{"id":"F2025L01377","name":"Privacy Regulations 2025","slug":"privacy-regulations-2025","collection":"legislative_instrument","jurisdiction":"commonwealth","status":"in_force","isInForce":true,"actNumber":null,"makingDate":null,"administeringDepartment":null,"currentVersion":{"id":443033,"registerId":"F2025L01377-fast-fetch-1775957945939","compilationNumber":null,"startDate":"2026-04-12","status":"InForce","reasons":null,"registeredAt":null},"sections":[{"sectionNumber":"1","sectionType":"section","heading":"Privacy Regulations 2025","content":"---\nmeta-content-style-type: text/css\nmeta-content-type: application/xhtml+xml; charset=utf-8\n---\n\n?xml version=\"1.0\" encoding=\"utf-8\" standalone=\"no\"?>\n\n![Commonwealth Coat of Arms of Australia](image.001.jpeg)\n\n \n\nPrivacy Regulations 2025\n\nI, the Honourable Sam Mostyn AC, Governor‑General of the Commonwealth of Australia, acting with the advice of the Federal Executive Council, make the following regulations.\n\nDated  13 November   2025\n\nSam Mostyn AC\n\nGovernor‑General\n\nBy Her Excellency’s Command\n\nMichelle Rowland\n\nAttorney‑General\n\n \n\n \n\n \n\n \n\n \n\n \n\n \n\nContents\n\nPart 1—Preliminary\n\n1 Name\n\n2 Commencement\n\n3 Authority\n\n4 Schedules\n\n5 Definitions\n\nPart 2—Interpretation\n\n6 Consumer credit liability information\n\n7 Small business operators treated as organisations\n\n8 State authorities treated as organisations\n\n9 State instrumentality treated as an organisation\n\n10 Meaning of credit provider\n\n11 Meaning of credit reporting business\n\n12 Meaning of repayment history information\n\nPart 3—Credit reporting\n\n13 Use or disclosure of credit reporting information\n\n14 Permitted disclosure of credit information to a credit reporting body\n\nPart 4—Dealing with personal information in emergencies and disasters\n\n15 Designated secrecy provisions\n\nPart 5—Australian Privacy Principles\n\n16 Exceptions to Australian Privacy Principle 9.1—adopting payroll numbers for the provision of superannuation services\n\n17 Exceptions to Australian Privacy Principle 9.2—using and disclosing payroll numbers for the provision of superannuation services\n\n18 Exceptions to Australian Privacy Principle 9.2—accessing Centrelink Confirmation eServices (entitlement to concessions, services or assistance)\n\n19 Exceptions to Australian Privacy Principle 9.2—accessing Centrelink Confirmation eServices (entitlement to early release of superannuation)\n\nPart 6—Application provisions\n\n20 Application of this instrument as originally made\n\nSchedule 1—Repeals\n\nPrivacy Regulation 2013\n\n \n\nPart 1—Preliminary\n\n \n\n1  Name\n\n  This instrument is the Privacy Regulations 2025.\n\n2  Commencement\n\n (1) Each provision of this instrument specified in column 1 of the table commences, or is taken to have commenced, in accordance with column 2 of the table. Any other statement in column 2 has effect according to its terms.\n\n \n\n- Commencement information\n- Column 1 Column 2 Column 3\n- Provisions Commencement Date/Details\n- 1. The whole of this instrument 1 April 2026. 1 April 2026\n\n\nNote: This table relates only to the provisions of this instrument as originally made. It will not be amended to deal with any later amendments of this instrument.\n\n (2) Any information in column 3 of the table is not part of this instrument. Information may be inserted in this column, or information in it may be edited, in any published version of this instrument.\n\n3  Authority\n\n  This instrument is made under the Privacy Act 1988.\n\n4  Schedules\n\n  Each instrument that is specified in a Schedule to this instrument is amended or repealed as set out in the applicable items in the Schedule concerned, and any other item in a Schedule to this instrument has effect according to its terms.\n\n5  Definitions\n\nNote: A number of expressions used in this instrument are defined in the Act, including the following:\n\n(a) agency;\n\n(b) contracted service provider;\n\n(c) government related identifier;\n\n(d) organisation;\n\n(e) small business operator.\n\n  In this instrument:\n\nAct means the Privacy Act 1988.\n\nAustralian Retirement Trust means:\n\n (a) the Trustee for Australian Retirement Trust Pty Ltd (ABN 60 905 115 063); or\n\n (b) a payroll contractor of that entity, acting in that capacity.\n\nAustralianSuper means:\n\n (a) the Trustee for AustralianSuper (ABN 65 714 394 898); or\n\n (b) a payroll contractor of that entity, acting in that capacity.