Digital Footprint Basics for Australians: What's Public and What Isn't

Australians often assume their privacy protections work like the EU's — strict, broad, and automatic. The reality sits somewhere in between. The Privacy Act 1988 covers how organisations handle personal information, but it doesn't make everything private by default, and several categories of data are public by design.

What's public by default

• ABN and business registrations. If you run a business or work as a sole trader, your ABN details are searchable through the Australian Business Register.
• Court and bankruptcy records. These are public record in most cases and regularly appear in broader search results.
• Some electoral roll data. Limited extracts of the electoral roll can be accessed for specific approved purposes, though general public browsing isn't permitted.

None of this is a leak or a breach — it's information that's structurally public. The issue is that it combines easily with other exposed data, like an old breached email or phone number, to build a fuller picture than any single source intended.

What the Privacy Act actually covers

The Act applies to most businesses with turnover above a set threshold, along with government agencies and health service providers. It gives you rights to access what an organisation holds about you, request correction of inaccurate data, and complain to the Office of the Australian Information Commissioner if an organisation mishandles your information.

What it doesn't do is retroactively remove things that are already public record, or apply to smaller businesses below the turnover threshold — a real gap compared to GDPR's broader private-sector reach, which we cover in what GDPR lets you request.

What you can practically do

• Request access to your data from any covered organisation and check it's accurate
• Complain to the OAIC if a company won't correct or explain its data handling
• Check what's already exposed independently, since public records and old breaches sit outside what any single opt-out request can clean up

If you're planning travel or working abroad, it's worth knowing what's genuinely private versus what a VPN can and can't hide — see VPN myths for international travelers. And for a full picture of what's currently tied to your phone number and email, a Scan My Shadow report checks 1,500+ sources directly, which gives you a clearer starting point than a general digital footprint check alone.

Curious what's already out there about you? Scan My Shadow checks your phone number and email across 1,500+ sources and sends you a clear report — no guesswork, just facts. Start your scan.