D.1 · When it applies
When the notice is owed
Section 21P of the Privacy Act applies when three things are true together.
- A credit provider refuses an application for consumer credit made in Australia, by you alone or by you jointly with others.
- The refusal rests wholly or partly on credit eligibility information about you, about someone proposing to guarantee the credit, or, for a joint application, about another applicant.
- A credit reporting body gave the provider the relevant credit reporting information so it could assess the application.
The credit reporting code asks more of the notice where the provider refuses within 90 days of getting the information from the body: the rows marked as code paragraphs in the table below. A refusal after those 90 days still owes the notice section 21P requires.
D.2 · What it says
What the notice must contain
| The notice must | Where the rule is |
|---|---|
| Say the application has been refused | Privacy Act s 21P(2)(a) |
| Say the refusal rests wholly or partly on credit eligibility information about at least one of the people involved | s 21P(2)(b) |
| If the information is about you, give the name and contact details of the body that supplied it | s 21P(2)(c) |
| Explain your right to get your credit reporting information free during the 90 days after the notice, and how to ask the body for it | Code para 16(6)(b) |
| Say it is important to be proactive in checking the accuracy of what credit reporting bodies hold about you | Code para 16(6)(c) |
| Say the lender relies on several sources, including what you told it and what one or more bodies disclosed | Code para 16(6)(d) |
| Describe factors often weighed when credit is refused | Code para 16(6)(e) |
| Refer to the lender’s own processes for access, correction and complaints | Code para 16(6)(f) |
The factors the code gives as examples are the adequacy of income and other resources to meet repayments, the extent of debts and other commitments, how secure the applicant’s employment is, and credit history, which can include past bankruptcy, defaults, serious credit infringements, a high number of credit applications and unsatisfactory repayment history.
D.3 · The clock
The dates, worked through
The code sets the notice’s timing: at the time the lender tells you of the refusal, or within 10 business days of that date. A credit reporting body must not charge for access if you give it evidence that a credit provider refused your consumer credit application not more than 90 days before, even if you already had a free copy in the past 3 months.
Example only · made-up dates
A lender declines an application on Monday 7 December 2026 and tells the applicant by email that day, without the written notice. Every date below is counted from that day.
- The written notice is due by Monday 21 December 2026, 10 business days later (counting weekdays only, with no public holiday in between).
- The applicant asks the named body for a copy. It must respond within a reasonable period, and no later than 10 days after the request.
- Day 90 after the refusal falls on Sunday 7 March 2027. A request backed by evidence of the refusal up to then is free.
Two 90-day counts are at work here. Paragraph 19(4) binds the credit reporting body for 90 days from the refusal itself; the 90 days in paragraph 16(6)(b), which the notice must explain, run from the date of the notice. When the notice comes after the refusal, as here, the body’s duty under 19(4) can end before the 16(6)(b) window does.
D.4 · Joint and guarantors
Joint applications and guarantors
Section 21P is written from each individual applicant’s side. On a joint application, the refusal can rest on information about you, about another applicant, or about a proposed guarantor, and the notice must say it rests on credit eligibility information about one or more of them.
The body’s name and contact details are part of the notice only where the information is about you. So two joint applicants can receive notices that differ in that one line.
D.5 · The lender’s copy
Asking the lender what it holds
What the body sent and what the lender derived from it is credit eligibility information. A credit provider holding it must give you access on request, within a reasonable period. The code says it should do so within 30 days unless unusual circumstances apply, explain the information clearly with reasonable summaries, and tell you to ask the credit reporting bodies as well for the most up-to-date picture.
A provider that is an agency, in the Act’s sense, can’t charge. Any other provider’s charge for giving access must not be excessive, and it can’t charge you just for asking.
If something on the report looks wrong, the OAIC’s page on making a credit reporting complaint sets out the order: the credit provider or body first, which must acknowledge the complaint within 7 days, then a recognised dispute resolution scheme, then the OAIC.