Privacy Regulations 2025

Several discrete legal mechanisms are central to this instrument. Each is a conversion of policy choice into legal prescription under the Act.

1. Prescriptions under definitions in the Act

• The regulations repeatedly use the Act’s power to prescribe details that feed into statutory definitions. For example, s 6 prescribes which terms or conditions count as consumer credit liability information under subsection 6(1) of the Act. That alters what data credit providers may consider reportable under the Act’s credit reporting framework.

2. Treating entities as “organisations” for the Act

• Sections 7, 8 and 9 use the Act’s mechanism for extending the definition of “organisation” beyond private sector bodies to capture small business operators (residential tenancy database operators) and specified State authorities and instrumentalities. The legal consequence is that the privacy obligations and rights in the Act (and APPs where applicable) apply to these entities as if they were organisations within the Act’s coverage.

3. Carving out specific exceptions to APP 9

• APP 9 restricts the adoption, use and disclosure of government related identifiers. The regulations create narrow exceptions under Australian Privacy Principle 9.3 (referred to in ss 16-19) by prescribing certain payroll numbers and other government identifiers as government related identifiers and by prescribing circumstances and organisations in which those identifiers can be adopted, used or disclosed for particular services (notably superannuation services and access to Centrelink Confirmation eServices). The exceptions are governed by the text of ss 16-19 and, where specified, require the individual’s consent (ss 18(1)(c), 19(c)).

4. Credit reporting definitions and permissions

• The instrument clarifies what constitutes repayment history information (s 12), prescribes certain agencies as credit providers for particular provisions of the Act (s 10 and s 13), and prescribes circumstances for permitted disclosure of credit information to credit reporting bodies including disclosure in connection with commercial credit (s 14). It also specifies that certain businesses that provide personal information to credit providers for identity verification or asset validation are not credit reporting businesses (s 11).

5. Designation of secrecy provisions

• Section 15 designates sections 19 and 19A of the Census and Statistics Act 1905 as “designated secrecy provisions” for the Act’s subsection 80P(7) definition. That converts those Census Act secrecy offences or prohibitions into a discrete category recognised by the Act for the purposes of emergency/disaster dealings with personal information.

6. Transitional application

• Section 20 addresses temporal application: ss 16-19 apply to government related identifiers assigned before, on or after the instrument’s commencement, making those APP exceptions retrospective for assigned identifiers.

Taken together, these concepts alter scope and permissible conduct under the Act by: (a) bringing particular private and state bodies into the Act’s coverage; (b) permitting specified identifier-based data uses in defined circumstances; (c) clarifying credit-reporting reporting and disclosure mechanics; and (d) linking secrecy provisions under the Census Act into the Act’s emergency/disaster disclosure framework.

The instrument names and effectively changes the regulatory position of a set of identifiable actors, plus broad classes of entities and individuals.

Named organisations and classes

• Superannuation trustees and payroll contractors: Australian Retirement Trust (s 5 definition), AustralianSuper (s 5), AvSuper (s 5). Sections 16 and 17 prescribe circumstances in which these organisations (and AvSuper specifically) may adopt, use or disclose payroll numbers for the provision of superannuation services (ss 16-17).
• Agencies assigning payroll numbers: Airservices Australia is specifically referenced in s 16(a). The definition of payroll contractor and payroll number in s 5 determines when a payroll number is a government related identifier.
• Centrelink-related participants: Participants in the Centrelink Confirmation eServices scheme administered by Services Australia and organisations in the enumerated classes may use Customer Reference Numbers and certain DVA identifiers to access confirmation services to enquire about entitlement to concessions, services or assistance, with the individual’s consent (s 18). A narrower set of participants that provide superannuation products and services can use Customer Reference Numbers to enquire about entitlement to early release of superannuation on financial hardship grounds (s 19).
• Small business operators operating residential tenancy databases: Section 7 prescribes those small businesses as organisations for the Act and prescribes their relevant acts or practices that bring them within the Act (collecting, maintaining, using/disclosing personal information on those databases).
• State authorities and instrumentalities: Essential Energy (NSW), Keystart (WA), the Office of the National Rail Safety Regulator (SA), NT Home Ownership (NT) are prescribed as organisations (s 8). HomeStart Finance is prescribed as a State instrumentality (s 9). Special modifications apply to NT Home Ownership and HomeStart Finance (ss 8(5) and 9(2)).
• Credit-related bodies: Indigenous Business Australia, Export Finance and Insurance Corporation (EFIC), the Regional Investment Corporation, and NT Home Ownership are prescribed as credit providers for particular provisions (s 10 and s 13). Section 11 also identifies classes of business that are not credit reporting businesses because they provide information to credit providers for identity verification or asset validation.
• Operators of databases beyond the operator: The definition of “residential tenancy database” (s 5) captures databases that store personal information relating to an individual’s occupation of residential premises and which are accessible by persons other than the operator.