\n\nAvSuper means:\n\n (a) the trustee for AvSuper Fund (ABN 84 421 446 069); or\n\n (b) a payroll contractor of that trustee, acting in that capacity.\n\nCentrelink Confirmation eServices scheme means the scheme of that name that is administered by Services Australia.\n\nCentrelink program has the same meaning as in the Human Services (Centrelink) Act 1997.\n\nCustomer Reference Number, for an individual, means the number assigned to the individual, in relation to a Centrelink program, by the Department administered by the Minister who administers the Human Services (Centrelink) Act 1997.\n\nNote: A Customer Reference Number is a government related identifier.\n\nDVA File Number, for an individual, means a file number assigned to the individual by the Department administered by the Minister who administers the Veterans’ Entitlements Act 1986.\n\nNote: A DVA File Number is a government related identifier.\n\nDVA unique identification number, for an individual, means the unique identification number assigned to the individual by the Department administered by the Minister who administers the Veterans’ Entitlements Act 1986.\n\nNote: A DVA unique identification number is a government related identifier.\n\nHomeStart Finance means the body with that name established by regulation 4 of the Housing and Urban Development (Administrative Arrangements) (HomeStart Finance) Regulations 1995 (SA).\n\nIndigenous person means a person who is:\n\n (a) a member of the Aboriginal race of Australia; or\n\n (b) a descendant of an Indigenous inhabitant of the Torres Strait Islands.\n\nNT Home Ownership means:\n\n (a) NT Home Ownership (ABN 85 169 745 141); or\n\n (b) an agent of that entity, acting in its capacity as agent.\n\npayroll contractor, of an organisation (the principal organisation), means an organisation that is responsible, under a contract, for processing, on behalf of the principal organisation, any payments that are:\n\n (a) received by, or on behalf of, the principal organisation; and\n\n (b) made by:\n\n (i) an agency; or\n\n (ii) an agent of an agency, acting in its capacity as agent; or\n\n (iii)  a contracted service provider for a Commonwealth contract, acting for the purposes of the provision of services to an agency under the Commonwealth contract; and\n\n (c) made for the benefit of an individual employed, or formerly employed, by the agency.\n\npayroll number, for an individual, means an identifier that is:\n\n (a) assigned to the individual by:\n\n (i) an agency; or\n\n (ii) an agent of an agency, acting in its capacity as agent; or\n\n (iii)  a contracted service provider for a Commonwealth contract, acting for the purposes of the provision of services to an agency under the Commonwealth contract; and\n\n (b) assigned for the purpose of providing salary and other employment benefits to the individual.\n\nNote: A payroll number is a government related identifier.\n\nresidential tenancy database means a database that:\n\n (a) stores personal information in relation to an individual’s occupation of residential premises as a tenant; and\n\n (b) can be accessed by a person other than the operator of the database or a person acting for the operator.\n\nPart 2—Interpretation\n\n \n\n6  Consumer credit liability information\n\n  For the purposes of paragraph (e) of the definition of consumer credit liability information in subsection 6(1) of the Act, the following terms or conditions of the consumer credit are prescribed:\n\n (a) how the principal and interest on the consumer credit are to be paid, namely whether:\n\n (i) the principal and interest are to be paid in full; or\n\n (ii) the principal and interest are to be paid, leaving a residual unpaid amount of principal and interest at the end of the term of the consumer credit; or\n\n (iii) only the interest is to be paid;\n\n (b) whether the term of the consumer credit is fixed or revolving;\n\n (c) if the term of the consumer credit is fixed—the length of the term;\n\n (d) whether the individual is a guarantor to another individual in relation to the other individual’s credit;\n\n (e) whether the consumer credit is secured or unsecured;\n\n (f) any variation to any of the terms or conditions mentioned in any of paragraphs (a) to (e) of this section.\n\n7  Small business operators treated as organisations\n\nSmall business operators that operate residential tenancy databases\n\n (1) For the purposes of subsection 6E(2) of the Act, a small business operator that operates a residential tenancy database is prescribed.