When a customer asks your mortgage support team for their personal information, capture the request accurately and hand it to the brokerage's responsible privacy owner. Keep the original receipt time, the requested records and any uncertainty about the requester visible. Preparing an application file does not mean an assistant should decide what may be released.
This proposed intake method is for Australian brokerages defining administrative duties for assistants and processors. It helps the responsible person assess a request under the organisation's process. It does not decide whether a particular entity is covered by privacy law, whether an exception applies or which documents a requester is entitled to receive.
Recognise the request without making a release decision
A customer might ask for “everything you hold about me”, a copy of a particular conversation or information supplied by a representative. Record their actual words and the contact route. A support worker should not quietly narrow a broad request to the documents they happen to see in the application folder.
The OAIC's access guidance explains the general right to access personal information, subject to exceptions. It says the organisation must be satisfied that a request comes from the person or someone they have authorised. Its guidance distinguishes an organisation's reasonable response period from the specific 30-day requirement for an agency.
Have the privacy owner confirm the applicable process and response expectations. Do not turn a forwarded request into a fresh receipt date or promise an automatic 30-day extension. For internal coordination, retain when the request first reached the team and record when the owner accepted it.
Build an intake card with six fields
Scroll sideways to see all columns →
| Field | Support worker records |
|---|---|
| Original receipt | Date, time, time zone and controlled message or call reference |
| Requester | Stated identity, contact route and any claimed representative relationship |
| Request | The person's own description of information sought and preferred access method |
| Uncertainty | Unresolved identity, authority, scope or mixed-record questions |
| Action taken | Approved acknowledgement or internal transfer actually completed |
| Accepted ownership | Responsible privacy contact, acceptance time and next internal check |
Use controlled references rather than attaching a whole mortgage pack to the intake card. The owner needs a route to the original request and relevant systems. Extra copies can make it harder to know which record was reviewed or eventually released.
An illustrative acknowledgement might say: “We have received your request and referred it to [responsible contact] under our access-request process. They will contact you about the next steps.” Use only approved wording that reflects what actually happened. Do not promise that every requested document will be supplied or ask for more identification than the approved process requires.
Rehearse a fictional joint-applicant request
All details in this exercise are invented. A message from the usual contact address for mock applicant A asks for the complete joint application file. The folder also contains applicant B's documents and an accountant's covering note. Applicant A says a new adviser will collect the information on their behalf.
The assistant records the original request, identifies the joint-file reference and notes that representative authority has not been established in the intake record. They route the request to the privacy owner without sending the folder to either the customer or the adviser. They do not infer that being one applicant settles access to every item in a joint file.
The privacy owner then asks for an inventory of potentially relevant records within specified systems. The assistant prepares that inventory under the instruction, recording where each item is held and any apparent third-party content. They mark it “for owner review”, not “approved release pack”. The owner handles the applicable access decision and any required treatment of other people's information.
The exercise tests two separate handoffs: receipt to the privacy owner, then the owner's scoped retrieval instruction to the worker. A forwarded email alone does not show that either handoff was accepted.
Keep retrieval separate from disclosure
Where the approved process assigns retrieval to support, give the worker a defined search scope and return location. Name the systems, the relevant references and the person who will assess the results. Keep discovered items distinguishable from the set authorised for release.
If the worker cannot search a system, record that limitation rather than reporting “all records found”. If a relevant record sits with a provider, pass that dependency to the owner. Do not contact an unfamiliar recipient or open a broader account solely because the request sounds urgent.
Use the support file-note method to distinguish the request, the instruction, the search performed and the unresolved step. The access-permissions matrix helps keep retrieval within the worker's existing authorised duties.
Close the coordination task on an actual event
Record the owner's instruction and the administrative action actually completed. If the owner approves a communication or transfer, follow the approved recipient, channel and version checks. Sending an internal inventory is different from completing the requester's access process.
Keep the next check owned when a response, authority check or retrieval remains pending. Review a fictional request with the backup contact before assigning this duty to an outsourced worker. The practical standard is whether another person can find the original request and identify who is making the outstanding decision.
Discuss a clearly scoped mortgage support role with Mortgage Talent. Include your approved request-intake process, privacy decision-maker and retrieval boundaries in the brief. Confirm specialist privacy advice separately; this administrative workflow does not establish that such advice is part of a staffing service.
Take the next step
Explore Mortgage Talent or speak with our team about your hiring needs.