Privacy and Data Protection Act 2014

An individual or organisation whose interests are affected by a decision of the Information Commissioner under section 78(1) to serve a compliance notice may apply to VCAT for review of the decision.

An application for review must be made within 28 days after the later of—

the day on which the decision is made; or

if, under the Victorian Civil and Administrative Tribunal Act 1998, the individual or organisation requests a statement of reasons for the decision, the day on which the statement of reasons is given to the individual or organisation or the individual or organisation is informed under section 46(5) of that Act that a statement of reasons will not be given.

The Information Commissioner is a party to a proceeding on a review under this section.