\n\n (2) For the purposes of subsection 6E(2) of the Act, the following acts or practices of a small business operator of the kind mentioned in subsection (1) of this section are prescribed:\n\n (a) an act done, or a practice engaged in, in connection with collecting personal information for the purpose of establishing or maintaining a residential tenancy database;\n\n (b) an act done, or a practice engaged in, in connection with maintaining personal information on a residential tenancy database;\n\n (c) an act done, or a practice engaged in, in connection with using or disclosing personal information that is stored on a residential tenancy database.\n\n8  State authorities treated as organisations\n\nNew South Wales\n\n (1) For the purposes of subsection 6F(1) of the Act, the body known as Essential Energy established under the Energy Services Corporations Act 1995 (NSW) is prescribed.\n\nWestern Australia\n\n (2) For the purposes of subsection 6F(1) of the Act, the body known as Keystart established under the Keystart Act 2024 (WA) is prescribed.\n\nSouth Australia\n\n (3) For the purposes of subsection 6F(1) of the Act, the Office of the National Rail Safety Regulator established under the Rail Safety National Law (South Australia) Act 2012 (SA) is prescribed.\n\nNorthern Territory\n\n (4) For the purposes of subsection 6F(1) of the Act:\n\n (a) NT Home Ownership is prescribed; and\n\n (b) the modification of the Act set out in subsection (5) of this section is prescribed.\n\n (5) The Act applies in relation to NT Home Ownership as if subsection 7B(5) of the Act were modified by adding, at the end of the subsection:\n\n “; and (c) the organisation is not a contracted service provider for a State contract to which NT Home Ownership is party.”.\n\n9  State instrumentality treated as an organisation\n\n (1) For the purposes of subsection 6F(1) of the Act:\n\n (a) HomeStart Finance is prescribed; and\n\n (b) the modification of the Act set out in subsection (2) of this section is prescribed.\n\n (2) The Act applies in relation to HomeStart Finance as if Australian Privacy Principle 11.2 did not apply in relation HomeStart Finance.\n\n10  Meaning of credit provider\n\n (1) For the purposes of subparagraph 6G(1)(d)(ii) of the Act, the following agencies, organisations or small business operators are prescribed:\n\n (a) Indigenous Business Australia;\n\n (b) the Export Finance and Insurance Corporation;\n\n (c) the Regional Investment Corporation;\n\n (d) NT Home Ownership.\n\n (2) For the purposes of subsection 6G(6) of the Act, an organisation or small business operator is not a credit provider in relation to an individual if the organisation or small business operator acts in the capacity of a current or prospective landlord of the individual.\n\n11  Meaning of credit reporting business\n\n (1) For the purposes of subsection 6P(4) of the Act, a business or undertaking is not a credit reporting business if the business or undertaking is in a class of businesses or undertakings that:\n\n (a) provides personal information to a credit provider; and\n\n (b) provides the information to:\n\n (i) verify an individual’s identity; or\n\n (ii) validate other information relating to the individual’s financial position (such as real property assets) that the individual provides to the credit provider.\n\n (2) A class of businesses or undertakings complies with paragraph (1)(b) if the class of businesses or undertakings:\n\n (a) compiles information about the individual from sources, including publicly available sources; and\n\n (b) provides the information to the credit provider to assist the credit provider to:\n\n (i) verify the individual’s identity; or\n\n (ii) verify that the individual owns real estate or other assets that the individual claims to own; or\n\n (iii) validate the individual’s claimed financial position (in relation to the value of the individual’s assets).\n\n12  Meaning of repayment history information\n\n  For the purposes of paragraph 6V(2)(a) of the Act, an individual is taken not to have met an obligation to make a monthly payment that is due and payable in relation to consumer credit if the individual misses any or all repayments due in a month, irrespective of the actual payment cycle for that obligation.\n\nPart 3—Credit reporting\n\n \n\n13  Use or disclosure of credit reporting information\n\n  For the purposes of paragraph 20E(4)(a) of the Act, the following credit providers are prescribed:\n\n (a) Indigenous Business Australia;\n\n (b) the Regional Investment Corporation;\n\n (c) NT Home Ownership.