Protecting your personal information: a plain-English guide

The official tips for protecting your personal information centre on sharing less, asking why details are needed, securing accounts and devices, and knowing what to do after a data breach. Personal information is anything that identifies you or could reasonably be used to work out who you are. This guide explains how to protect your personal information in Australia: what the Office of the Australian Information Commissioner (OAIC) says counts as personal information, the common ways it gets exposed, what official sources say about limiting what you share, what to do after a data breach, how a credit ban works, and the privacy rights the OAIC describes.

Organisations hold a lot of information about all of us, and some exposure is outside anyone’s personal control. What’s left is reducing how much is out there, and knowing what to do when something goes wrong.

What counts as personal information

The OAIC defines personal information as “information or an opinion about an identified individual, or an individual who is reasonably identifiable”, whether the information is true or not, and whether it’s recorded or not.

The OAIC’s examples include “a person’s name, signature, home address, email address, telephone number, date of birth, medical records, bank account details and employment details”. It adds that “tagged photographs of a person posted on a social media site will usually constitute personal information.”

Some personal information is treated as more sensitive. The OAIC lists sensitive information as including information or opinions about racial or ethnic origin, political opinion, religious beliefs, sexual orientation or criminal record, and notes that health information is also sensitive information.

Why some details matter more than others

Not every detail carries the same risk. Your favourite footy team isn’t much use to a criminal on its own. Your date of birth, driver licence number, Medicare number or passport details are different, because they’re used to prove who you are. Combined with a name and address, they can be enough to open accounts or apply for credit in someone else’s name. Our guide to identity theft explains how that happens.

Small details add up, too. Scamwatch says scammers may use information from your posts to “guess your passwords or target you with other scams.”

Where personal information leaks

Personal information gets out in several common ways:

• Data breaches. An organisation holding your information is hacked, or makes a mistake. See data breaches explained.
• Human error. The OAIC’s notifiable data breaches report for July to December 2024 gives examples such as “sending a document containing personal information to the incorrect recipient”, “Sending an email to a group by including all recipient emails addresses in the ‘To’ field”, and “using a public rubbish bin to dispose of customer records instead of a secure document disposal bin”.
• Scams and phishing. ASD’s ACSC describes phishing as “when scammers trick you into giving away your personal details”.
• Oversharing online. Public profiles and posts can reveal birthdays, addresses, workplaces and family details.
• Documents and devices. Old letters, cards and devices thrown out without being cleared.
• Collection you didn’t think about. Forms, loyalty programs and apps that ask for more than they need.

How to limit what you share

The OAIC’s “Tips to protect your privacy” are a good practical checklist. In summary:

1. Know your rights. The OAIC says the Privacy Act sets out 13 Australian Privacy Principles that government agencies and larger organisations must follow.
2. Read privacy policies and collection notices. The OAIC says that if you can’t understand one, you can ask the organisation to explain it.
3. Ask why, how and who. The OAIC says: “Don’t give out your personal information unless you are comfortable with how it is going to be used.” It also notes that in many cases you can use a pseudonym or deal with an organisation anonymously.
4. Check your credit report. The OAIC describes checking that it’s accurate and up to date, and says you don’t need a credit repair agency to fix a mistake.
5. Protect yourself online. The OAIC describes avoiding unsecured Wi-Fi for banking and shopping, and using different strong passwords.
6. Secure your phone. The OAIC gives examples such as using a PIN to lock your device and only downloading apps from reputable sources.
7. Use security software. The OAIC mentions reputable anti-virus, anti-spyware and firewall software, kept up to date.
8. Be careful on social media. “Your digital footprint can be forever, so think before you share,” the OAIC says.
9. Don’t leave information lying around. The OAIC describes shredding documents, destroying expired cards, and wiping devices and removing SIM cards before getting rid of them.
10. Beware of scams. The OAIC says not to give out personal information “until you’re sure it’s legitimate and above board.”

Related guides: social media privacy settings, how to secure your online accounts and selling or recycling a device safely.

A fictional example

Nadia signs up for a café loyalty card at loyalty.example. The form asks for her name, email, date of birth, home address and driver licence number. She wonders why a coffee card needs her licence.

This is the OAIC’s “ask why, how and who” tip in practice. The café’s privacy policy should explain what it collects and why. Nadia leaves the licence field blank and asks the staff, who say only an email is needed for the card.

How to respond to a data breach notification

If an organisation tells you your information was in a data breach, the OAIC says “by acting quickly, you can reduce your chance of experiencing harm”, and describes keeping a record of any action you take. The OAIC’s steps depend on what was exposed:

• Contact details: change email passwords, turn on multi-factor authentication for email where possible, and take care with unexpected emails, messages and calls.
• Financial information: change online banking passwords, check statements and report purchases you didn’t make to your financial institution, and check your credit report for unauthorised loans or applications.
• Government identity documents: take steps to protect yourself from identity fraud.
• Tax file number: the OAIC says the ATO can monitor unusual activity on your TFN.
• If your physical safety is at risk: contact the police.

Our data breaches guide covers the Notifiable Data Breaches scheme and these steps in more detail.

How a credit ban works

A credit ban (the OAIC calls it a ban period) stops a credit reporting body from using or disclosing your credit report in a credit check, except in limited cases such as with your written consent.

