Section 20KPrivacy Act 1988 (Cth)

No use or disclosure of credit reporting information during a ban period

(1) If:

(a) a credit reporting body holds credit reporting information about an individual; and

(b) the individual believes on reasonable grounds that the individual has been, or is likely to be, a victim of fraud (including identity fraud); and

(c) the individual requests the body not to use or disclose the information under this Division;

then, despite any other provision of this Division, the body must not use or disclose the information during the ban period for the information.

Civil penalty: 2,000 penalty units.

(2) Subsection (1) does not apply if:

(a) the individual expressly consents, in writing, to the use or disclosure of the credit reporting information under this Division; or

(b) the use or disclosure of the credit reporting information is required by or under an Australian law or a court/tribunal order.

Ban period

(3) The ban period for credit reporting information about an individual is the period that:

(a) starts when the individual makes a request under paragraph (1)(c); and

(b) ends:

(i) 21 days after the day on which the request is made; or

(ii) if the period is extended under subsection (4)—on the day after the extended period ends.

(4) If:

(a) there is a ban period for credit reporting information about an individual that is held by a credit reporting body; and

(b) before the ban period ends, the individual requests the body to extend that period; and

(c) the body believes on reasonable grounds that the individual has been, or is likely to be, a victim of fraud (including identity fraud);

the body must:

(d) extend the ban period by such period as the body considers is reasonable in the circumstances; and

(e) give the individual written notification of the extension.

Civil penalty: 1,000 penalty units.

(5) A ban period for credit reporting information may be extended more than once under subsection (4).

No charge for request etc.

(6) If an individual makes a request under paragraph (1)(c) or (4)(b), a credit reporting body must not charge the individual for the making of the request or to give effect to the request.

Sourced from the Federal Register of Legislation at 17 May 2026. For the latest information on Australian Government law please go to https://www.legislation.gov.au. Verify the current text against the official source before relying on it.

Related sections

Research how courts apply s 20K

BriefBridge searches Australian caselaw by meaning — every answer cited to the paragraph.

Try BriefBridge free