Government Information (Public Access) Act 2009

The GIPA Act has a wide reach. Every “agency” is subject to its proactive release, decision-making and reporting obligations. The statutory definition in s 4(1) is deliberately broad and includes:

• Public Service agencies (as defined under the Government Sector Employment Act 2013);
• Ministers and their staff employed under the Members of Parliament Staff Act 2013;
• public authorities and public offices (cll 2 and 3 of Schedule 4);
• local authorities (councils, county councils and joint organisations under the Local Government Act 1993);
• courts (but only in respect of administrative functions—judicial functions are excluded);
• any additional person or entity declared by regulation (cl 5 of Schedule 4).

Schedule 2 lists functions of particular agencies that generate “excluded information”. For example, the Independent Commission Against Corruption’s corruption prevention, complaint handling, investigative and reporting functions produce excluded information; the Judicial Commission’s complaint handling functions do likewise. An access application cannot be made for excluded information of the relevant agency (s 43).

On the applicant side, any “person” may make an access application. The definition in Schedule 4 cl 1 expressly includes agencies, other Australian governments and foreign governments. Natural persons, corporations, community groups, journalists, researchers and commercial competitors are all entitled to apply. Personal factors of the applicant (identity, motives, relationship to the subject matter) may be taken into account in limited circumstances (s 55), principally where they bear on considerations against disclosure in clauses 2–5 of the Table to s 14.

Third parties whose information is contained in the requested records are also affected. Agencies must consult them where it appears the information concerns their personal, business, professional, financial or research interests and they may have concerns about disclosure (s 54). Consultation is mandatory before personal information about a deceased person is released (consultation with a close relative). Authorised objectors (the applicant or a consulted third party) may object to inclusion of information in a disclosure log (s 56).

The Information Commissioner and NCAT exercise significant oversight functions. The Information Commissioner promotes the Act, issues guidelines, assists agencies, reviews decisions, monitors compliance and may make recommendations for legislative or administrative change (s 17). NCAT conducts administrative reviews, with special procedural rules to protect information for which there is an overriding public interest against disclosure (s 107) and limitations on its powers in respect of Cabinet and Executive Council information (s 106).

Private-sector contractors who enter government contracts valued at $150,000 or more are indirectly affected through the mandatory contract disclosure regime in Division 5 of Part 3 and the obligation under s 121 to ensure that contracts grant the agency an immediate right of access to service-delivery and public-contact records.

Finally, the Act binds the Crown (s 122) and therefore applies to the executive government as a whole, subject only to the specific carve-outs for judicial functions, parliamentary bodies and certain Royal Commissions.

Duties of agencies

• Proactive publication — Agencies must publish open access information free of charge on a website (s 6(2)) and keep a record of any open access information withheld on public-interest grounds (s 6(5)). They must adopt and review agency information guides (ss 20–21), maintain disclosure logs (s 25) and keep government contracts registers (s 27). Principal officers must authorise decisions about proactive release (ss 7(5), 8(6)).
• Facilitation and assistance — Agencies must provide advice and assistance to applicants (s 16) and help invalid applications become valid (s 52). They must conduct reasonable searches (s 53) and facilitate access by redacting irrelevant or exempt matter where practicable (ss 6(4), 7(4), 8(5), 74).
• Decision-making — Decisions on access applications must be made within 20 working days (s 57), by or with the authority of the principal officer (s 9(3)), independently of Ministerial direction (s 9(2)). Notices must be detailed, contain reasons, findings on material facts and review rights (ss 61, 126).
• Consultation — Mandatory consultation with third parties in defined circumstances (s 54) and optional consultation with other agencies (s 54A).
• Charging — Agencies may impose processing charges at $30 per hour (s 64) but must apply statutory discounts and waivers (ss 65–67) and may only require advance deposits up to 50% of the estimated charge (s 69).
• Record-keeping and reporting — Agencies must not destroy, conceal or alter records to prevent disclosure (offence under s 120) and must report annually (s 125).

Rights of applicants

• Enforceable right of access — Subject only to an overriding public interest against disclosure (s 9(1)).
• Choice of form of access — Inspection, copy, transcript or other reasonable form (s 72), subject to limited exceptions.
• No conditions on use — Access cannot be made conditional on undertakings about subsequent use or disclosure except to avoid an overriding public interest against disclosure (s 73).
• Review rights — Internal review, Information Commissioner review and NCAT administrative review of all reviewable decisions listed in s 80.
• Discounts and waivers — 50% reduction for financial hardship or special public benefit; full waiver of processing charges for the first 20 hours of personal information applications.
• Protections — Good-faith releasers are protected from defamation, breach of confidence and criminal liability (ss 113–114).

