Can I see the same credit report the lender sees?

You can access the credit reporting information a bureau holds about you, usually without a fee for a reasonable request. That access file is not always formatted identically to a lender’s paid report, and the three bureaus do not hold identical data. Pull all three if the decision matters. General information only.

How long does a ban period last?

An initial ban is short — commonly twenty-one days — and can be extended if you have reasonable grounds to believe you have been, or are likely to be, a victim of fraud. During a ban the bureau generally must not disclose your credit reporting information. Confirm the current Privacy Act wording when you make the request; do not rely on a forum post.

If a bureau will not correct a default, where do I go?

Ask the credit provider and the bureau, in writing, with the evidence. If they refuse, you can complain to the bureau’s IDR and then to AFCA where the firm is a member, and you can take a privacy complaint to the OAIC. Correction is a legal right, not a paid “repair” service.

Privacy and credit-reporting rights — Credit Made Simple

A credit report in Australia is not a score, and it is not a rumour. It is a set of categories of information that Equifax, Experian and illion are allowed to hold and disclose under Part IIIA of the Privacy Act 1988 (Cth) and the registered Credit Reporting Code. The Act sets what can be stored, for how long, and who may see it. The Code fills in how a default is listed, how hardship information is flagged, and how a correction is handled. The Office of the Australian Information Commissioner is the privacy regulator. ASIC does not run this system. AFCA can hear some disputes that sit with a licensed credit provider. The OAIC is the door when the problem is the bureau, or the Act itself.

Scores are a product the bureaus build on top of the file, with different models and ranges. That is how Australian credit scores work. A privacy right attaches to the information, not to a lender’s favourite three-digit output.

This is general information. It is not a promise that any particular listing is unlawful, or that any particular correction will be made.

The file, not the marketing number

Comprehensive credit reporting, which Australia moved into over the last decade, means the file is no longer only a list of defaults and enquiries. Repayment history information, open account data, and financial hardship information can sit alongside the older negative items. A missed repayment that is more than fourteen days late can appear as repayment history. A default is a narrower, heavier item: generally an amount overdue for at least sixty days, at or above a minimum threshold, after two prescribed notices. Hardship information, since 1 July 2022, can appear for twelve months. Personal insolvency information has its own, longer, retention rules.

The OAIC publishes a table of retention periods. The useful rows, in outline, are these. Repayment history: two years. Financial hardship information: one year. Enquiries: five years. Defaults: five years. Court judgments: five years. Current consumer credit obligations: two years after the credit ends. Serious credit infringements: seven years. Bankruptcy and debt agreements: the later of five years from the start or two years from the end, with a specific rule where a debt agreement is completed by being paid out. Those are statutory periods, not bureau goodwill. When they expire, the information should go.

The three bureaus do not share one database. A default listed with one may not appear, or may appear later, with another. Lenders do not all subscribe to the same body. If you are preparing a complaint or a correction, read the actual reports from all three. A single free score app is not the file.

Access

You have a right to access the credit reporting information a bureau holds about you. In ordinary circumstances the bureau must give you access without charge if the request is reasonable. Paid “plus” reports with a score and monitoring are a commercial extra, not the statutory right. Use the bureau’s access channel and keep the PDF. If you need it, ask for the information disclosed to a particular lender on a particular date — that is how you test whether the version you see now is the version they saw then.

Identity checks are not optional. If access is refused, ask for the refusal in writing. The OAIC can deal with access complaints. So, in some cases, can AFCA if a licensee is the one blocking information it used.

Correction

Correction is the right people pay “credit repair” firms to exercise for them. The Act already gives it to you. If information is inaccurate, out of date, incomplete, irrelevant or misleading, having regard to the purpose of the disclosure, you can require the bureau or the credit provider to correct it. They have to consult each other when the information came from a provider. They have to deal with the request in a statutory timeframe — thirty days is the figure most published guides use, subject to extensions if they need to consult and tell you so.

Evidence wins these requests. A statement showing the amount was paid before the listing date. A notice sent to an address that was not your last known address because the provider ignored an update. A default listed while a hardship request was on foot, contrary to the Credit Reporting Code. A bankruptcy that should have dropped off under section 20X. Attach the documents. Name the item. “My score is unfair” is not a correction request.