Individuals affected

• Employees and former employees of agencies where payroll numbers are assigned (s 5 definition of payroll number and payroll contractor).
• Tenants whose personal information is on residential tenancy databases (s 5 definition and s 7).
• Individuals who have consumer credit and whose repayment conduct may be reported as repayment history information under s 12.
• Individuals whose government related identifiers (Customer Reference Number, DVA file numbers, DVA unique identification number, payroll numbers) are used or disclosed under the exceptions in ss 16-19; those uses generally require the individual’s consent in the Centrelink Confirmation eServices contexts (s 18(1)(c), s 19(c)).

Who pays and who decides

• The instrument places decision-making control in regulation by naming which entities can act in specified ways. The named organisations or classes are the ones that may adopt or use specified identifiers, to the extent the exceptions allow it (ss 16-19). The Act’s enforcement and compliance machinery (not modified here) remains the route for sanction; the instrument itself does not insert standalone fines. Costs of compliance, system changes, privacy-policy updates and potentially increased data handling practices fall on the prescribed organisations and small business operators because the instrument extends coverage or permits new data practices for them. Individuals pay in the sense that their identifiers may be used or disclosed in new circumstances, subject in some cases to consent requirements explicitly included in ss 18 and 19.

The regulations alter duties and rights by prescribing how statutory provisions of the Privacy Act apply to particular entities and circumstances. The instrument does not rewrite the APPs, but creates statutory exceptions and extensions. The key legal duties and rights to note, with precise references, are as follows.

Duty to observe the Act where entity is prescribed

• Where a body is prescribed as an organisation, the Act applies to that body as if it were an organisation. Section 7 prescribes small business operators operating residential tenancy databases as organisations for the purposes of subsection 6E(2) of the Act. Sections 8 and 9 prescribe particular State bodies and instrumentality status for the Act’s purposes. The practical consequence is that those bodies must comply with the obligations and enjoy the rights that apply to organisations under the Act, except where the instrument modifies application (for example s 9(2) exempts APP 11.2 in relation to HomeStart Finance).

Specific APP 9 exceptions and conditions

• APP 9 generally controls adoption, use and disclosure of government related identifiers. The instrument prescribes narrow exceptions:
  • s 16 prescribes that certain payroll numbers assigned by Airservices Australia and their payroll contractors are government related identifiers and that AvSuper is a prescribed organisation. The prescribed circumstance is AvSuper adopting such an identifier for provision of a superannuation service.
  • s 17 prescribes payroll numbers as government related identifiers and the listed superannuation providers (Australian Retirement Trust, AustralianSuper, AvSuper) as prescribed organisations where a payroll number is used or disclosed for the provision of superannuation services.
  • s 18 prescribes Customer Reference Numbers, DVA file numbers and DVA unique identification numbers as government related identifiers for the purposes of APP 9.3 where a participant in the Centrelink Confirmation eServices scheme, and an organisation in the enumerated classes, may use or disclose those identifiers with the individual’s consent to enquire about entitlement to concessions, services or assistance.
  • s 19 prescribes Customer Reference Numbers for use by Centrelink Confirmation eServices participants that provide superannuation products and services to enquire about early release entitlement, again with the individual’s consent implied by the structure of s 19.
• These sections, read together, create a statutory permission to adopt, use or disclose the named identifiers in specified circumstances without the general APP 9 prohibition applying.