Rights and protections for third parties

• Right to be consulted and to object (ss 54, 56).
• Right to apply for review of a decision to release their information (s 80).
• Protection from actions for defamation or breach of confidence where information is released in good faith (s 113).

The Act creates five specific offences in Part 6, Division 2, each carrying a maximum penalty of 100 penalty units (currently $11,000 for a natural person):

• s 116 — An officer of an agency must not make a reviewable decision the officer knows is contrary to the Act.
• s 117 — Directing an officer to make a decision known to be unlawful, or directing any person involved in an access application to act contrary to the Act.
• s 118 — Improperly influencing a decision for the purpose of causing an unlawful outcome.
• s 119 — Knowingly misleading or deceiving an officer to obtain access to government information.
• s 120 — Destroying, concealing or altering a record for the purpose of preventing authorised or required disclosure.

Proceedings can only be brought by or with the authority of the Director of Public Prosecutions or the Attorney General (s 128(2)) and are dealt with summarily before the Local Court.

Civil enforcement is indirect. The Act does not create a statutory cause of action for breach; instead, it relies on the review jurisdiction of the Information Commissioner and NCAT, coupled with the criminal offences and the personal liability protection in s 115 (which shields officers acting in good faith). If an agency fails to decide an application within time it is deemed to have refused to deal with it (s 63), triggering refund of the application fee and rights of review. NCAT may make restraint orders against applicants who make repeated unmeritorious applications (s 110) and may refer systemic issues to the Information Commissioner (s 111). The Information Commissioner’s monitoring, audit and reporting functions (s 17(g)) provide a further layer of systemic enforcement.

The GIPA Act is designed to operate as a “default” access regime. Section 10 provides that it does not prevent or discourage publication or access under any other Act or law that enables members of the public to obtain government information. Section 11 states that the Act overrides secrecy provisions in other legislation except those listed in Schedule 1 as overriding secrecy laws. Other secrecy provisions are taken into account as considerations against disclosure under cl 6 of the Table to s 14.

Specific interactions include:

• Privacy legislation — The Privacy and Personal Information Protection Act 1998 and Health Records and Information Privacy Act 2002 are expressly referenced in cl 3 of the Table to s 14. The Information Commissioner must consult the Privacy Commissioner before issuing guidelines on privacy-related public interest considerations (s 14(4)). Personal information about the applicant is a strong factor in favour of disclosure (example (d) under s 12(2)).
• State Records Act 1998 — Preserved by s 123. Agencies are not required to search electronic backup systems unless a record has been lost in contravention of that Act or the agency’s records management procedures (s 53(4)).
• Freedom of Information Act 1989 — Repealed and replaced. Transitional provisions in Schedule 3 cll 3–4 preserve FOI applications made before repeal.
• Other access regimes — The Act sits alongside specific regimes such as the Independent Commission Against Corruption Act 1988, the Law Enforcement Conduct Commission Act 2016 and various Royal Commission statutes, many of which appear in Schedule 1 or 2.
• Subpoenas and court orders — Section 79 provides that an agency need not comply with a subpoena for documents already provided under GIPA to the person who requested the subpoena. Conversely, s 60(1)(d) permits an agency to refuse to deal with an access application if the information is available via subpoena.
• Copyright — Nothing in the Act requires or permits infringement of copyright (s 6(6)).
• ADR Act and NCAT Act — Part 5 Division 4 contains specific procedural rules that prevail over the Administrative Decisions Review Act 1997 and Civil and Administrative Tribunal Act 2013 to the extent of inconsistency (s 112A).

The Act also interacts with the Government Information (Information Commissioner) Act 2009, which establishes the office that performs the oversight, guideline and review functions referred to throughout the GIPA Act.

The GIPA Act has been amended on numerous occasions, most notably by the Government Information (Public Access) Amendment Act 2012, the Government Information (Public Access) Amendment Act 2018 and various statute-law revision and sector-specific Acts.

The 2012 amendments were the most substantial. They:

• strengthened the presumption in favour of disclosure and clarified the onus on review (amendments to ss 55, 97 and 105);
• introduced the concept of “authorised objectors” and refined disclosure-log procedures (new s 56);
• expanded agency assistance obligations and adjusted timeframes;
• clarified that personal factors of the applicant can only be taken into account in relation to certain Table considerations (s 55(3));
• introduced mandatory 20-hour waiver for personal information applications (s 67).

These changes responded to early operational experience and recommendations of the Information Commissioner that the Act should more clearly favour disclosure and reduce procedural barriers for applicants seeking their own personal information.

