Australia Privacy (Credit Reporting) Code 2025 1A: Destroy credit-related personal information irretrievably, or where electronic destruction is impossible put it beyond use on the five conditions

When the Act, the Regulations or the Code require a credit reporting body to destroy credit information or credit reporting information it must ensure the information is irretrievably destroyed; where irretrievable destruction of electronic information is not possible it must put the information beyond use by irretrievably omitting it from the databases used for Part IIIA disclosures, being unable and committed not to use it (including to derive CRB derived information) or disclose it, surrounding it with appropriate technical and organisational security, and committing to destroy it when that becomes possible. A credit provider required to destroy credit reporting information or credit eligibility information must take reasonable steps to destroy it irretrievably, or where impossible put it beyond use on the matching conditions (no use including for CP derived information, no disclosure, security, and a commitment to destroy).