Can a client ask a conveyancer for a copy of their file?

Q: What are they actually entitled to?

Personal information about them that you hold. That is broader than most practices assume and narrower than "the file". Broader , because personal information is information about an identified or reasonably identifiable individual, and it does not have to be formal, sensitive or correct. Your file notes are personal information. An internal email describing a client as difficult is information about that client and is within scope. Practices are routinely surprised by this and it is the single most useful thing to know before you write the note, not after. Narrower , because a conveyancing matter contains a great deal that is not personal information about the requester: the contract terms, the other side's information, searches and certificates about the property, and your own working documents to the extent they are not about them. A request for "my file" is therefore two requests wearing one coat. One is the APP 12 statutory right. The other is a professional and contractual question about the matter file, which is governed by your retainer, your state's conveyancing and licensing rules and the general law, not by the Privacy Act. They can produce different answers, and it is w

Q: How long do we have?

For an organisation , APP 12.4(a)(ii) requires you to respond within a reasonable period after the request is made . The fixed 30-day figure that circulates is APP 12.4(a)(i) , which applies to agencies , meaning Commonwealth agencies, not to a private conveyancing practice. (Compilation 104, `verify/2026-07-30-app12-13-subsections.md`) That is not licence to take longer. The OAIC's guidance treats 30 days as the benchmark for what is ordinarily reasonable, and a practice that takes three months on a straightforward request will struggle to call that reasonable. Treat 30 days as the working target and the outer edge of comfortable, not as an entitlement you have until. What actually protects you is the acknowledgement. Reply promptly confirming you have the request, what you understand it to cover, and when you expect to respond. Most complaints in this area are about silence rather than delay. ✅ Lettering pinned to Compilation 104. Both limbs sit under 12.4(a) , as (a)(i) agency and (a)(ii) organisation. ⚠️ I had previously written this as 12.4(a) and 12.4(b); 12.4(b) is the separate manner-of-access duty , and the flag on this line is why the wrong version never shipped.

Yes. APP 12 gives an individual a right to be given access to the personal information you hold about them, on request, and a conveyancing practice bound by the Privacy Act has to respond. Two things make it less alarming than it sounds: the right runs to personal information about the person asking, not to every document in the matter, and an organisation may charge a non-excessive fee for giving access, which agencies may not. Before you collate anything, confirm who is asking.

By Jon Oates, Founder of Privaproof · Last updated 28 July 2026

‹ Conveyancer privacy compliance hub

General information, not legal advice. Your obligations depend on your circumstances.

First: are you sure who is asking?

Do this before you look for a single document, because getting it wrong is the version of this that causes real harm.

A request arrives by email, from an address that looks like your former client's, asking for the file. In a conveyancing practice that file may contain a current residential address, a mortgage position, identity documents and financial evidence. Handing that to the wrong person is a disclosure in breach of APP 6, and in the worst case it puts someone's address in the hands of a person they have moved to get away from.

So confirm identity proportionately to the sensitivity of what is being asked for. For a full settlement file, more than a matching email address. Where the request comes through a third party, a lawyer, a family member, an accountant or an attorney, verify the authority as well as the identity, and check its scope. A power of attorney is not automatically a licence to collect everything.

And where you doubt, slow down rather than refuse. APP 12.3 has grounds for refusal and "I was not sure" is not one of them. Verifying is not refusing.

Sources: Privacy Act 1988 (Cth), APP 6, APP 12 · OAIC APP 12 guidelines

What are they actually entitled to?

Personal information about them that you hold. That is broader than most practices assume and narrower than "the file".

Broader, because personal information is information about an identified or reasonably identifiable individual, and it does not have to be formal, sensitive or correct. Your file notes are personal information. An internal email describing a client as difficult is information about that client and is within scope. Practices are routinely surprised by this and it is the single most useful thing to know before you write the note, not after.

Narrower, because a conveyancing matter contains a great deal that is not personal information about the requester: the contract terms, the other side's information, searches and certificates about the property, and your own working documents to the extent they are not about them.

A request for "my file" is therefore two requests wearing one coat. One is the APP 12 statutory right. The other is a professional and contractual question about the matter file, which is governed by your retainer, your state's conveyancing and licensing rules and the general law, not by the Privacy Act. They can produce different answers, and it is worth separating them in your response rather than treating the whole thing as a privacy request.

Sources: Privacy Act 1988 (Cth), APP 12.1, s 6(1) definition of personal information · OAIC APP 12 guidelines

How long do we have?

For an organisation, APP 12.4(a)(ii) requires you to respond within a reasonable period after the request is made. The fixed 30-day figure that circulates is APP 12.4(a)(i), which applies to agencies, meaning Commonwealth agencies, not to a private conveyancing practice. (Compilation 104, `verify/2026-07-30-app12-13-subsections.md`)

That is not licence to take longer. The OAIC's guidance treats 30 days as the benchmark for what is ordinarily reasonable, and a practice that takes three months on a straightforward request will struggle to call that reasonable. Treat 30 days as the working target and the outer edge of comfortable, not as an entitlement you have until.

What actually protects you is the acknowledgement. Reply promptly confirming you have the request, what you understand it to cover, and when you expect to respond. Most complaints in this area are about silence rather than delay.