Consent requirement in Centrelink Confirmation eServices uses

• Where the instrument allows access to services under the Centrelink Confirmation eServices scheme to enquire about entitlement, it requires that the use or disclosure be “with the individual’s consent” (s 18(1)(c), s 19(c)). That is a statutory condition on permitted use/disclosure in those sections.

Credit reporting rights and duties

• Section 6 prescribes what counts as consumer credit liability information for paragraph (e) of the definition in subsection 6(1) of the Act, thereby affecting what credit providers may include in credit-related records. Section 12 makes an explicit rule for repayment history information: an individual is taken not to have met a monthly payment obligation if they miss any or all repayments due in that month, irrespective of the payment cycle. That alters the operational test used for s 6V(2)(a) of the Act.
• Sections 10 and 13 prescribe certain agencies and bodies as credit providers for specific provisions of the Act (subparagraphs 6G(1)(d)(ii) and 20E(4)(a)), enabling those bodies to engage in credit provider activities under the Act’s credit reporting framework. Section 11 excludes classes of businesses from being credit reporting businesses where they merely provide identity verification or asset validation information to a credit provider; that changes who must comply with credit reporting business obligations.

Designated secrecy provisions and emergency disclosure

• Section 15 prescribes sections 19 and 19A of the Census and Statistics Act 1905 as designated secrecy provisions for the Act’s subsection 80P(7). That creates a statutory recognition of those Census secrecy provisions when applying the Act’s rules about handling personal information in emergencies and disasters. The concrete effect is to define which external secrecy obligations are relevant to the Act’s emergency disclosure rules.

Modifications to application

• The instrument modifies how the Act applies in specific instances. For example, s 9(2) makes the Act apply in relation to HomeStart Finance as if APP 11.2 did not apply to it. Section 8(5) prescribes a modification for NT Home Ownership by adding a clause to subsection 7B(5) of the Act, excluding contracted service providers for a State contract to which NT Home Ownership is party. Those are precise legal alterations to which APP obligations apply to those entities.

Transitional application

• Section 20 states that ss 16-19 apply in relation to a government related identifier assigned before, on or after commencement, so the permissions and exceptions are not confined to identifiers assigned after the instrument takes effect.

What is not created here

• The Regulations do not create standalone criminal penalties or administrative fines in the text provided. Enforcement and penalties are left to the Act’s existing framework; the instrument exercises delegated prescribing powers to clarify and modify the Act’s operation for particular entities and identifiers.

The instrument does not itself introduce new penalty provisions or specific enforcement mechanisms. Its effect on enforcement and remedies arises by changing which entities and data practices fall within the scope of the Privacy Act 1988 and by clarifying permitted practices under APP 9 and the Act’s credit reporting provisions.

Key points on enforcement and penalties, based on the instrument’s text:

• No new penalties in the regulations

  • The regulations contain no new criminal offences, infringement notice schemes, or administrative penalty schedules. The instrument operates by prescribing application and interpretation matters under the Act rather than by creating fresh sanctions.

• Enforcement routes remain those in the Act

  • Because the instrument is made under the Privacy Act 1988 (s 3), the enforcement, complaint-handling and remedial mechanisms in the Act will continue to apply to activities that are brought within scope by the prescriptions here. The instrument does not amend the Act’s enforcement provisions in the text provided.

