You’ve made up your mind to apply for a loan. You’ve found a broker who seems switched on, the conversation is going well, and then they slide a stack of forms across the desk. Among them is a document with “Privacy Disclosure” or “Privacy Consent” across the top. It explains what they’re going to do with your information, asks for your signature, and signals that the actual work starts the moment you sign.
If your first instinct is to feel cautious, you’re not alone. In a country where data breaches make headlines almost monthly, signing a form that hands over your financial life feels heavy. But the privacy disclosure is one of the most consumer-friendly mechanisms in Australian finance. It’s a protection, not a trap. And no legitimate broker can move your application forward until you’ve reviewed and signed one.
This guide walks you through exactly what a privacy disclosure is, the Australian law that requires it, what you’re agreeing to, and what to do if a broker tries to skip it. Whether you’re applying for a personal loan, a business loan, a car loan, or a leisure asset loan, the same framework applies.
What a Privacy Disclosure Actually Is
A privacy disclosure is the written notice and consent document your broker must give you before they collect, use, or share your personal and credit information. It tells you who is collecting your data, why they’re collecting it, where they will send it, how they will store it, and how long they will keep it. By signing it, you’re giving your broker authority to act on your behalf and to share what they know about you with the lenders they think are the right fit.
In some businesses you’ll see the privacy disclosure bundled with related documents such as the Credit Guide and Credit Quote. In others, it’s a standalone form. Either way, the content has to cover the same regulated ground.
Think of it like this. You wouldn’t let a real estate agent show your house to buyers without first signing an agency agreement. A privacy disclosure is the loan version of that. Without it, the broker has no authority to do anything with your information, and any lender who received an application without proper consent could be exposed to regulatory action.
The Law Behind It: Privacy Act 1988 and NCCP Act
Two pieces of legislation make the privacy disclosure non-negotiable in Australia.
The first is the Privacy Act 1988, which sets out the Australian Privacy Principles (APPs). The APPs govern how personal information can be collected, used, disclosed, and stored. The Office of the Australian Information Commissioner (OAIC) regulates the Act and investigates breaches. Several APPs apply directly to the broking process, including APP 3 (collection), APP 5 (notification), APP 6 (use and disclosure), APP 7 (direct marketing), and APP 11 (security of information).
The second is the National Consumer Credit Protection Act 2009, the same Act that governs every aspect of how brokers and lenders operate. Under the NCCP Act, a broker providing credit assistance must give the consumer specific disclosures before acting. The privacy disclosure is part of that disclosure package, alongside the Credit Guide and the Credit Quote.
Together, the two Acts make it crystal clear: no signed privacy disclosure, no application. A broker who tries to bypass this isn’t being efficient. They’re cutting corners on the rules that protect you.
What You’re Consenting To When You Sign the Privacy Disclosure
This is the part most borrowers skim. Don’t. Knowing what’s actually in scope means you can ask sensible questions and spot anything that doesn’t look right.
Credit File Checks
You’re consenting to the broker pulling your credit report from one or more credit bureaus, typically Equifax, illion, or Experian. A credit check can leave a soft enquiry on your file at the quote stage and a hard enquiry once an application is formally submitted to a lender. Hard enquiries are visible to future lenders and can mildly affect your score for a short period, which is why responsible brokers don’t fire your application off to every lender on the panel.
Use of Comprehensive Credit Reporting Data
Since 2018, Australia has operated under Comprehensive Credit Reporting (CCR). That means your credit file now holds positive data such as on-time repayments, not just defaults and missed payments. By signing the privacy disclosure, you’re consenting to the broker accessing your CCR information and using it to assess what loans you’d be likely to qualify for. ASIC’s Moneysmart explains credit scores and credit reports in plain English if you want background.
Sharing With Selected Lenders
You’re authorising the broker to share your information with the lenders that fit your situation. A reputable broker doesn’t blast your file to every lender on their panel. They identify the lenders most likely to approve your scenario and submit only to those. Get A Loan works with a wide panel of Australian lenders, but a typical application is shared with one or two lenders, not all of them.
Bank Statement Access
Most modern brokers use a secure bank statement service to verify income and expenses. You’ll be asked to consent to this either as part of the privacy disclosure or via a linked secure portal. The service is read-only. Brokers and lenders can see your transaction history. They cannot move money in or out of your account.
Ongoing Communication
You’re consenting to contact about your application via phone, email, and SMS. You can opt out of broader marketing communication at any time, but you cannot opt out of communication directly related to your loan application without effectively withdrawing the application itself.
What Your Broker Cannot Do Without a Signed Privacy Disclosure
A signed privacy disclosure isn’t optional paperwork. Without it, a broker cannot legally:
- Pull your credit file from any bureau
- Submit an application or any of your information to a lender
- Verify your income through a bank statement service
- Discuss your specific financial situation with anyone outside the broker’s licensed business
- Provide an accurate quote based on your real circumstances
A broker who promises to “send your details over” before you’ve signed anything is either misunderstanding their obligations or ignoring them. Either way, that’s not the broker you want.
