-
On this page
The Office of the Australian Information Commissioner (OAIC) is reviewing the Privacy (Tax File Number) Rule 2015 (TFN Rule) to determine if it is fit for purpose. The TFN Rule is due to sunset on 1 April 2027.
The OAIC is seeking submissions from interested individuals, organisations and government agencies on remaking the TFN Rule as guided by the consultation questions set out below.
The closing date for submissions is 5pm AEDT 2 December 2026.
Background
The Information Commissioner must, by legislative instrument, issue rules concerning the collection, storage, use and security of tax file number information under s17 of Privacy Act 1988 (Privacy Act).[1]
The primary purpose of the TFN Rule is to regulate the collection, storage, use, disclosure, security and disposal of individuals’ Tax File Number (TFN) information. The TFN Rule limits handling to only those circumstances permitted under taxation, personal assistance or superannuation law. A breach of the TFN Rule is an interference with privacy under the Privacy Act. Individuals who consider that their TFN information has been mishandled may make a complaint to the Privacy Commissioner.
TFNs are unique identifiers which increases the risk of serious breaches of personal privacy if data is lost or misused. The obligations in the TFN Rule are additional to the secrecy provisions in the Taxation Administration Act 1953 (Cth) and obligations under the Privacy Act. To the extent of any inconsistency, the Taxation Administration Act would prevail.
The TFN Rule protects the TFN information of individuals only. The TFN Rule is not intended to protect TFN information relating to other entities, such as corporate entities, partnerships, superannuation funds and trusts.
Proposed approach
Subject to consultation feedback, the OAIC proposes that the TFN Rule be re-made on substantially the same terms to the current TFN Rule, with necessary updates to dates and other similar references.
Consultation questions
To assist you in preparing comments for this consultation, we have suggested some questions which are intended to stimulate comments and reflections on the TFN Rule. You may wish to prepare your comments in consideration of these questions generally or by responding to some or all of the questions directly. You can also provide any other feedback on the content, readability and accessibility of the TFN Rule.
- Is the Overview section in the Rule clear, relevant and practical? Should any intersecting frameworks or legislation described in the Overview be removed, amended or added?
- Should any terms listed in Section 6 be removed, amended or added?
- Are there specific sections of Part 2 - Operational provisions that require updating? Please provide detailed reasons, with examples or illustrations where possible.
- Are there any matters that you believe the Rule should cover that have not been covered or should be covered in greater detail?
- Are there any other ways in which the Rule could be enhanced while keeping within its intended scope?
How to provide comments
Submissions can be made via email at consultation@oaic.gov.au. The closing date for submissions is 5 pm AEDT 2 December 2026.
The OAIC intend to make all submissions publicly available on our website. Please indicate when making your submission if it contains confidential information, you do not want made public and why it should not be published. Requests for access to confidential comments will be determined in accordance with the Freedom of Information Act 1982.
Privacy collection statement
The OAIC will use the personal information it collects during this consultation for the purpose of informing the remake of the Rule and considering issues raised by this consultation paper. We may seek further information from you related to your submission. Please see Privacy policy for more information.
[1] The Privacy Commissioner is also able to exercise this function with approval from the Information Commissioner (s 12(4)(d)(i) Australian Information Commissioner Act 2010).