• Consequential compliance exposure

  • Entities that become “organisations” under these regulations (for example, small business operators of residential tenancy databases under s 7, or prescribed State bodies under s 8) will be subject to the Act’s compliance regime. That can include complaints to the Office of the Australian Information Commissioner and any subsequent remedies or enforcement action that the Act permits. The instrument therefore increases potential enforcement exposure for those newly prescribed bodies without altering the Act’s sanctioning framework.

• Credit reporting processes and reporting exposure

  • By prescribing how repayment history information is to be determined (s 12) and by designating particular credit providers and permitted disclosure pathways (ss 10, 13-14), the instrument changes what information credit providers and credit reporting bodies may lawfully rely on or transmit. Non-compliance with the Act’s credit reporting obligations in the new contexts still engages the Act’s enforcement mechanisms.

• Designated secrecy provisions and emergency disclosure

  • Section 15’s designation of Census Act ss 19 and 19A as designated secrecy provisions means that those provisions will be treated within the Act’s emergency/disaster disclosure rules (subsection 80P(7) of the Act). The regulations do not, however, change the penalties that attach to breaches of the Census Act secrecy provisions themselves; they simply list those provisions for the Act’s definitional purposes.

Practical implication for regulated entities and advisers

• Advisers should not expect new enforcement grounds beyond the Act, but should expect that entities newly brought into the Act’s scope will have to respond to the Act’s existing enforcement environment. That means privacy complaints, investigations and any regulatory action available under the Act could follow where conduct in the newly prescribed contexts breaches the Act or exceeds the narrow exceptions established in ss 16-19.

The instrument is heavily cross-referential. It uses the Act’s prescribing power to modify the Act’s application and to tie provisions of other Commonwealth laws into the Act’s framework. These are the main statutory interactions and the mechanisms by which they operate.

Privacy Act 1988

• The instrument is made under the Privacy Act 1988 (s 3) and repeatedly references specific sections and definitions in the Act, for example subsection 6(1), subsection 6E(2), subsection 6F(1), subsection 6G, subsection 6P(4), subsection 6V(2)(a), paragraph 20E(4)(a), and subparagraph 21D(2)(a)(i). The Regulations therefore function as subordinate law that clarifies or prescribes aspects of how the Act’s definitions and exceptions operate.

Census and Statistics Act 1905

• Section 15 prescribes sections 19 and 19A of the Census and Statistics Act 1905 as “designated secrecy provisions” for the purposes of subsection 80P(7) of the Act. The mechanism is definitional: by listing those provisions, the Act’s emergency/disaster personal information provisions can treat those Census secrecy provisions as relevant secrecy laws for the Act’s handling of information in emergencies.

Human Services (Centrelink) Act 1997 and Centrelink Confirmation eServices

• The instrument defines “Customer Reference Number” in relation to a Centrelink program and references the Centrelink Confirmation eServices scheme administered by Services Australia (s 5 definitions and ss 18-19). It prescribes specific uses of Customer Reference Numbers, DVA file numbers and DVA unique identification numbers by participants in the Centrelink Confirmation eServices scheme, conditioned on individual consent (ss 18-19). The mechanism is one of cross-agency data confirmation: private or non-Centrelink participants in the scheme may query entitlement status via Centrelink Confirmation eServices subject to the APP exceptions in these regulations.

Veterans’ Entitlements Act 1986 and DVA identifiers

• The instrument expressly notes that DVA File Number and DVA unique identification number are government related identifiers because they are assigned by the Department that administers the Veterans’ Entitlements Act 1986 (s 5 definition). Those identifiers are then prescribed for limited use under the Centrelink Confirmation eServices exceptions (s 18).