\n\n14  Permitted disclosure of credit information to a credit reporting body\n\n (1) For the purposes of subparagraph 21D(2)(a)(i) of the Act, a credit provider is prescribed if the credit provider discloses the credit information in connection with the provision of commercial credit.\n\n (2) For the purposes of subparagraph 21D(2)(a)(i) of the Act, the following credit providers are prescribed:\n\n (a) Indigenous Business Australia;\n\n (b) if the Regional Investment Corporation is not a member of, or subject to, a recognised external dispute resolution scheme—the Regional Investment Corporation;\n\n (c) NT Home Ownership.\n\n (3) For the purposes of subparagraph 21D(3)(c)(i) of the Act, the following credit providers are prescribed:\n\n (a) Indigenous Business Australia;\n\n (b) the Regional Investment Corporation;\n\n (c) NT Home Ownership.\n\nPart 4—Dealing with personal information in emergencies and disasters\n\n \n\n15  Designated secrecy provisions\n\n  For the purposes of paragraph (d) of the definition of designated secrecy provision in subsection 80P(7) of the Act, the following provisions of the Census and Statistics Act 1905 are prescribed:\n\n (a) section 19;\n\n (b) section 19A.\n\nPart 5—Australian Privacy Principles\n\n \n\n16  Exceptions to Australian Privacy Principle 9.1—adopting payroll numbers for the provision of superannuation services\n\n  For the purposes of Australian Privacy Principle 9.3:\n\n (a) a payroll number for an individual is a prescribed government related identifier if the payroll number is assigned to the individual by:\n\n (i) Airservices Australia; or\n\n (ii) an agent of Airservices Australia, acting in its capacity as agent; or\n\n (iii)  a contracted service provider for a Commonwealth contract, acting for the purposes of the provision of services to Airservices Australia under the Commonwealth contract; and\n\n (b) AvSuper is a prescribed organisation; and\n\n (c) a prescribed circumstance is that a payroll number for an individual that is a prescribed government related identifier under paragraph (a) of this section is adopted by AvSuper for the purposes of the provision of a superannuation service to the individual.\n\n17  Exceptions to Australian Privacy Principle 9.2—using and disclosing payroll numbers for the provision of superannuation services\n\n  For the purposes of Australian Privacy Principle 9.3:\n\n (a) a payroll number for an individual is a prescribed government related identifier; and\n\n (b) each of the following are prescribed organisations:\n\n (i) Australian Retirement Trust;\n\n (ii) AustralianSuper;\n\n (iii) AvSuper; and\n\n (c) a prescribed circumstance is that a payroll number for an individual is used or disclosed, by an organisation prescribed by paragraph (b) of this section, for the purposes of the provision of a superannuation service to the individual.\n\n18  Exceptions to Australian Privacy Principle 9.2—accessing Centrelink Confirmation eServices (entitlement to concessions, services or assistance)\n\n (1) For the purposes of Australian Privacy Principle 9.3:\n\n (a) each of the following numbers for an individual is a prescribed government related identifier:\n\n (i) a Customer Reference Number;\n\n (ii) a DVA file number;\n\n (iii) a DVA unique identification number; and\n\n (b) an organisation is a prescribed organisation if the organisation:\n\n (i) is a participant in the Centrelink Confirmation eServices scheme; and\n\n (ii) is included in a class of organisations set out in the table in subsection (2) of this section; and\n\n (c) a prescribed circumstance is that a number for an individual that is a prescribed government related identifier under paragraph (a) of this subsection is, with the individual’s consent, used or disclosed by an organisation prescribed by paragraph (b) of this subsection to access services provided under the Centrelink Confirmation eServices scheme to enquire whether the individual is entitled to receive a concession, service or assistance.\n\n (2) The classes of organisations are set out in the following table:\n\n \n\n- Classes of organisations that can use or disclose Customer Reference Numbers, DVA File Numbers and DVA unique identification numbers\n- Item Class of organisation\n- 1 Organisations that provide healthcare services or healthcare products, including any of the following:(a) hospitals;(b) providers of hearing products and hearing services;(c) providers of disability support services;(d) providers of counselling and mental health services;(e) providers of drug treatment and rehabilitation services.