How Australian Lenders Protect Your Personal and Financial Information

Applying for a loan usually means sharing information you would not give to just anyone.

You may be asked for identification details, income information, bank statements, living expenses and information about your existing financial commitments.

It is reasonable to want to know what happens to those details after you provide them.

Australian lenders covered by privacy law must take reasonable steps to protect the personal information they hold from misuse, interference, loss, unauthorised access, modification and disclosure. They must also comply with rules governing how information is collected, used, shared, retained and corrected.

However, no organisation or online system can promise that a data breach will never occur. The technology and processes used to manage information can also differ between lenders.

In this guide, we explain the privacy requirements that may apply, some of the safeguards lenders can use and practical steps you can take to help protect your personal and financial information.

What Information Might a Lender Collect?

The information requested will depend on the lender, the type of credit you apply for and your circumstances.

When you apply for personal credit, you may be asked to provide information such as:

• Your full name, date of birth and contact details.
• Your current and previous residential addresses.
• Driver licence, passport or other identification information.
• Employment and income details.
• Bank statements or transaction information.
• Regular living expenses.
• Existing debts and repayment commitments.
• The amount and purpose of the loan.
• Information used or obtained through the credit-reporting system.
• Records of your communications about the application or account.

A lender may also collect technical information when you use its website, including information obtained through cookies and similar technologies.

In some circumstances, sensitive information may also be relevant.

For example, if you contact us about financial hardship, you may provide information relating to illness, unemployment, family violence or another circumstance affecting your ability to meet your repayments.

Our Hardship Privacy Policy states that we only collect sensitive information relevant to assessing and managing your request for a hardship variation.

Why Do Lenders Need Your Financial Information?

A legitimate lender should have a valid reason for requesting information from you.

Financial and personal information may be needed to:

• Confirm your identity.
• Assess your credit application.
• Understand your income and financial commitments.
• Consider whether repayments are likely to be affordable.
• Administer an approved credit contract.
• Prevent or investigate suspected fraud.
• Meet legal and regulatory obligations.
• Respond to complaints or hardship requests.

When you apply with us, our responsible lending obligations require us to make reasonable inquiries about your requirements, objectives and financial situation, take reasonable steps to verify your financial situation and assess whether the proposed credit contract would be unsuitable for you.

Meeting basic eligibility requirements does not guarantee that we will approve your application. We assess each application individually based on the information available to us and our responsible lending obligations.

You can read more about this process in our Credit Guide.

Australian Privacy Laws That Apply to Lenders

Several parts of Australia’s privacy framework can affect how lenders handle your information.

The Privacy Act and Australian Privacy Principles

The Privacy Act 1988 includes 13 Australian Privacy Principles, commonly called the APPs.

The APPs cover matters including how regulated organisations collect, manage, use, disclose and secure personal information, as well as how they provide access to and correct that information.

The OAIC’s current APP Guidelines were updated in May 2026.

Some particularly relevant principles include the following.

APP 3: Collection of Personal Information

APP 3 governs the collection of solicited personal information.

Broadly, a covered organisation should only collect personal information that is reasonably necessary for its functions or activities, subject to the requirements that apply to the organisation and the type of information involved.

For you, this means there should be a genuine purpose behind the information being requested.

APP 6: Use and Disclosure

Personal information generally cannot simply be used or disclosed for an unrelated purpose.

The Privacy Act sets rules around when information can be used or disclosed for another purpose, including circumstances involving consent or another permitted exception.

APP 11: Information Security

APP 11 requires an organisation covered by the principle to take reasonable steps in the circumstances to protect the personal information it holds.

Those protections must address:

• Misuse.
• Interference.
• Loss.
• Unauthorised access.
• Modification.
• Disclosure.

Reasonable steps can include both technical and organisational measures.

APP 12 and APP 13: Access and Correction

You can generally ask a covered organisation for access to the personal information it holds about you.

You can also request correction when information is inaccurate, out of date, incomplete, irrelevant or misleading, although limited exceptions and procedural requirements can apply.

Credit-Reporting Privacy Rules

Consumer credit information is also subject to additional rules under Part IIIA of the Privacy Act and the Privacy (Credit Reporting) Code 2025.

The current Credit Reporting Code took effect on 25 March 2025. It is a mandatory code applying to covered credit providers and credit reporting bodies, and a breach of the code is treated as a breach of the Privacy Act.

These rules address matters including:

• The types of credit information that can be collected and disclosed.
• Permitted uses of credit-reporting information.
• Repayment history and default information.
• Financial hardship information.
• Access to and correction of credit information.
• Complaints about credit reporting.

A lender’s privacy policy should explain how it participates in the credit-reporting system and identify relevant credit reporting bodies when required.

How Lenders May Protect Your Information in Practice

Australian privacy law does not prescribe one identical security system that every lender must use.

What constitutes reasonable security can depend on factors such as:

• The organisation’s circumstances.
• The nature and sensitivity of the information.
• The potential harm associated with a breach.
• The systems through which information is handled.