State Acts and State-owned entities

• The instrument prescribes State bodies established under State legislation, for example:
  • Essential Energy under the Energy Services Corporations Act 1995 (NSW) (s 8(1)).
  • Keystart under the Keystart Act 2024 (WA) (s 8(2)).
  • Office of the National Rail Safety Regulator under the Rail Safety National Law (South Australia) Act 2012 (SA) (s 8(3)).
  • NT Home Ownership, which is defined in s 5 and prescribed in s 8(4), and for which s 8(5) modifies the Act’s subsection 7B(5) as it applies to NT Home Ownership.
  • HomeStart Finance under the Housing and Urban Development (Administrative Arrangements) (HomeStart Finance) Regulations 1995 (SA) is prescribed as a State instrumentality in s 9, and s 9(2) modifies application by excluding APP 11.2 in relation to it.
• The mechanism is to apply the federal Privacy Act to these state entities by prescription, with particular carve-ins or carve-outs.

Credit and financial sector laws and frameworks

• The instrument references credit reporting concepts under the Act and prescribes particular entities as credit providers (s 10, s 13). It also uses the concept of a “recognised external dispute resolution scheme” in s 14(2)(b) when prescribing the Regional Investment Corporation conditionally. The mechanism is legal classification: entities so prescribed acquire the status and duties of credit providers under the Act’s credit reporting regime, and in some cases the prescription conditionally depends on their membership in external dispute resolution systems.

Other

• The instrument repeals the earlier Privacy Regulation 2013 (Schedule 1). That repeal will interact with prior delegations and compliance settings that depended on the 2013 regulations; practitioners should map previous regulatory reliefs and prescriptions to the new regulations to determine what has changed operationally.

Net effect on interaction

• The Regulations use the Act’s delegated powers to integrate specific identifiers, entities and external statutory secrecy provisions into the Privacy Act framework. The cross-references create a network where Commonwealth privacy rules apply to state entities, where Centerlink and DVA identifiers can be used by third parties under limited, consented circumstances, and where credit reporting definitions are adjusted for reporting and disclosure practices. Entities operating at the intersection of these regimes will need to reconcile any differences between the requirements of the cross-referenced statutes and the exceptions and prescriptions in these regulations.

This instrument is presented as a new regulation made in 2025. The instrument itself records a single explicit amendment history item: repeal of the Privacy Regulation 2013 in Schedule 1. Beyond that, the instrument contains commencement and application provisions relevant to time of operation.

Key items:

• Commencement

  • The whole instrument commences on 1 April 2026 (s 2). The instrument contains the standard note that the commencement table relates only to the instrument as originally made and will not be updated for later amendments.

• Repeal of earlier regulation

  • Schedule 1 repeals the whole of the Privacy Regulation 2013 (Schedule 1, item 1). This is a complete repeal of that subordinate instrument. The practical effect is that any prescriptions, exemptions or rules in the 2013 regulations cease to have effect and are replaced where relevant by the new prescriptions in the 2025 instrument.

• Application provision

  • Section 20 provides a transitional rule: sections 16-19 (the APP 9 exceptions) apply in relation to a government related identifier assigned before, on or after the commencement date. That makes those particular rules applicable to identifiers already assigned prior to commencement.

• No other amendment entries listed

  • The instrument contains no other entries showing prior amendments, or a schedule of amendments to other instruments beyond the repeal in Schedule 1. The text says that each instrument specified in a Schedule is amended or repealed as set out; Schedule 1 contains only the repeal of the Privacy Regulation 2013.

What is not present

• The instrument does not include a detailed amendment history chart of prior subordinate instruments beyond the one repeal. It does not list a series of amendment dates or savings provisions for multiple prior rules except for the specific transitional rule in s 20.

Practical note for advisers

• Because the instrument repeals the 2013 regulations in full, advise clients to map any operational or documented reliance on the 2013 regulations to the new 2025 regulations to identify changes in prescription and scope. Section 20’s transitional rule only covers ss 16-19; other changes will apply from commencement and will not be treated as applying retrospectively by the instrument’s text.

The text of the instrument itself contains no references to litigation, case law, or judicial interpretation. It does not cite any decisions, and the Schedule does not record court outcomes. Based solely on the instrument provided:

• There is no litigation history recorded in the instrument.
• The instrument does not appear to be the product of a court-ordered change nor does it rely on any judicial construction in the text.