The 2018 amendments (No 89 of 2018) focused on streamlining and modernisation:

• increased the contract disclosure threshold from $100,000 to $150,000 (s 27);
• allowed agencies to approve additional facilities for lodging applications and paying fees (s 41(2));
• refined consultation and disclosure-log notice requirements (ss 54, 56);
• introduced s 54A permitting consultation with other agencies even if they are not expected to have concerns;
• clarified NCAT’s powers and the relationship with the ADR Act and NCAT Act (new s 112A);
• updated references to successor bodies (e.g. replacement of Administrative Decisions Tribunal with NCAT).

Subsequent amendments have been largely consequential: updating Schedule 1 to reflect new overriding secrecy laws (e.g. Public Interest Disclosures Act 2022, Electoral Act 2017, cyber-security provisions in the Privacy and Personal Information Protection Act 1998 Part 6A and the Identity Protection and Recovery Act 2025), adding new excluded-information categories in Schedule 2 (Ageing and Disability Commissioner, Children’s Guardian reportable conduct functions), and adjusting annual reporting requirements to align with the Government Sector Finance Act 2018.

The recurring theme of amendments has been to reduce administrative burden where possible while preserving or strengthening the Act’s pro-disclosure bias and ensuring that new legislative secrecy or exclusion needs (particularly around law enforcement, cyber security and child protection) are accommodated without undermining the core object in s 3.

Because the Act grounds almost all substantive decisions in the balancing of public interest considerations, litigation has concentrated on three areas.

First, the meaning and weight of the Table considerations. NCAT and its predecessor have emphasised that each consideration must be assessed on the particular facts and that generalised assertions of prejudice are insufficient. For example, claims under cl 1(f) of the Table (prejudice to effective exercise of agency functions) have been closely scrutinised; agencies must demonstrate a reasonable expectation of prejudice, not mere speculation (Commissioner of Police v Danis [2017] NSWCATAD 19 illustrates the required evidentiary threshold). The “could reasonably be expected to” test has been interpreted consistently with FOI case law as requiring a real and substantial risk, not a remote possibility.

Second, the scope of Schedule 1 conclusive presumptions, particularly Cabinet information (cl 2). Section 106 limits NCAT to deciding whether there were reasonable grounds for the agency’s claim; it cannot conduct a merits review. Disputes have arisen over whether a document was “prepared for the dominant purpose” of submission to Cabinet (cl 2(1)(b)) and the extent of the factual-material exception in cl 2(4). Courts have stressed that the exception is narrow and does not permit disclosure of documents that would reveal the substance of deliberations even if they contain facts (Egan v Chadwick (1995) 40 NSWLR 1 principles have been applied by analogy).

Third, the interaction with privacy. The requirement in s 14(4) for the Information Commissioner to consult the Privacy Commissioner before issuing guidelines on cl 3(a) or (b) considerations has produced several contested reviews. Cases have clarified that the mere fact that information is “personal information” does not automatically outweigh the public interest in disclosure; the nature, sensitivity and context must be weighed (AEZ v Commissioner of Police [2013] NSWADT 90 and subsequent NCAT decisions).

Controversies have also arisen around disclosure logs. Some agencies initially interpreted s 25 narrowly, while applicants have objected to the inclusion of their identities or the subject matter of requests on privacy grounds. The 2012 amendments and subsequent guidelines have largely resolved these by requiring agencies to balance the public interest in transparency of decision-making against the authorised objector’s concerns.

Systemic controversies have included slow compliance by some local councils, disputes over the breadth of “reasonable searches” (s 53), and the cost of processing large, poorly framed applications. NCAT’s power to make restraint orders under s 110 has been used sparingly but has been upheld on appeal where applicants have made dozens of overlapping requests.

No challenge has successfully impugned the constitutional validity of the Act. Its compatibility with implied freedom of political communication has been assumed, given that it expands rather than contracts the flow of information about government.

Most practitioners encounter several recurring traps.

1. The “overriding” threshold is high but not absolute. Many agencies still default to refusal on the basis of any conceivable prejudice. The correct approach is to identify the specific public interest considerations against disclosure that actually arise on the evidence, weigh them against the general and specific considerations in favour (including the statutory examples in s 12(2)), and only refuse if the former outweigh the latter on balance (s 13). A mere “could reasonably be expected to” prejudice is not enough if the countervailing factors are strong.

2. Personal factors are double-edged. Under s 55 an applicant’s identity and motives can be taken into account as factors in favour of disclosure (e.g. the information is the applicant’s own personal information) but can only be taken into account as factors against disclosure to the extent they engage clauses 2–5 of the Table. They cannot be used to bolster clause 1 (responsible government) or clause 6 or 7 considerations. Many decision-makers overlook this statutory limit.

3. Disclosure logs are not optional for significant releases. If an agency decides to provide access to information that it considers may be of interest to other members of the public, it must record the statutory particulars in its disclosure log (s 25) unless an authorised objector successfully objects under s 56. The objector’s entitlement to object is itself reviewable. Agencies that routinely omit entries risk Information Commissioner audit findings.

