Does APP 12 & APP 13 access and correction requests apply to trust and company service providers?
A computed answer from the Rules Mate applicability engine, with the exact condition, the outcome for every structure and size, and the primary source.
Short answer: Yes
Yes. This obligation applies to trust and company service providers whatever their structure or size. The deciding fact: AML/CTF reporting entity — covered by the Privacy Act for AML/CTF activities (s 6E(1A)).
The obligation in brief
APP 12 & APP 13 access and correction requests. APP 12 requires entities to give an individual access to their personal information held by the entity on request, within 30 days (private sector). g.
Trigger: Receiving an access or correction request.
Why trust & company service providers get a different answer
Rules Mate runs its applicability engine across 9 business structures and 6 size bands for each of the 35 industries it maps. For 24 of those industries the answer for "APP 12 & APP 13 access and correction requests" is it depends on structure or size. Trust & company service providers is one of the 11 where the answer is different: yes.
The deciding fact for trust and company service providers: AML/CTF reporting entity — covered by the Privacy Act for AML/CTF activities (s 6E(1A))
About the industry: Entities providing trust or company formation, registered agent, or nominee services. Tranche 2 captured.
Compare a professional services (general) business with 6–19 employees structured as a Pty Ltd company: the obligation does not apply (Requires APP-entity status (turnover > $3M or a s 6D(4) carve-out)).
Answer by business structure and size
Each cell is the engine's outcome for a business in trust & company service providers with that structure and size, assuming it sells to consumers and small businesses and holds customer contact details. "Check" means the obligation turns on a fact the industry does not settle.
| Structure | No employees | 1–5 employees | 6–19 employees | 20–99 employees | 100–499 employees | 500+ employees |
|---|---|---|---|---|---|---|
| Sole trader | Yes | Yes | Yes | Yes | Yes | Yes |
| Partnership | Yes | Yes | Yes | Yes | Yes | Yes |
| Trust | Yes | Yes | Yes | Yes | Yes | Yes |
| Pty Ltd company | Yes | Yes | Yes | Yes | Yes | Yes |
| Public company | Yes | Yes | Yes | Yes | Yes | Yes |
| Not-for-profit (unregistered) | Yes | Yes | Yes | Yes | Yes | Yes |
| Registered charity | Yes | Yes | Yes | Yes | Yes | Yes |
| Super fund | Yes | Yes | Yes | Yes | Yes | Yes |
| Foreign company | Yes | Yes | Yes | Yes | Yes | Yes |
What the obligation requires
- When due
- Access: 30 days (private sector). Correction: reasonable timeframe; statement of correction if disagreement.
- Evidence to keep
- Request register, response letters, correction logs.
- Maximum penalty
- Civil penalty exposure for systemic failure to respond; complaint-handling by OAIC
- Regulator
- OAIC
- Jurisdiction
- Commonwealth (national)
Other obligations where trust & company service providers differ from the norm
- Notifiable Data Breach (NDB) scheme: Yes
- APP 7 direct marketing: consent, opt-out & when you can't message (2026): Yes
- Privacy Act Reform — information controllers regime (proposed Tranche 2): Yes
- Publish a Privacy Policy that meets APP 1: Yes
- APP 2 — anonymity + pseudonymity for individuals: Yes
- Comply with Australian sanctions law + screening (DFAT): Yes
- All 15 answers for trust & company service providers
Other industries with a non-default answer
Questions
- Does APP 12 & APP 13 access and correction requests apply to trust and company service providers?
- Yes. This obligation applies to trust and company service providers whatever their structure or size. The deciding fact: AML/CTF reporting entity — covered by the Privacy Act for AML/CTF activities (s 6E(1A)).
- Is the answer the same for every industry?
- No. For 24 of the 35 industries Rules Mate maps, the answer is it depends on structure or size. Trust & company service providers is one of 11 industries with a different answer.
Related
Sources
Computed by the Rules Mate applicability engine from the published obligation corpus; facts last checked 3 October 2026. Rules Mate is not a law firm and this is general information, not legal advice. Confirm your position with the regulator source or a qualified adviser before acting.