What this means for practitioners

• There is, in the instrument, no existing body of litigation to interpret the new prescriptions or to provide precedential guidance for how courts or tribunals will read the regulatory exceptions. Implementation and interpretation disputes,for example over the scope of “prescribed circumstance” under ss 16-19, or over the meaning of s 12’s repayment history rule,may therefore be matters for initial regulatory interpretation by the Office of the Australian Information Commissioner or for future litigation.
• Because the instrument makes specific prescriptive choices (naming organisations, defining repayment history mechanics, and setting consent conditions), disputes are likely to focus on applying those prescriptions to operational fact patterns rather than on broad statutory interpretation questions already resolved by case law.

In short, the instrument itself contains no litigation history. Practitioners should monitor administrative guidance from the relevant regulator and be alert to initial disputes that will clarify how the new prescriptions operate in practice.

The Regulations contain several specific drafting choices and interactions that can produce unintended practical consequences if overlooked. These are precise, source-grounded points to watch for.

1. Repayment history defined by month, not payment cycle (s 12)

• The instrument takes an individual as not having met a monthly payment obligation if they miss any or all repayments due in a month, “irrespective of the actual payment cycle for that obligation” (s 12). Where credit agreements use weekly or fortnightly cycles, missing one scheduled repayment in the month could potentially be treated as a missed monthly repayment for reporting purposes. Credit reporting practitioners need to align their operational definitions and reporting systems to this monthly construct; otherwise they risk mismatches between contractual cycles and reporting mechanics.

2. Conditional prescription for Regional Investment Corporation in permitted disclosures (s 14(2)(b))

• Section 14(2)(b) prescribes the Regional Investment Corporation as a credit provider for permitted disclosure only if it “is not a member of, or subject to, a recognised external dispute resolution scheme.” The wording is counter‑intuitive: membership in or subjection to an EDR scheme appears to alter prescription status. Entities and advisers should check whether the Regional Investment Corporation is a member/subject to such a scheme to understand if this prescription applies. The drafting gives rise to an operational binary that depends on EDR membership status.

3. Small business operators of residential tenancy databases are “organisations” (s 7)

• Section 7 prescribes small business operators who operate residential tenancy databases as organisations, and prescribes the specific acts that bring them within the Act (collecting, maintaining, using/disclosing personal information on the database) (s 7(2)). Small operators who previously considered themselves outside the Act must reassess obligations, privacy policies and complaint-handling mechanisms. The instrument does not provide transitional relief for such small businesses; the compliance burden may therefore be immediate at commencement.

4. Payroll number defined tightly but exceptions broaden in ss 16-17

• The definition of payroll number in s 5 requires a payroll number to be assigned by an agency, agent of an agency, or a contracted service provider for a Commonwealth contract acting for purposes of provision of services to an agency under that contract. Yet s 16(a) and s 17(a) prescribe payroll numbers in particular contexts (for example those assigned by Airservices Australia or generally) as government related identifiers and then permit adoption/use/disclosure by named superannuation organisations. Practitioners must map where payroll numbers are assigned and whether the assignment falls within the definition so that the APP 9 exceptions in ss 16-17 are properly triggered.

5. Consent requirement is explicit in Centrelink Confirmation eServices exceptions (ss 18(1)(c), 19(c))

• The permitted uses of Customer Reference Numbers and DVA identifiers in ss 18-19 are expressly conditioned on the use/disclosure being “with the individual’s consent.” That is an explicit gatekeeper. Ensure consent is documented and specific to the enquiry being made via the Centrelink Confirmation eServices scheme.

6. HomeStart Finance exemption from APP 11.2 (s 9(2))

• Section 9(2) modifies the Act as it applies to HomeStart Finance by excluding APP 11.2 in relation to HomeStart Finance. The instrument does not state what APP 11.2 requires. Practitioners must therefore check APP 11.2 in the Act to understand what duty is being removed. The regulation creates a legal asymmetry between HomeStart Finance and other organisations.