4. Schedule 1 is not a complete shield. Even where information falls within a conclusive presumption (e.g. Cabinet information), the agency must still consider whether the document has been approved for public disclosure by the Premier or whether ten years have passed (cll 2(2), 3(2)). The factual-material carve-out in cl 2(4) is narrower than many realise and does not permit disclosure of documents that would reveal the position a Minister has taken in Cabinet.

5. Redaction is not always sufficient. Section 74 permits deletion of exempt matter, but only if the remaining information is responsive to the application. If redaction would render the record meaningless or if the exempt and non-exempt matter are inextricably intertwined, the agency may lawfully refuse access to the whole record. Conversely, agencies sometimes refuse entire documents when targeted redaction would suffice—an error that is frequently corrected on review.

6. The 20-working-day decision period is strict. Extensions are permitted only for mandatory consultation, retrieval from archives, or by agreement. Processing charges cannot be imposed if the application is not decided within time (s 63(4)). Many agencies inadvertently lose the right to charge by failing to issue a formal extension notice within five working days (s 57(5)).

7. Contract registers are not mere formalities. The obligation under s 121 to ensure that government contracts grant the agency an immediate right of access to service-delivery records survives even if the contract itself is exempt from the register under one of the exceptions in ss 32, 38–40. Private contractors who resist audit rights frequently discover that the agency’s GIPA obligations override commercial confidentiality arguments.

8. NCAT’s jurisdiction on Cabinet and Executive Council information is limited. Section 106 prevents NCAT from deciding the correct and preferable decision; it can only decide whether reasonable grounds existed for the claim. If it finds reasonable grounds it must uphold the claim even if it believes disclosure would be in the public interest. This is a frequent source of misunderstanding by self-represented applicants.

For agencies

1. Establish governance — Appoint a dedicated GIPA officer reporting to the principal officer. Maintain an up-to-date agency information guide (review annually) and ensure all staff understand the presumption in favour of disclosure.

2. Proactive publication — Create and maintain a central website page for open access information. Publish contracts registers on the tenders.nsw.gov.au portal (or agency website for SOCs, councils and universities). Keep an internal register of withheld open access information (s 6(5)).

3. Application handling — Use a standardised checklist for validity (s 41). Acknowledge within 5 working days with all required statements (s 51(3)). Log the application for potential disclosure-log inclusion and notify the applicant of objection rights.

4. Searches and consultation — Document searches (date, databases searched, keywords, responsible officers). Consult third parties early using the exact notice requirements in s 54(2A). Record objections and decisions on disclosure-log inclusion.

5. Decision-making — Apply the public interest test methodically: list all relevant considerations in favour and against, weigh them, and record findings on material questions of fact (s 61). Cite specific clauses of the Table. If refusing, explain why redaction was not practicable.

6. Charges and deposits — Calculate processing time conservatively. Issue advance-deposit notices that comply with s 68(3). Apply all mandatory discounts and waivers. Do not charge if the decision is late.

7. Review readiness — Ensure every decision notice contains correct review rights and contact details. Prepare comprehensive s 58(1) ADR Act bundles for NCAT that include all search records, consultation notes and the weighing exercise.

8. Training and culture — Annual refresher training for all staff who handle information. Senior management must visibly support the pro-disclosure culture required by s 3(2) and s 15(a).

For applicants

1. Check open access information first — Search the agency’s website and disclosure log before lodging a formal application. Much information is already available free of charge.

2. Draft precisely — Identify the information sought with sufficient particularity to satisfy s 41(1)(e). Attach submissions on public interest factors you wish the agency to consider (s 42(a)).

3. Consider informal release — Many agencies will provide information informally if the request is narrow and uncontroversial.

4. Anticipate consultation — If the request concerns personal or business information of third parties, expect delay for consultation and be prepared to explain why disclosure is in the public interest or why personal factors favour release.

5. Manage costs — Request a 50% discount or full waiver where applicable. Narrow the request if an advance deposit notice is received. Keep the scope realistic—broad “all documents relating to X” requests frequently trigger s 60(1)(a) refusal for unreasonable diversion of resources.

6. Use review rights strategically — Internal review is quick but limited to the same agency. Information Commissioner review is free, non-adversarial and often results in recommendations that agencies accept. NCAT review is appropriate for complex legal questions or where binding orders are required.

7. Preserve evidence — Keep copies of all correspondence, search logs provided by the agency and any evidence of personal factors (e.g. hardship) that may be relevant on review.

By following these compliance steps, agencies minimise review applications and legal risk, while applicants maximise the likelihood of prompt, low-cost access to the information they seek. The Act’s detailed procedural architecture exists to make these outcomes routine rather than exceptional.