The OAIC recommends considering a combination of technical and organisational security measures.

Common safeguards can include:

A strong privacy approach usually relies on multiple safeguards rather than one security measure alone.

How Third-Party Providers May Be Managed

Lenders can use other organisations for services such as:

• Identity verification.
• Credit reporting.
• Payment processing.
• Technology.
• Document management.
• Customer support.

Using an external service provider does not automatically remove an organisation’s privacy responsibilities.

Depending on the arrangement, controls may include:

• Reviewing a provider’s privacy and security practices.
• Restricting the information the provider can access.
• Limiting permitted uses of that information.
• Using confidentiality and data-protection requirements.
• Establishing processes for reporting security incidents.
• Reviewing provider performance.
• Requiring appropriate handling or deletion of information when services end.

Our Privacy Policy states that when we disclose personal information to a supplier for a necessary business purpose, we do so in accordance with Australian privacy law and obtain assurances from those suppliers about their compliance with Australian privacy law.

What Happens to Information Held by Credit Reporting Bodies?

Credit reporting bodies collect permitted information about consumer credit activity and use it to produce credit-reporting information, such as credit reports.

Depending on the circumstances and applicable law, this can include information about matters such as:

• Credit applications.
• Credit accounts.
• Repayment history.
• Overdue payments and defaults.
• Financial hardship arrangements.
• Certain court judgments.
• Personal insolvency information.
• Serious credit infringements.

Credit providers and credit reporting bodies cannot use credit information for any purpose they choose.

Part IIIA of the Privacy Act, the Privacy Regulation 2013 and the Privacy (Credit Reporting) Code 2025 regulate how consumer credit-reporting information can be handled.

Our Privacy Policy explains that we may collect credit information directly from you and through a credit reporting body.

It also identifies Equifax Pty Ltd as the credit reporting body to which we may disclose permitted credit information. We may use credit information for purposes including assessing your application, managing your credit contract and participating in the credit-reporting system.

You can also contact a credit reporting body directly to request access to your credit information and seek correction when you believe information is wrong.

How Long Can a Lender Keep Your Information?

A lender may not always be able to delete every piece of information immediately when you request it.

Some records may still be required to:

• Administer an account.
• Investigate a complaint.
• Satisfy record-keeping obligations.
• Comply with Australian law.
• Comply with a court or tribunal order.

APP 11 generally requires an organisation to take reasonable steps to destroy or de-identify personal information when it is no longer needed for a permitted purpose, unless an exception applies.

An exception can include circumstances in which an Australian law or court or tribunal order requires the information to be retained.

This means you do not have an unrestricted right to demand the immediate deletion of every record.

You can, however, ask why particular information is being retained and seek information about how it is handled.

What Happens After a Serious Data Breach?

A data breach can involve personal information being lost, accessed without authorisation or disclosed to someone who should not receive it.

Under Australia’s Notifiable Data Breaches scheme, organisations covered by the scheme must notify affected individuals and the OAIC when there are reasonable grounds to believe an eligible data breach has occurred.

Broadly, this includes a breach that is likely to result in serious harm and when remedial action has not removed that likely risk.

A notification should explain important information such as:

• The organisation involved.
• What happened.
• The types of personal information involved.
• Recommended steps you can take in response.

Not every security incident meets the threshold for mandatory notification.

The OAIC’s June 2026 guidance recommends that organisations:

1. Contain a suspected breach.
2. Assess the risks.
3. Notify affected individuals and the OAIC when required.
4. Review the incident to help prevent future breaches.

How We Protect Personal Information at Sunshine Loans

Protecting the information you provide to us is an important part of how we manage your application and account.

Our published Privacy Policy states that we take reasonable steps to secure personal information, including:

• Maintaining secure environments for electronic and hard-copy information.
• Restricting access to authorised personnel.
• Using technologies such as encryption and password protection for information kept electronically.

Our Privacy Policy also states that all personal information we receive remains in Australia.

You can request access to personal, sensitive or credit information we hold about you and ask us to correct information you believe is incorrect.

Our policy also explains how to contact our Privacy Officer and which complaint options are available if you are not satisfied with how we have handled a privacy matter.

You can review our Privacy Policy before providing information to learn more about how we collect, hold, use and disclose personal, sensitive and credit information.

Sunshine Loans Pty Ltd holds Australian Credit Licence number 390556.

Steps You Can Take to Protect Your Information

Lenders have responsibilities for the information they hold, but there are also practical precautions you can take when applying for credit or managing an account online.

Check That the Lender Is Legitimate

Before providing identification documents or banking information, check who you are dealing with.

ASIC’s Professional Registers allow you to search for credit licensees and credit representatives using information including a company name or licence number.

This is particularly important because scammers can impersonate legitimate Australian financial businesses.

In March 2026, Scamwatch warned about personal loan scams involving fraudulent websites, social media advertisements and scammers impersonating legitimate licence holders to obtain money or personal information.