7. NT Home Ownership and contracted service providers carve-out (s 8(5))

• Section 8(5) prescribes a modification to subsection 7B(5) of the Act such that an organisation is not a contracted service provider for a State contract to which NT Home Ownership is party. This affects whether contracted service providers for State contracts are captured as organisations for the Act. The effect is to exclude such contracted service providers from being treated as organisations in relation to NT Home Ownership, but only insofar as the modified subsection applies. Practitioners contracting with NT Home Ownership must consider whether their service is a “State contract” and whether the contract role places them inside or outside the Act’s coverage.

8. Non-credit reporting business carve-out (s 11)

• Section 11 excludes businesses that provide personal information to a credit provider for identity verification or asset validation from being a credit reporting business. Entities that compile public or sourced information and provide it to credit providers may avoid classification as credit reporting businesses. However, this will depend on whether the class of businesses “compiles information . . . from sources, including publicly available sources,” and whether the information provided is only for the narrow purposes listed in s 11(2)(b). Misclassification risk exists if a business’s actual activities go beyond identity/asset validation.

9. Centrelink Confirmation eServices participant test and class breadth (s 18(1)(b), s 18(2))

• The classes of organisations able to use the Centrelink Confirmation eServices scheme include a broad range of providers, from health care, education, utilities, rail, trustee services, welfare services, social housing providers, legal aid, local government services, to financial services (s 18(2) table). That breadth may mean many private sector actors will be able to make entitlement enquiries using government identifiers subject to consent. Data controllers should carefully scope their participation and consent mechanisms.

10. Transitional scope for APP 9 exceptions (s 20)

• Section 20 confirms that ss 16-19 apply to government related identifiers assigned before, on or after commencement. Entities that rely on historical identifiers assigned prior to commencement cannot assume the exceptions apply only prospectively; the exceptions explicitly reach back to identifiers already assigned.

Practitioners should review contractual documentation, privacy policies, consent records and operational systems with these specific drafting features in mind. Several of the Regulations’ mechanics are conditional on fine-grained facts (who assigned an identifier, whether an entity participates in a named scheme, EDR membership, contract status), making careful fact-mapping essential before relying on any exception or classification.

This section sets out pragmatic steps organisations and advisers should take to align operations with the Regulations’ prescriptions. Each step links to the relevant regulation text.

1. Inventory identifiers and attribution (ss 5, 16-19, 20)

• Map all government related identifiers held or processed (Customer Reference Number, DVA file number, DVA unique identification number, payroll numbers).
• For payroll numbers, apply the regulation’s definition in s 5 to determine whether a payroll number is a government related identifier: it must be assigned by an agency, agent of an agency, or a contracted service provider for a Commonwealth contract acting for the purposes of providing services to an agency (s 5 payroll number definition).
• Where payroll numbers were assigned before commencement, note that ss 16-19 apply to identifiers assigned before, on or after commencement (s 20).

2. Update privacy policies and APP 9 responses (ss 16-19)

• For organisations prescribed in ss 16-19 (Australian Retirement Trust, AustralianSuper, AvSuper, participants in the Centrelink Confirmation eServices scheme), explicitly document the APP 9 exceptions relied upon. Specify the prescribed circumstance (for example, adoption of a payroll number for superannuation services under s 16(c) or using a Customer Reference Number to check entitlement under s 18(1)(c)).
• Where use/disclosure is conditioned on consent (ss 18(1)(c) and 19(c)), ensure consent mechanisms comply with the Act’s requirements for informed, voluntary consent and retain records of consent linked to each enquiry.

3. For small business residential tenancy database operators (s 7)

• Treat the business as an organisation under the Act from commencement. Implement privacy management programs, complaints handling, and privacy notices addressing collection, maintenance, use and disclosure of tenant personal information (s 7(2)). Ensure database access controls are reviewed and documented.