If they agree, they must correct the information and, in the usual case, notify recent recipients. If they refuse, they must tell you why and how to complain. That refusal letter is the start of an OAIC complaint, not the end of the matter.

Some listings are accurate and still painful. An old default you did, in fact, incur is not an error because you have since paid it. Payment should update the status. It does not rewind the five years. Firms that promise to “remove negatives” without distinguishing error from history are the subject of credit-repair companies in Australia. Paying them to send the letter you can send is optional. It is not a legal step.

Fixing errors on your credit file walks the practical sequence. This page is the statutory backbone of that sequence.

Ban periods

If you reasonably believe you have been, or are likely to be, a victim of fraud — including identity theft — you can require a credit reporting body to place a ban on your file. During the ban the body generally must not disclose your credit reporting information, which means new credit that relies on a bureau check should stall. That is the point. It is an inconvenience when you are also trying to open a legitimate account. It is a protection when someone else is trying to.

The initial ban is short. The Privacy Act’s consumer-facing explanations treat twenty-one days as the ordinary first period. You can extend it if the grounds remain. You can end it. Make the request with each bureau you care about; a ban at one does not automatically bind the others.

A ban is not a correction and it is not a hardship flag. It does not delete accurate history. It suppresses disclosure while the fraud is dealt with. If a fraudulent account has already been opened, you will still need to dispute that account with the provider, the bureau and, if needed, the police report the provider will ask for. The ban stops the next one.

Direct marketing, pre-screening and the quieter uses of the file

Australian Privacy Principle 7 limits how personal information is used for direct marketing. Part IIIA adds credit-specific rules. Credit reporting information is not a general marketing list. There is a regulated practice, often called pre-screening, in which a credit provider uses limited credit reporting information to exclude people from a direct-marketing offer — for example, not sending a card offer to people who already look like a default risk. You can opt out of that use. The bureaus publish the channel. Use it if you are tired of the offers. It will not stop every piece of lender marketing on earth; it will stop the use of credit reporting information for that purpose.

A credit provider that holds your information as a customer is in a different position from a bureau. Their marketing is mostly an APP 7 problem, plus the Spam Act and the Do Not Call Register. If a provider keeps writing after a clear opt-out, that is a complaint. Marketing mail and enforcement mail share a letterbox. They do not share a legal category.

The OAIC, and the other doors

The Office of the Australian Information Commissioner administers the Privacy Act, including Part IIIA, and registers the Credit Reporting Code. You complain to the OAIC after you have complained to the entity that holds the information, except in the situations the OAIC says it will take earlier. Provide the request, the refusal, and the evidence. The OAIC can make determinations. It is not fast. It is the regulator.

AFCA is often the better first external door when the respondent is a licensed credit provider and the dispute is “they listed a default they were not entitled to list” or “they will not correct their own contribution to the file.” Complaints, IDR and AFCA is that process. You can run AFCA and then the OAIC if you need the privacy regulator as well. You should not assume they will merge the files for you.

ASIC becomes relevant when the credit provider’s conduct is also a credit-licensing problem — collections that go beyond the guidance, a credit-assistance business that is unlicensed, a SACC that ignored the cap. Privacy and credit law overlap. They are not the same complaint.

If the listing is accurate because the account is in hardship rather than in error, the useful tools are a hardship variation and a counsellor on 1800 007 007, not a privacy form. The Code already restricts default listing while a genuine hardship request is being decided. Use that rule. Do not invent a correction that the statements will contradict.

Rights that only work on paper you keep

Access, correction, ban and opt-out operate when you can show what you asked for and what was said in reply. Download the reports. Send correction requests to an address that generates a record. If a provider says they have notified the bureau, ask the bureau whether the item actually moved.

What hurts a score is a separate literature. The legal one is shorter. The bureaus may hold listed categories for listed periods; they must give you access, correct what is wrong, honour a fraud ban, and not treat the file as a general marketing list. The OAIC is the agency that sentence points to. Equifax, Experian and illion are the companies that have to obey it. A paid repair firm is optional. A counsellor is free. A correction request in your own name is the right the Act already wrote down.