Who must comply with credit reporting obligations (Part IIIA Privacy Act)?

Credit providers and CRBs must adhere to the CR Code on collection, use, disclosure, hardship and dispute resolution.

Part IIIA of the Privacy Act and the Privacy (Credit Reporting) Code 2014 govern handling of consumer credit information. Credit providers must give s 21D notices, observe permitted disclosures, treat repayment history information correctly, handle financial hardship requests under s 21D and the FHI regime (from 1 July 2022), and respond to corrections within statutory periods.

Applies when the business has credit reporting activity or credit activity.

How the regulator frames it: Credit providers, credit reporting bodies, mortgage insurers, and trade insurers within the regime.

What triggers it: Providing or receiving consumer credit information.

Jurisdiction: Commonwealth law, so the test is the same in every state and territory.

Outcome across the 35 industries Rules Mate maps (2 of 35: yes; 33 of 35: no).

Structure does not change the answer in the 2 industries it can reach: for every structure the answer is "yes".

Size does not change the answer in the 2 industries it can reach: at every size band the answer is "yes".

Each line is one run of the Rules Mate applicability engine for a single business profile, with the reason the engine gives:

• Pty Ltd company in banks & adis with 6–19 employees, turnover $1M–$3M: applies. Authorised deposit-taking institution.
• Pty Ltd company in real estate agents with 6–19 employees, turnover $1M–$3M: does not apply. Requires credit reporting activity or credit activity.

Starting from a small or large professional services company that does not otherwise meet the test, each of these single facts changes the engine's answer:

• The business holds an Australian credit licence (ACL): it then applies (ACL holder).
• The business provides credit to customers: it then applies (provides credit).

When due

Continuous; specific notification triggers per Part IIIA.

Frequency

Ongoing

Evidence to keep

CR Code compliance documentation, FHI procedures, notification templates, complaints register.

Status

Current

Priority

High

Maximum penalty: Same penalty regime as broader Privacy Act; CR Code breaches additionally enforceable.

Rules Mate has not yet classified the audit or assurance level for this obligation. Any audit, review or certification requirement is set by the regulator source listed below.

• APP 3 collection of sensitive information: APP 3 bars collecting sensitive information — health, race, religion, sexual orientation and more — without consent. What counts as sensitive, the exceptions and penalties.
• Automated decision-making transparency in your privacy policy (APP 1.7–1.9): From 10 December 2026, APP entities that use computer programs to make or substantially assist decisions that significantly affect individuals must say so in their APP privacy policy.
• Notifiable Data Breach (NDB) scheme: Under the NDB scheme, APP entities must notify the OAIC and affected individuals of an eligible data breach likely to cause serious harm — assessed within 30 days.
• APP 12 & APP 13 access and correction requests: Individuals can ask to access (APP 12) and correct (APP 13) the personal information you hold — the strict response times, allowable refusals and how to comply.
• APP 7 direct marketing: consent, opt-out & when you can't message (2026): APP 7 restricts using or disclosing personal information for direct marketing and requires a simple opt-out — when it applies, the exceptions and penalties.

Across the 1,890 business profiles Rules Mate evaluates, these obligations apply to most of the businesses this one applies to, and are far more common among them than among businesses generally:

• Consumer Credit Hardship Notice (NCC ss 72-73): applies to 100% of the same businesses (17.5× the overall rate)
• Display comparison rate on credit product advertising: applies to 100% of the same businesses (17.5× the overall rate)
• Register security interests on the PPSR: applies to 100% of the same businesses (17.5× the overall rate)
• Comply with NCCP responsible lending obligations: applies to 100% of the same businesses (17.5× the overall rate)
• Respond to hardship notices within statutory timeframe: applies to 100% of the same businesses (17.5× the overall rate)
• Banking Code of Practice 2025: applies to 50% of the same businesses (17.5× the overall rate)

Rules Mate tracks 20 published obligations tagged "privacy", 3 of them rated critical. For a professional services Pty Ltd company with 6–19 employees operating in every state, 4 of those apply outright. This obligation is rated high priority, and is an ongoing duty.

Regulated by Office of the Australian Information Commissioner.

OAIC: Privacy and freedom of information regulator. Administers the Privacy Act 1988, the Notifiable Data Breaches scheme, and the Australian Privacy Principles.

• Office of the Australian Information Commissioner

Privacy Act 1988: Federal privacy Act.

• Privacy Act 1988

Free tools that help with this obligation:

• Privacy Act 2026 readiness
• NDB notification timer
• Marketing compliance check (Spam Act)