Based on the OAIC’s guidance (checked October 2026):

1. Check eligibility. The OAIC says you can request one if you’ve “been or are likely to be the victim of fraud”, including identity fraud.
2. Apply to the credit reporting bodies. Each has an online form, linked from the OAIC’s page. The OAIC recommends applying to all three, or you can ask one to pass the request to the others, which it must do “as soon as reasonably practicable”.
3. Note the end date. “The ban period will last for 21 days after you first make the request,” the OAIC says.
4. Extend it if needed. The body must extend the ban if it believes you’ve been or are likely to be a victim of fraud, and there’s no limit on extensions.

The OAIC says requesting a ban, or an extension, is free. Our guide to identity theft explains how a ban fits into recovering from identity misuse.

Your privacy rights in Australia

The OAIC explains that the Privacy Act gives you the right to:

• know why your information is being collected, how it will be used and who it may be disclosed to
• choose not to identify yourself, or use a pseudonym, in certain circumstances
• ask for access to your personal information, including health information
• stop unwanted direct marketing
• ask for incorrect personal information to be corrected
• complain if you think a covered organisation or agency has mishandled your information.

On correction, the OAIC says organisations should respond “within a reasonable period”, which it considers to be 30 days, and that correcting your information is free. If a request is refused, the organisation must explain why in writing and tell you how to complain.

Who the Privacy Act covers

According to the OAIC, the Privacy Act generally covers Australian Government agencies, and says “organisations with an annual turnover more than $3 million have responsibilities under the Privacy Act”, subject to some exceptions. Some smaller businesses are covered too, such as private sector health service providers and businesses that sell or purchase personal information. The OAIC lists areas that generally aren’t covered, including state and territory government agencies (generally covered by state or territory law), individuals acting in a personal capacity, small business operators unless an exception applies, and employee records in some situations. Whether the Act applies in a particular case depends on the details, and the OAIC can explain.

Things to watch for

• Over-collection. Forms that ask for ID numbers or dates of birth when the service doesn’t seem to need them.
• Follow-up scams after a breach. The OAIC describes taking care with emails, messages and calls after contact details are exposed.
• Identity documents sent by email or photo. Copies are hard to get back once sent.
• Public profile details. Birthdays, pets’ names and old schools often match security questions.
• “Credit repair” offers. The OAIC says you don’t need a credit repair agency to fix a mistake on your credit report.

Common questions

How do I protect my personal information in Australia?

The OAIC’s tips centre on sharing less and asking questions first. The OAIC says: “Don’t give out your personal information unless you are comfortable with how it is going to be used.” Its tips also cover reading privacy policies, using different strong passwords, locking your phone with a PIN, checking your credit report, and shredding documents and wiping old devices. “Your digital footprint can be forever, so think before you share,” the OAIC says. See how to limit what you share.

What counts as personal information in Australia?

The OAIC defines it as “information or an opinion about an identified individual, or an individual who is reasonably identifiable”, whether it’s true or not. Its examples include a name, signature, home address, email address, phone number, date of birth, medical records and bank account details, and it says tagged photos on social media will usually count. Some categories, such as health information, are sensitive information. See what counts as personal information.

What do I do if my personal information has been leaked in a data breach?

The OAIC says “by acting quickly, you can reduce your chance of experiencing harm”, and its steps depend on what was exposed. They include changing email and banking passwords, turning on multi-factor authentication for email, checking statements and your credit report, and contacting police if your physical safety is at risk. IDCARE, on 1800 595 160, says it doesn’t charge individuals for its base support service. See how to respond to a data breach notification.

How do I put a ban on my credit file?

By applying to the credit reporting bodies, each of which has an online form linked from the OAIC’s page. The OAIC says you can request a ban if you’ve “been or are likely to be the victim of fraud”, including identity fraud. It says requesting a ban is free, that “The ban period will last for 21 days after you first make the request”, and that there’s no limit on extensions where fraud is likely. See how a credit ban works.

Can I ask a business what information it holds about me?

The OAIC says the Privacy Act gives you that right with the organisations and agencies it covers. The rights it lists include asking for access to your personal information, including health information, and asking for incorrect information to be corrected. The OAIC says organisations should respond to a correction request “within a reasonable period”, which it considers to be 30 days, and that correcting your information is free. See your privacy rights in Australia.

Does the Privacy Act apply to small businesses?

Generally not, according to the OAIC, unless an exception applies. The OAIC says “organisations with an annual turnover more than $3 million have responsibilities under the Privacy Act”, and that some smaller businesses are covered too, such as private sector health service providers and businesses that sell or purchase personal information. Whether the Act applies in a particular case depends on the details, and the OAIC can explain. See who the Privacy Act covers.

Where to get official help

• The OAIC for privacy rights, credit bans and privacy complaints: oaic.gov.au
• IDCARE, which describes itself as “the national identity and cyber support service”: 1800 595 160
• Scamwatch to report scams: scamwatch.gov.au/report-a-scam
• ASD’s ACSC for ReportCyber and the 24/7 hotline: 1300 CYBER1 (1300 292 371), as listed on its cybercrime help page
• Police if your physical safety is at risk; in an emergency, call 000