Start From the Lender’s Official Website

Be cautious about applying through links in unexpected emails, text messages or social media messages.

Scammers can copy logos, names and other branding to make a website or communication appear legitimate.

Scamwatch recommends independently checking who you are dealing with rather than automatically trusting a link sent to you.

Read the Privacy Policy

Before submitting an application, consider checking:

• What information will be collected.
• Why that information is needed.
• Who it may be shared with.
• Whether information may be disclosed overseas.
• Which credit reporting bodies may be involved.
• How you can request access or correction.
• How you can make a privacy complaint.

For applications made with us, you can find this information in our Privacy Policy.

Protect Your Accounts

Use a strong, unique password for important financial and email accounts.

When multi-factor authentication is available, using it can add another layer of protection.

Do not provide passwords or one-time verification codes simply because someone contacts you claiming to represent a legitimate organisation.

You should also keep your phone, browser and operating system updated and take care when accessing financial accounts through unfamiliar devices or networks.

Question Unexpected Contact

A convincing phone call, email or text message may still be fraudulent.

Do not assume someone is genuine simply because they know your name, the name of a financial institution or other information about you.

When you are unsure, end the interaction and contact the organisation using details you have independently obtained from its official website.

What Should You Do if Your Information May Be Compromised?

Act promptly if you believe your personal or financial information has been stolen, exposed or supplied to a scammer.

Depending on what information is involved, you may need to:

• Contact the relevant lender using its official support channel.
• Change passwords for affected accounts and any other account where you reused the same password.
• Contact your bank or card provider if banking information or money may be at risk.
• Review your accounts and credit information for unfamiliar activity.
• Ask the organisation what information was affected and which protective measures it recommends.
• Contact IDCARE for identity and cyber-support assistance.
• Report suspected scams to Scamwatch.
• Consider asking a credit reporting body about a temporary credit-report ban if you believe you are at risk of identity fraud.

Scamwatch’s current guidance tells people who have provided money or personal information to a scammer to act quickly, contact their bank or card provider, change compromised passwords, monitor their accounts and seek assistance from IDCARE when appropriate.

Frequently Asked Questions

Are Online Loan Applications Safe?

A legitimate lender should have technical and organisational measures designed to protect information submitted through an online application, but no digital service can guarantee that a security incident will never occur.

Before entering personal or financial information, check that you are using the organisation’s official website and review its privacy policy.

When you apply with us, our Privacy Policy explains the measures we use to help secure the personal information we hold, including restricted access, encryption and password protection for electronic information.

Can a Lender Share My Personal Information?

A lender may be permitted or required to disclose personal information in particular circumstances.

The Privacy Act and other applicable laws place limits on when and why information can be used or disclosed.

Depending on your circumstances, disclosures can involve:

• Service providers.
• Identity-verification services.
• Regulators.
• Credit reporting bodies.

The lender’s privacy policy should explain the types of disclosures relevant to its activities.

Can I Ask a Lender to Delete My Information?

Yes, you can ask, but immediate deletion may not always be possible.

Information may still need to be retained for purposes such as managing an active account, addressing a complaint or complying with a legal obligation.

When information is no longer needed for a permitted purpose and no relevant exception applies, APP 11 generally requires reasonable steps to destroy or de-identify it.

Can I See What Information a Lender Holds About Me?

You can generally request access to personal information a covered organisation holds about you.

The organisation may need to confirm your identity before providing access, and limited exceptions can apply.

You can request access to personal, sensitive and credit information we hold about you using the process described in our Privacy Policy.

What Can I Do if My Credit Information Is Wrong?

You can contact the relevant credit provider or credit reporting body and request correction.

Explain which information you believe is incorrect and provide supporting information when available.

Our Privacy Policy explains how you can request correction of credit information we hold about you.

Where Can I Make a Privacy Complaint?

It is generally sensible to start by contacting the organisation’s privacy or complaints team and giving it an opportunity to investigate.

Depending on the issue and the organisation involved, unresolved privacy or financial-services complaints may potentially be referred to bodies such as the OAIC or the Australian Financial Complaints Authority.

If your complaint concerns information we hold, our Privacy Policy explains our internal process and the available external complaint options.

Understand How Your Information Will Be Handled

Before applying for credit, take some time to understand what information you will be asked to provide, why it is needed and how it may be handled.

You can review our Privacy Policy for information about how we collect, use, disclose and protect personal, credit and sensitive information.

You can also read our Credit Guide to understand our responsible lending process and dispute resolution information.

For questions about information we hold or an existing account, you can contact our Customer Support team through our official website.

Taking the time to understand these protections can help you make a more informed decision before sharing personal or financial information online.

The information provided in this blog is for general informational purposes only and does not constitute financial, legal or privacy advice. It is not tailored to the specific circumstances of any individual. Before acting on the information, you should consider whether it is appropriate for you, having regard to your objectives, financial situation and needs.