\n- 2 Organisations that are education providers, including any of the following:(a) pre‑schools, primary schools and secondary schools;(b) providers of childcare services;(c) universities, TAFE, community colleges and other tertiary education providers;(d) adult education providers;(e) organisations that provide administrative services to education providers.\n- 3 Organisations that provide any of the following:(a) electricity;(b) gas;(c) water;(d) telecommunications services;(e) broadband internet services.\n- 4 Organisations that provide passenger rail services.\n- 5 Organisations that provide motor vehicle roadside assistance services.\n- 6 Organisations that provide trustee services.\n- 7 Organisations that provide welfare services, including any of the following:(a) advocacy organisations;(b) organisations that provide assistance to:(i) elderly persons; or(ii) disabled persons; or(iii) immigrants and refugees; or(iv) Indigenous persons; or(v) families; or(vi) children; or(vii) persons impacted by domestic violence; or(viii) homeless persons; or(ix) prisoners.\n- 8 Organisations that provide free or subsidised social housing, facilities management services, mortgages or accommodation services to any of the following:(a) socially or economically disadvantaged persons;(b) elderly persons;(c) disabled persons;(d) Indigenous persons.\n- 9 Organisations that provide legal aid services, including any of the following:(a) legal aid organisations operated by the Commonwealth government, or the government of a State or Territory;(b) legal practitioners who provide services for or on behalf of legal aid organisations;(c) a court of the Commonwealth, a State or a Territory.\n- 10 Organisations that provide services on behalf of local government.\n- 11 Organisations that provide any of the following:(a) financial planning services;(b) financial products and services (including brokers);(c) insurance products and services;(d) banking services and loans as a credit union;(e) subsidised or reduced interest loans.\n\n\n \n\n19  Exceptions to Australian Privacy Principle 9.2—accessing Centrelink Confirmation eServices (entitlement to early release of superannuation)\n\n  For the purposes of Australian Privacy Principle 9.3:\n\n (a) a Customer Reference Number for an individual is a prescribed government related identifier; and\n\n (b) an organisation is a prescribed organisation if the organisation:\n\n (i) is a participant in the Centrelink Confirmation eServices scheme; and\n\n (ii) provides superannuation products and services; and\n\n (c) a prescribed circumstance is that a Customer Reference Number for an individual is, with the individual’s consent, used or disclosed by an organisation prescribed by paragraph (b) of this section to access services provided under the Centrelink Confirmation eServices scheme to enquire whether the individual is entitled to the early release of superannuation on the ground of financial hardship.\n\nPart 6—Application provisions\n\n \n\n20  Application of this instrument as originally made\n\n  Sections 16, 17, 18 and 19 (which provide for exceptions to Australian Privacy Principles) apply in relation to a government related identifier that is assigned to an individual before, on or after the commencement of this instrument.\n\nSchedule 1—Repeals\n\n \n\nPrivacy Regulation 2013\n\n1  The whole of the instrument\n\nRepeal the instrument.\n\n \n","sortOrder":0}],"analysis":{"kimi_summary":{"content_quality":"ok","complexity_score":5,"scope_assessment":{"changed":false,"description":"The legislation maintains the traditional scope of privacy regulations — operational details and specific exceptions under the Privacy Act 1988. While it adds new categories of exceptions (particularly around Centrelink verification services) and brings additional state entities under coverage, this represents incremental expansion within the established framework rather than a fundamental shift beyond the original regulatory purpose."