What is data protection?

A single finance application carries a lot of personal information: name, date of birth, address, email and phone; bank account details, payslips, tax returns, liabilities and credit history; employer, role and tenure; and copies of driver licences, passports and utility bills. Some of it is sensitive in the legal sense, and all of it is valuable to a fraudster.

That is why the Privacy Act treats the lending process as high-stakes. Loss or unauthorised access can lead to identity fraud and financial loss for the customer, regulatory action against the business, and reputational damage that ends referral relationships. Every broker, credit licensee and lender that collects this material is responsible for it from the moment it arrives until it is securely destroyed.

The Australian Privacy Principles set the rules. Collection: gather information only for a lawful lending purpose, tell customers what you collect and why, and collect no more than you need. Use and disclosure: use it only for the lending purpose or something directly related, such as passing it to a lender, an aggregator or a valuer, and use it for direct marketing only within the limits of APP 7, which generally means the customer would reasonably expect it and can opt out easily.

Security: protect it from misuse, interference, loss and unauthorised access or disclosure, meaning encryption, secure storage, access controls and careful handling. Retention and destruction: keep it only as long as needed, then destroy or de-identify it securely rather than holding payslips indefinitely. Access: give customers their information on request. And publish a clear privacy policy explaining all of this.

The failures are predictable. Payslips and bank statements sent as plain email attachments. Customer files sitting on a personal laptop, phone or USB stick without encryption. No retention schedule, so documents pile up for years. Vague consent, so customers do not realise their information goes to lenders and credit bureaus. Every staff member able to open every file, often through a single shared login.

The fixes are just as concrete. Send documents through password-protected transfer, secure cloud folders with access controls or encrypted email, with expiry dates where possible. Encrypt local drives and backups and use a password manager. Give each person their own login, restrict access by role and log who opens sensitive documents. Write down how long you keep each document type and actually run the destruction, using secure deletion or shredding. Put a privacy collection notice in your engagement letter and get consent before sharing outside the lending process.

If personal information is accessed or disclosed without authorisation and that is likely to result in serious harm, it is an eligible data breach and you must notify the OAIC and the affected people as soon as practicable. The sequence is: contain the breach and stop further exposure, assess whether it is eligible and document the reasoning, notify with a description of what happened, what data was involved, the likely impact and what customers can do, then keep a record of the decision.

The Office of the Australian Information Commissioner investigates complaints and notified breaches, can order remedial action, apologies or compensation, and can seek civil penalties in court for serious breaches. Slow or inadequate notification makes all of that worse. Good records of your privacy decisions are your best protection if the OAIC asks questions.