Creditcrest Privacy
Your Privacy Act duties as clocks and registers, ready for 10 December 2026.
Make data duties visible.
Access and correction requests, retention and breach assessments, on their clocks.
What you do here. See an example lender’s access and correction requests, retention and breach assessments, each on its clock.
Try it end to endTake the tour- You bring
- Requests, holdings and incidents
- You get
- Access and correction clocks, retention, breach assessments
- Holds the line
- The automated-decision disclosure APP 1 requires
Requests
| Request | By | Status | Why that day |
|---|---|---|---|
| Access to credit eligibility information, made 1 Sept 2026 | 30 Sept 2026 | open | Credit eligibility information: s 21T says a reasonable period, and the CR Code says within 30 days of the request unless unusual circumstances apply. Read the earlier way, that is by 30 Sept 2026. Any charge must not be excessive. |
| Correction of credit information, made 1 Sept 2026 | 30 Sept 2026 | open | Credit information: s 21V(2) gives the period of 30 days that starts on the day the request is made — 1 Sept 2026 is day 1 and 30 Sept 2026 is day 30. No charge may be made. |
Disposal schedule, as at 26 Sept 2026
2 record(s) are past their retention period and due to be destroyed or de-identified; 1 held; 1 cannot be scheduled. The periods are the lender’s; APP 11.2 applies only once information is no longer needed and no law requires it kept.
- A-1 (application): destroy — due 30 June 2026
- O-1 (otp-log): de-identify — due 30 July 2026
- L-1: held — a complaint at AFCA
- L-2: No closedOn, so no disposal day can be computed. It is kept, not guessed.
A suspected data breach
assessing Aware of grounds to suspect on 10 Sept 2026: the assessment should be finished by 10 Oct 2026. Whether serious harm is likely is the entity’s assessment, not this file’s.
Automated decisions
Not yet required: APPs 1.7–1.9 commence on 10 Dec 2026. Publishing this earlier is allowed.
We use computer programs that use personal information to make, or to help make, decisions that could reasonably be expected to significantly affect your rights or interests. The kinds of personal information those programs use: bank transaction data you share with us; the answers on your application. No decision of this kind is made solely by a computer program. Decisions where a computer program does something substantially and directly related to the decision, which a person then makes: whether an application is referred to an assessor.
For a program
See /v1/privacy.