Privacy (Credit Reporting) Code 2025
21Complaints
Start here
Get a plain-English read of 21
Turn the raw legal text into a practical explanation grounded in Privacy (Credit Reporting) Code 2025.
21 Complaints
(1) This section is made for the purposes of Division 5 of Part IIIA of the Act.
Note: Division 5 of Part IIIA of the Act contains requirements relating to the handling of complaints.
(2) Where a credit reporting body or credit provider is required by Australian law, a condition of a licence issued by a regulatory authority or an enforceable Industry Code requirement to meet complaints handling requirements, the body or provider must comply with those requirements for the purposes of a complaint under Part IIIA of the Act.
(3) If subsection (2) does not apply to a credit reporting body or credit provider, that body or provider (as applicable) must comply with the following sections of ISO 10002:2018(E) Quality management - Customer satisfaction - Guidelines for complaints handling in organisations for the purposes of a complaint under Part IIIA:
(a) Section 4 Guiding Principles;
(b) Section 5.2 Leadership and Commitment;
(c) Section 6.4 Resources;
(d) Section 8.1 Collection of information; and
(e) Section 8.2 Analysis and evaluation of complaints.
(4) A credit reporting body must be a member of, or be subject to, a recognised external dispute resolution scheme.
Note: The Commissioner may recognise an external dispute resolution scheme under section 35A of the Act.
(5) A credit reporting body or credit provider that is consulted by another body or provider about a complaint must take reasonable steps to respond to the consultation request as soon as practicable.
Note: If the recipient considers it necessary to consult with a credit reporting body or credit provider, subsection 23B(2) of the Act requires them to consult with that body.
(6) If a credit reporting body or credit provider forms the view that it will not be able to resolve a complaint within the 30 day period required by Part IIIA of the Act, the body or provider (as applicable) must:
(a) inform the individual of the delay before the end of the 30 day period and provide the reason for the delay, the expected timeframe to resolve the complaint and seek their agreement to an extension for a period that is reasonable in the circumstances; and
(b) advise that the person may complain to the recognised external dispute resolution scheme of which the body or provider (as applicable) is a member, or to which it is subject – and provide the contact details for that scheme - or, in the case of a provider that is not a member of, or subject to, such a scheme, to the Commissioner.
Notifications of complaints
(7) Where a credit reporting body has an obligation under subsection 23C(2) of the Act to give notice to a credit provider about a complaint relating to a body’s act or practice that may breach section 20S of the Act, this obligation is taken to be met if the body gives notice as soon as practicable to: