An OPC inquiry — whether triggered by a complaint or an own-motion investigation — usually asks one core question: what reasonable steps did you take to ensure the individual was aware of the collection?
What the OPC typically requests
- Which data sources were accessed
- When each lookup occurred
- Which IPP3A pathway was relied on
- Evidence of notification or consent where applicable
- Who in your organisation performed the lookup
Exporting from DEIS
- Open Lookups → History (or Evidence depending on your workspace version).
- Filter by date range, data source, or individual identifier.
- Export as CSV or PDF for regulator-facing packs.
Each row includes timestamp, user, data source, pathway, and notification delivery status where relevant.
Common mistakes in OPC responses
Spreadsheet reconstruction after the fact. The OPC can tell when evidence was created retroactively. DEIS records are timestamped at lookup time.
Blanket consent without lookup-level records. A signed form helps, but you still need to show it applied to this lookup on this date.
Notification sent but not delivered. Bounce handling matters. DEIS records delivery events, not just send clicks.
When to get legal support
DEIS gives you the factual record. Your counsel helps frame narrative and privilege. Export early and share the pack with your advisor before responding to the Commissioner.