(1) A higher education provider must comply with the Australian Privacy Principles in respect of * personal information obtained for the purposes of subsection 36 - 12(2) or 36 - 20(1) or Chapter 3 or 4.
(2) A higher education provider must have a procedure under which a student enrolled with the provider may apply to the provider for, and receive, a copy of * personal information that the provider holds in relation to that student.
(3) The provider must comply with:
(a) the requirements of the Higher Education Provider Guidelines relating to * personal information in relation to students; and
(b) the procedure referred to in subsection (2).