},"complexity_factors":["Heavy cross-referencing to the Privacy Act 1988 (the 'Act') with numerous references to specific subsections (e.g., 'subsection 6E(2)', 'Australian Privacy Principle 9.3')","19 defined terms in section 5, many of which are entity-specific (naming particular superannuation funds and government bodies by ABN and legislative establishment)","Nested conditional logic in the exceptions framework — exceptions to principles that are themselves exceptions to general prohibitions","Multiple modification clauses that rewrite how the Act applies to specific entities (e.g., sections 8(5) and 9(2) modify the Act's application to NT Home Ownership and HomeStart Finance)","Prescriptive tables for commencement information and classes of organisations (Part 5, section 18)","Specific entity naming creates fragmentation — different rules apply to AvSuper vs AustralianSuper vs Australian Retirement Trust despite all being superannuation funds"],"plain_english_summary":"This regulation replaces the 2013 Privacy Regulation, refining how personal information is handled under the Privacy Act by updating credit-reporting rules, extending federal privacy coverage to additional state bodies and tenant-database operators, and creating narrow exceptions that allow certain organisations to use government identifiers for legitimate verification and superannuation purposes. \n\nIt matters because it balances stronger privacy safeguards with practical data-sharing for service delivery, eligibility checks and emergency responses while limiting misuse of sensitive identifiers."},"flash_summary_failed":{"failed":true,"reason":"A positive credit balance is required for all requests, including BYOK, so fallback providers remain available. Add credits at https://vercel.com/d?to=%2F%5Bteam%5D%2F%7E%2Fai%3Fmodal%3Dtop-up to continue.","source":"analysis-cron"},"flash_summary":{"complexity_score":5,"scope_assessment":{"changed":true,"description":"Yes. The instrument repeals the Privacy Regulation 2013 and replaces it with a reworked set of prescriptions: it narrows or expands who counts as an ‘organisation’ for the Act, prescribes specific government‑related identifiers (payroll, Centrelink, DVA), creates new exceptions to APP 9 for superannuation and Centrelink eServices, sets detailed credit‑reporting and repayment‑history rules, and applies those exceptions to identifiers assigned before commencement (s.20). These changes alter who may use or disclose identifiers and the compliance perimeter of the Act."},"complexity_factors":["Extensive cross‑references to multiple provisions of the Privacy Act 1988 (eg. ss.6E, 6F, 6G, 6P, 6V, 20E, 21D, 80P) requiring readers to consult the Act to understand effects (see whole instrument and Parts 2–4).","Numerous prescribed organisations and classes (definitions and lists across ss.5, 8, 10, 13–14, 16–19) which create targeted but granular obligations and exceptions.","Multiple targeted exceptions to Australian Privacy Principle 9 (ss.16–19) that differ by identifier, actor and circumstance, increasing rules‑to‑facts mapping complexity.","Definitions that alter legal character of identifiers and actors (eg. payroll number, payroll contractor, residential tenancy database in s.5 and ss.6,7,12) affecting who is treated as an organisation and what counts as reportable information.","Modifications to how the Act applies to particular entities (NT Home Ownership and HomeStart Finance in ss.8–9) introducing entity‑specific deviations from standard APP application.","Interlocking credit‑reporting rules (ss.6,10–14) — defining consumer credit liability, repayment history and which bodies may disclose or receive credit information.","Temporal application clause (s.20) that makes APP exceptions apply to identifiers assigned before, on or after commencement, widening retrospective application considerations.","Full repeal of the predecessor instrument (Schedule 1) requiring transitional understanding of prior regulatory baseline."],"plain_english_summary":"These Regulations replace the Privacy Regulation 2013 and update how the Privacy Act applies to credit reporting, government‑related identifiers (for example payroll, Centrelink and DVA numbers), residential tenancy databases and certain state or superannuation bodies. They prescribe which organisations and classes may collect, use or disclose those identifiers and credit information, create exceptions to APP 9 for specified superannuation and Centrelink eServices uses, and set rules on repayment‑history reporting. Agencies, listed organisations, credit providers and small tenancy operators gain new compliance duties."}},"importantCases":[],"_links":{"self":"/api/acts/privacy-regulations-2025","history":"/api/acts/privacy-regulations-2025/history","analysis":"/api/acts/privacy-regulations-2025/analysis","conflicts":"/api/acts/privacy-regulations-2025/conflicts","importantCases":"/api/acts/privacy-regulations-2025/important-cases","documents":"/api/acts/privacy-regulations-2025/documents"}}