The Three Documents You Should Receive
The privacy disclosure is one of three documents a properly run broker provides upfront. Knowing what each one does helps you recognise whether the broker you’re dealing with is following the rules.
Credit Guide
This introduces the broker, identifies the ACL or Credit Representative number they operate under, explains who the broker can write loans with, sets out the fees the broker may charge or commissions they may receive, and tells you how to lodge a complaint. The Credit Guide is required under the NCCP Act and is one of the first things a broker should hand you.
Privacy Disclosure and Consent
The document this article is about. It deals specifically with how your information will be collected, used, shared, and stored, and gives the broker your written authority to act on it.
Credit Quote and Proposal Disclosure
Once the broker has reviewed your situation and identified suitable lenders, the Credit Quote sets out what specific products are being recommended, what fees will apply, and what commission the broker will receive if the loan settles. The Proposal Disclosure provides a clearer breakdown of why a particular product was recommended for you.
If you’re applying through Get A Loan for an unsecured personal loan, an unsecured business loan, or one of our car loan products, you’ll receive these documents as part of the standard onboarding process.
How Your Data Is Protected After You Sign
The Privacy Act doesn’t just regulate how data is collected. It also dictates how it must be stored and protected once collected. Under APP 11, every credit licensee must take reasonable steps to protect personal information from misuse, interference, loss, unauthorised access, modification, and disclosure.
In practical terms, that means encryption in transit (when your data is sent between systems) and at rest (when it’s sitting in a database). It means restricted internal access, so only staff who genuinely need to see your file can. It means data retention policies, so information isn’t kept forever once the application is closed.
You also have specific rights under the Act. Under APP 12 you can request a copy of the personal information held about you. Under APP 13 you can ask for corrections if anything is wrong. If you believe a broker or lender has mishandled your data, you can lodge a complaint with the OAIC at the Office of the Australian Information Commissioner.
When to Walk Away From a Broker
Most Australian brokers do this properly. A small minority don’t. Here are the warning signs.
- They don’t offer a privacy disclosure at all, or wave it off as “just a formality.”
- They ask for sensitive identity documents before you’ve signed anything.
- They can’t or won’t tell you which ACL or Credit Representative Number they operate under.
- They can’t or won’t tell you their AFCA member number.
- They refuse to put their fee structure in writing.
- They submit your application to multiple lenders simultaneously without explanation, leaving multiple hard enquiries on your file.
Any one of these is a yellow flag. Two or more together is a red flag, and you should consider taking your application elsewhere. The ASIC Moneysmart broker page has further consumer guidance you can use as a sanity check.
Quick Summary
- A privacy disclosure is your written consent for a broker to collect, use, and share your information.
- It’s required by the Privacy Act 1988 and reinforced by the NCCP Act 2009.
- Without it, a broker cannot legally check your credit file or submit an application on your behalf.
- You should also receive a Credit Guide and a Credit Quote during the same process.
- You retain the right to access, correct, or complain about your data at any time.
- Walk away from any broker who tries to skip or rush this step.
What If You’ve Already Signed and Regret It
If you’ve signed a privacy disclosure and changed your mind, you can withdraw your consent in writing at any time. Email the broker, request that they stop processing your information, and ask them to confirm in writing what has already been done and to whom anything was sent. Under the Privacy Act they must respond to a reasonable request to stop using your data for future purposes.
If you suspect your information has been misused, lodge a complaint with the broker’s IDR process first. If that doesn’t resolve it within 30 days, escalate to AFCA for finance-related complaints, or to the OAIC for pure privacy breaches. You can also reach out to the National Debt Helpline for free financial counselling if the broader loan situation is stressing you out. Our warning about borrowing page is also worth a read.
Final Thoughts
The privacy disclosure is one of those finance industry documents that looks like bureaucratic friction but is actually working hard on your behalf. It forces brokers to be specific about what they’re doing with your information, it gives you a paper trail you can reference if anything goes wrong, and it sets the boundary between a legitimate professional service and a cowboy operation.
When the next broker hands you a privacy disclosure, don’t sign without reading. Don’t read without asking questions. And don’t tolerate any broker who tries to talk you past it. Done well, the privacy disclosure is the first signal that the broker you’ve chosen knows what they’re doing. If you’re ready to start an application with a broker that follows the rules properly, you can apply through Get A Loan today.
Disclaimer
The information in this article is general in nature and does not take into account your objectives, financial situation or needs. It is not personal advice, tax advice, legal advice or a recommendation to apply for any product. Before acting on any information, you should consider whether it is appropriate for your circumstances and seek independent financial, legal and tax advice where appropriate.
Get A Loan Finance Pty Ltd is an Authorised Credit Representative (CRN 571713) of AFAS Group Pty Ltd (ACL 414426). We are a finance broker, not a lender. We work with a panel of lenders and finance providers. Product features, eligibility criteria and availability can change without notice.
