way you requested 
10. to impose a processing charge or to require an advance deposit
11. to refuse a reduction in a processing charge
12. to refuse to deal further with your access application because you failed to pay an advance deposit within the time required for payment
13. to include information in a disclosure log despite your objection or objection of someone consulted.

What are my review options? 

You have three options: 

Internal review

• by the agency who made the decision 

External review

• by the Information Commissioner 
• by the NSW Civil and Administrative Tribunal (NCAT). 

Option 1: Internal review by the agency

What is an internal review?

An internal review asks the agency to look at the decision again.

Who does the review?

An officer who is at least as senior as the person who made the original decision. The officer performs the review as if the original decision had not been made.

How long do I have to ask for an internal review?

You have 20 working days after you have been given the notice of a decision to ask for an internal review. An agency may accept an application for internal review out of time, but is not obliged to do so.

What is a working day?

A ‘working day’ is any day that is not a Saturday, Sunday, public holiday or any day during the period declared by the Premier of NSW as the Christmas closedown period.

When does the time limit start?

If the agency emails you the notice of decision, the time to ask for an internal review begins from the date of the email. 

If the agency posts you the notice of decision, the time limit begins to run on the first working day after the notice was posted, even if you had not yet received the notice at that point.

Will I be told that the agency has received my request for an internal review?

Yes. The agency must acknowledge your internal review request within five working days of receiving it.

Do I have to pay for an internal review?

There is a $40 fee, but an agency may choose to waive it. There are some situations where you can’t be charged a fee for an internal review: 

• if the agency failed to process your application in time (‘deemed refusal’).
• if the internal review is conducted because the Information Commissioner has recommended the agency reconsider its decision.

How long will the internal review take?

The agency must decide the internal review within 15 working days. The agency can extend this by an extra 10 working days if they have to consult with someone else not previously consulted (a ‘third party’). The review period can also be extended by agreement with the agency.

Can I ask for an internal review of all my GIPA application decisions?

There are some limits:

• If a Minister or their personal staff, or the principal officer of an agency made the decision, you cannot ask for an internal review, but you can ask for an external review (see Options 2 and 3 below).
• If the decision is being or has already been reviewed by the Information Commissioner or the NCAT – except if the internal review was recommended following an external review by the Information Commissioner.

Option 2: External review by the Information Commissioner

Do I have to seek an internal review by the agency before asking for review by the Information Commissioner?

Not always:

• If you are the person who applied for access to information, you do not have to have an internal review of the decision before asking the Information Commissioner to review it.
• If internal review is not available in the circumstances (see above).

Are there any restrictions on seeking external review by the Information Commissioner? 

Yes. You cannot ask for an external review by the Information Commissioner: 

• If NCAT has:
  
  • already reviewed the decision, or
  • is currently reviewing the decision.
• If you made your initial GIPA application to the IPC itself. The Information Commissioner is unable to undertake an external review of the IPC’s own decision

How long do I have to ask for an external review by the Information Commissioner?

You have 40 working days after you have been given the notice of decision to ask for external review by the Information Commissioner. There is no provision for the Information Commissioner to accept applications out of time. 

What can the Information Commissioner do in an external review?

The Information Commissioner can only make recommendations about the decision to the agency. This may include a recommendation that the agency reconsider and make a new decision on the access application.

How long will the Information Commissioner take?

The Information Commissioner must complete the review and make any recommendations within 40 working days from the day on which all necessary information relating to a review application has been gathered. You can agree with the Information Commissioner to extend this timeframe and the Information Commissioner will notify the agency about this.

You must be notified when the review is completed and advised of any recommendations made by the Information Commissioner.

What if the Information Commissioner does not complete the review in this timeframe?

In this case, the Information Commissioner is deemed to have made no recommendations to the agency. 

The original decision then stands and the only option available to you is to seek external review by NCAT.

Option 3: External review by NCAT

If you disagree with any of the decisions listed in section 80 (listed on page 1 of this fact sheet), you can ask for a review by NCAT. 

Do I have to have an internal review by the agency first?

If you are the person applying for access to information, you do not have to have an internal review of the decision before asking NCAT to review it. 

If you are not the original access applicant (e.g. you are someone else consulted when another person made a GIPA application, a ‘third party’), you must seek an internal review before applying for review by NCAT. Even if this applies to you, an internal review may not be available, and so is not required, if:

• the decision was made by a Minister or their personal staff
• the decision was made by the principal officer of an agency made the decision, 
• the decision has already been internally reviewed by the agency 
• the decision is being or has been reviewed by the Information Commissioner.

Are there any restrictions on seeking external review by NCAT?

Yes. If you made your initial GIPA application to the IPC itself. While the GIPA Act div 4 includes a review pathway to NCAT, NCAT has held that s 42 of the GIIC Act requires you first to obtain leave (permission) from the Supreme Court of NSW before NCAT can review the IPC’s decision:

• Jeray v Information and Privacy Commission [2024] NSWCATAP 239 (published 25 November 2024)

• Wojciechowska v Information and Privacy Commission [2026] NSWCATAD 126 (published 4 May 2026).

How long do I have to ask for an external review?

If you have applied for review by the Information Commissioner, you have 20 working days from being notified of the Information Commission’s review outcome to apply to NCAT.

In other circumstances, you have 40 working days from being given the decision to apply to NCAT for review. 

Further information can be found on the NCAT website: https://www.ncat.nsw.gov.au. 

Contact the Information and Privacy Commission NSW (IPC):

Freecall:           1800 472 679
Email:              ipcinfo@ipc.nsw.gov.au 
Website:           www.ipc.nsw.gov.au

 NOTE: The information in this fact sheet is to be used as a guide only. Legal advice should be sought in relation to individual circumstances

Flowchart – reviewing an agency’s decision:

NOTE: The information in this fact sheet is to be used only as a guide and only applies to applications made under the GIPA Act to agencies other than the IPC. Independent legal advice should be sought in relation to individual circumstances.