4. Credit reporting and repayment history (ss 6, 10-14)

• Reconfigure credit reporting systems to apply the monthly repayment test in s 12: missing any or all repayments due in a month means the individual is taken not to have met the monthly payment obligation. Ensure reporting cut-offs and algorithms reflect this rule.
• If you are Indigenous Business Australia, EFIC, the Regional Investment Corporation, or NT Home Ownership, map your status under s 10 and s 13 for credit provider rights. If your disclosures to credit reporting bodies are in connection with commercial credit, s 14 permits disclosure; document the legal basis for each disclosure.
• If your business compiles identity or asset validation information and provides it to credit providers, evaluate whether s 11 excludes you from being a credit reporting business. If you fall within the exclusion, document scope and limitations to avoid misclassification.

5. Centrelink Confirmation eServices participation and consent processes (ss 18-19)

• Organisations in the enumerated classes that participate in the scheme must ensure the interaction with Centrelink Confirmation eServices is covered by a lawful consent recorded for each individual enquiry (s 18(1)(c)). Consent must be demonstrable and stored.
• For superannuation product providers using Customer Reference Numbers to check early release entitlement on financial hardship grounds (s 19), integrate the service enquiry workflow with consent capture and retention.

6. State bodies and contracted service provider arrangements (ss 8-9)

• Where you are a contracted service provider to NT Home Ownership or a State instrumentality, evaluate whether you are excluded from being an organisation for the Act by s 8(5). Where HomeStart Finance is involved, note that APP 11.2 is stated not to apply to HomeStart Finance (s 9(2)); determine internal compliance responsibilities accordingly.
• For State entities newly prescribed as organisations (Essential Energy, Keystart, Office of the National Rail Safety Regulator), ensure privacy governance aligns with the Act’s obligations.

7. Data sharing agreements and third-party contractors

• Where adoption, use or disclosure of identifiers is permitted under these Regulations (for example payroll numbers for superannuation services), update data-sharing agreements to reference the precise statutory basis (cite ss 16-19). Include obligations on payroll contractors that process identifiers to maintain confidentiality and to comply with the Act’s APP obligations where applicable.

8. Training and operational controls

• Train staff on the new monthly repayment reporting rule (s 12), the limited APP 9 exceptions (ss 16-19), and the consent requirement in Centrelink Confirmation eServices. Ensure systems produce audit trails of consent and of identifier lookups.
• For residential tenancy databases, implement technical and organisational measures to secure the personal information collected, as the operator now qualifies as an organisation under s 7.

9. Regulatory interaction checking

• If you act across Commonwealth and State systems, map interactions between this instrument and State legislation cited in s 8(1)-(3), s 9 and the definitions. Confirm whether special modifications (for example exclusion of APP 11.2 for HomeStart Finance under s 9(2)) change your statutory duties.

10. Documentation and recordkeeping

• Keep written records of the legal basis for any adoption, use or disclosure of government related identifiers citing the relevant regulation provision.
• For each use of Centrelink Confirmation eServices, retain consent records tied to the specific enquiry, and document how the enquiry meets the prescribed circumstance in s 18 or s 19.

11. Risk and impact assessments

• Conduct Privacy Impact Assessments (PIAs) for changed practices, particularly for any new cross-agency lookups via Centrelink Confirmation eServices (ss 18-19) and for credit reporting changes (s 12). Document privacy risks and mitigation measures.

12. Monitor guidance and regulatory interpretation

• Because the instrument does not elaborate on enforcement mechanics, organisations should monitor guidance from the Office of the Australian Information Commissioner and Services Australia about implementing Centrelink Confirmation eServices integrations, and any further administrative guidance explaining how the new prescriptions should be operationalised.

These steps are practical and grounded in the instrument’s prescriptions. The essential compliance actions are to identify whether and how your organisation is captured by the new prescriptions, document legal bases for identifier processing under the specified sections, implement consent and audit systems where required, and align credit reporting and tenancy-database processes with the new definitions and classifications.