✅ Lettering pinned to Compilation 104. Both limbs sit under 12.4(a), as (a)(i) agency and (a)(ii) organisation. ⚠️ I had previously written this as 12.4(a) and 12.4(b); 12.4(b) is the separate manner-of-access duty, and the flag on this line is why the wrong version never shipped.

Sources: Privacy Act 1988 (Cth), APP 12.4 · OAIC APP 12 guidelines

Can we charge for it?

Yes, and this is the point where conveyancers are most often told the wrong thing.

APP 12.8 permits an organisation to charge for giving access, provided the charge is not excessive and does not apply to the making of the request. APP 12.7 is the reason for the confusion: it says an agency must not charge at all. (Compilation 104, `verify/2026-07-30-app12-13-subsections.md`)

So a private conveyancing practice may recover the reasonable cost of retrieving and producing the information. What it may not do is:

Charge for the request itself, as distinct from giving access.
Set a charge that is excessive, or one that is really a deterrent rather than a cost.
Use the charge to delay. Raise it early and clearly, not after the reasonable period has run.

The practical read: a modest, explained, cost-based charge for a large retrieval is within the rules. A standing "file retrieval fee" pitched at a level designed to make people go away is not.

Sources: Privacy Act 1988 (Cth), APP 12.8, APP 12.9 · OAIC APP 12 guidelines

What if they owe us money?

This is the question every conveyancing practice asks, and it deserves a careful answer rather than a convenient one.

A practice may have a lien over the matter file for unpaid fees. That is a right in relation to documents, arising under the general law and your retainer. APP 12 is a statutory right of access to personal information about an individual. They are different rights over different objects, and the existence of one does not obviously answer the other.

What the Act does say, and it is now pinned. APP 12.3 sets out ten grounds on which an organisation may refuse access: a serious threat to life, health or safety; unreasonable impact on the privacy of others; a frivolous or vexatious request; existing or anticipated legal proceedings not discoverable in those proceedings; revealing your intentions in negotiations; unlawfulness; a refusal required or authorised by law or a court order; suspected unlawful activity or serious misconduct where access would prejudice action; prejudice to enforcement activities; and evaluative information in a commercially sensitive decision.

⛔ An outstanding invoice is not among them.

⭐ And the Act's own answer to the cost of producing information is a charge, not a refusal. APP 12.7 forbids an agency from charging; APP 12.8 expressly permits an organisation to charge a non-excessive fee for giving access. The mechanism the Act provides for expense is a fee.

⚠️ Note also that every ground is qualified by "to the extent that". They authorise withholding the part that engages the ground, not refusing the request. Redaction is the ordinary answer where a file contains other people's information.

So treat the fee dispute and the access request as separate matters. Respond to the access request within a reasonable period, and raise any permitted charge under APP 12.8 openly rather than using silence as leverage. ⚠️ Whether a general-law lien over the file interacts with an APP 12 request is a question for your own advice, and not one we will answer for you.

Sources: Privacy Act 1988 (Cth), APP 12.3, APP 12.8, APP 12.9 · OAIC APP 12 guidelines

Can we refuse, and what if we do?

You can, on the listed grounds only. The ones a conveyancing practice is most likely to reach are that giving access would have an unreasonable impact on the privacy of other individuals, and that it relates to existing or anticipated legal proceedings between you and the individual and would not be discoverable in those proceedings.

The first is common in a settlement file, because the file is full of other people. It is a reason to redact, not usually a reason to refuse outright. APP 12.5 requires you to take such steps if any as are reasonable to give access in a way that meets both your needs and the individual's, and APP 12.6 provides that access "may be given through the use of a mutually agreed intermediary". (Compilation 104, `verify/2026-07-30-app12-13-subsections.md`) Producing the information with third-party material removed is the ordinary answer.

If you do refuse, in whole or in part, APP 12.9 requires a written notice setting out the reasons, except to the extent that would be unreasonable having regard to the grounds, and the complaint mechanisms available. APP 12.10 adds that where the refusal rests on paragraph 12.3(j), the reasons may include an explanation for the commercially sensitive decision.

And note the drafting problem this creates for you. A conveyancing file is dense with information about the other party. If you have never thought about how you would separate it, the first access request will be answered under time pressure by whoever is free. Deciding the approach once, in advance, is the whole of the work.

Sources: Privacy Act 1988 (Cth), APP 12.3, APP 12.5, APP 12.6, APP 12.9, APP 12.10 · See also correcting client information

What if the matter settled years ago?

The right does not expire with the matter. It attaches to the information for as long as you hold it, so a request about a settlement from six years ago is a valid request if the file is still there.

Which points at the other side of the same coin. You can only be asked for what you still hold, and APP 11.2 requires you to destroy or de-identify personal information you no longer need for any purpose for which it may be used or disclosed, unless you are required by an Australian law or a court or tribunal order to retain it. AML/CTF record-keeping and your state's trust-account rules are such laws, and they are why a conveyancing practice keeps records it might otherwise destroy.

A practice that retains everything forever has more to search, more to redact and more to lose in a breach. A defensible retention practice makes access requests smaller. Our record retention page works through the reconciliation.

Sources: Privacy Act 1988 (Cth), APP 11.2, APP 12 · See also how long a conveyancer keeps records

This is general information, not legal advice. Privaproof provides privacy tools and general information; it is not a law practice and does not provide legal advice, and it does not assess your AML/CTF obligations, which are administered by AUSTRAC. Privaproof's conveyancer materials are self-authored and are not independently reviewed by a solicitor.