The Australian Privacy Principles are rules for entities the Privacy Act 1988 actually covers. APP 13 is the correction principle. It will not give you a European-style right to be forgotten, unpublish a news feature, or empty a forum thread. Against the right entity, it will make a record accurate.
If you remember one distinction from this guide, make it this one: correction is not deletion. APP 13 asks an APP entity to take reasonable steps so that the personal information it holds is, having regard to the purpose for which it is held, accurate, up-to-date, complete, relevant and not misleading. APP 11 later asks whether the entity still needs the information at all. Mixing the two is how a letter to a bank becomes a letter the bank can ignore.
This sits in the Australian law hub. It is not legal advice. The Privacy and Other Legislation Amendment Act 2024 has started to land — including a statutory tort for serious invasions of privacy from June 2025 — but APP 13 itself is still the correction engine.
Who is an APP entity, and who is not
An APP entity is an agency — broadly, an Australian government agency — or an organisation the Act covers. Organisations include companies with an annual turnover of more than $3 million, and smaller operators the Act pulls in anyway: health service providers, businesses that trade in personal information, credit reporting bodies. A lot of the Australian internet is not an APP entity.
Small business operators under the turnover threshold are exempt unless an exception applies. A boutique “people search” page that has never seen $3 million may sit outside APP 13. Some of those businesses do trade in personal information, which pulls them back in. Data-broker opt-outs are still worth doing; they are a hygiene programme, not an APP 13 determination.
Individuals acting in a personal capacity are exempt. The neighbour, the ex, the Reddit account that is just a person — they are not APP entities. Section 16 says the Principles do not apply to personal, family or household affairs.
State and Territory agencies, including most public hospitals and public schools, have their own information-privacy statutes. Employee records held by a private employer remain, for now, in a well-known exemption. Do not assume it has vanished because a minister said it should. Media organisations acting in the course of journalism, if they have publicly committed to published privacy standards, are exempt — that is the door that shuts APP 13 against the Age and the ABC. Registered political parties, in the political acts the Act carves out, are also exempt.
The desks this letter is for: a bank, a telco, a health insurer, a Commonwealth department, a credit bureau, a large retailer, a broker clearly in the business of trading personal information.
What APP 13 actually requires
The entity must take reasonable steps to correct personal information it holds when it is satisfied the information is incorrect, or when you ask. “Holds” includes information the entity generated or received from someone else. Reasonable steps are contextual. A bank updating a middle name is trivial. A Commonwealth record that is also an archival record may not be alterable except under the Archives Act 1983.
If the entity corrects, and you ask it to, it must take reasonable steps to notify other APP entities to which it had previously given the information. That is not a broadcast to the internet. If it refuses, it must tell you in writing, with reasons and a complaints pathway, and must, if you ask, associate a statement recording that you say the information is wrong. It must not charge you. It must respond in a timely way — thirty days is the rhythm most privacy policies still quote, not a stopwatch in every case.
APP 12 (access) is the sibling. Ask for access, then ask for the correction.
Correction versus deletion
Australians who have read the GDPR arrive at APP 13 holding the wrong instrument.
A correction might be: the account is closed, not current; the default listing is a previous suburb; the “director” flag is a residual role you resigned. Those are APP 13 facts. They are also, sometimes, ASIC and ABN residue, which is a different registrar.
A deletion is a different request. APP 11.2 says an entity must take reasonable steps to destroy or de-identify personal information it no longer needs for any purpose for which it may be used or disclosed under the APPs. “I would rather you did not have it” is not the test. A bank that still needs the record for the Anti-Money Laundering and Counter-Terrorism Financing Act will not delete it because you are embarrassed. There is still no general Australian right to erasure of lawful, accurate, still-needed information. Anyone selling “GDPR takedowns for Australian files” is selling a foreign statute.
Credit files are their own desk
Credit reporting sits in Part IIIA of the Privacy Act, with the credit reporting bodies — Equifax, Experian, illion — and the providers that furnish them. The correction rights there are cousins of APP 13, not the same form.
If a default, an enquiry or an amount is wrong, write to the bureau and to the provider that listed it. A correction here can change a rental, a phone plan or a loan next week. A credit file will not delete a listing that is accurate and still within the retention period. That is the point of the file.
The OAIC is the second desk, not the first
The Office of the Australian Information Commissioner does not correct records on a telephone call. The pathway is:
- Write to the APP entity. Name the record and the inaccuracy, attach the proof, and ask for correction. Ask for access first if you need to see the record.
- Wait for the response. Keep the letter.
- If the entity refuses or does not respond in a reasonable time, complain to the OAIC with the correspondence attached. A determination is available. It is not a takedown order against the open web.
- A path from a determination exists in the federal courts. That is solicitor territory.
The OAIC is not a prosecutor of forum posts, and it is not an appeals bench for journalism. A complaint that is really “please unpublish this article” will end at the exemptions.
What APP 13 cannot do to a newspaper or a forum
A newspaper. The journalism exemption in section 7B is why APP 13 does not reach the article. The organisation must be a media organisation, the act must be in the course of journalism, and the organisation must have publicly committed to published privacy standards. The exemption covers the journalism, not the masthead’s marketing list. An APP 13 letter about a feature is the wrong statute. Use the corrections desk, and if the words are false and seriously harmful, use defamation. Our privacy statement is the house version of the same distinction: we will correct our record of you; we will not unpublish a method piece because you dislike the method.
A forum. The poster is almost certainly an individual in a personal capacity. Asking Reddit to “correct” a comment is not what APP 13 was built to do. The comment is someone else’s speech, not the host’s record of your date of birth. Platform policy, the Online Safety Act where the speech is abuse, and defamation where it is a false imputation are the live instruments.
A court list, a judgment, a company extract. Public registers exist to be public. APP 13 does not suppress a judgment because you lost. Registrar-specific processes — ASIC, ABN Lookup, the courts’ own suppression rules — are the real work. Do not send the OAIC a request that is really a suppression application.
A working sequence we recommend
- Identify the entity. If it is not an APP entity, stop using APP 13 as the heading.
- Ask for access to the record if you have not seen it.
- Write a short correction request. Quote the field. Attach the proof. Ask for downstream notification if it matters.
- If the record is a credit listing, write to the bureau and the provider on the same day.
- If the record is a broker page, run the opt-out and treat APP 13 as a bonus if the broker is clearly trading in personal information.
- If the entity refuses, request an associated statement, then complain to the OAIC with the file attached.
- If the thing you hate is an article or a thread, put this statute down and pick the right one.
If you want the desk to look at a general question about the process, use contact. Do not send the credit file, the passport, or a zip of the leak. We publish method. We do not run your case.