If you have a default, BNPL listing, or credit error in Australia, you can challenge it when it is inaccurate, incomplete, out of date, misleading, or listed without proper legal notice under the Privacy Act 1988 and the Privacy Credit Reporting Code 2025.
This guide explains how the law works, what evidence you need, how long providers have to respond, and how to escalate your complaint for free through Australian bodies if the lender or Credit Reporting Body does not fix the problem.
Table of Contents
Key takeaways
Your credit report must follow strict legal rules. Lawful and accurate information cannot be removed, only corrected when something is wrong or not compliant.
- Your credit report is regulated by the Privacy Act 1988, Part IIIA, and the Privacy Credit Reporting Code 2025, not just by internal lender policies.
- You can dispute any listing that is wrong, incomplete, not updated, irrelevant, or misleading.
- Lawfully reported and accurate information cannot be removed. It can only be corrected when it breaches legal requirements.
- BNPL products such as Afterpay and Zip are now covered by the Low Cost Credit Regulations 2025, which align them with banks and other credit providers.
- A credit provider must meet strict notice and timing rules before listing a default, including a 14-day intent to list period under section 21D.
- If you never received the required notices or your hardship request was ignored, you may have grounds to dispute the listing.
- Credit Reporting Bodies must investigate disputes, block the listing during investigation, and respond within set timeframes.
- Internal dispute resolution may fail. In this case, you can escalate to AFCA or the OAIC at no cost.
- You can use free resources such as Moneysmart, AFCA, and OAIC to manage disputes without paying a third party.
- This guide does not replace financial or legal advice tailored to your situation.
The legal nature of credit reporting in Australia
In Australia, your credit report is not just an internal scorecard used by lenders. It is treated as a legal record governed by the Privacy Act 1988, especially Part IIIA, and the Privacy Credit Reporting Code 2025. These laws define who can access your credit history, what can be reported, how long information can stay, and how you can correct it.
Credit information is held by Credit Reporting Bodies, often called CRBs. Common CRBs in Australia are Equifax, Experian, and Illion. They collect information from banks, BNPL providers, telcos, utilities, and other credit providers. Lenders then use that information to assess your credit applications.
When a lender lists a default or reports your repayment history, they must follow strict legal standards. If they do not follow these rules correctly, you may have a solid basis to dispute the listing and request a correction or removal of that specific entry.
Legislative Standards for 2025 and 2026
Privacy Credit Reporting Code 2025
The Privacy Credit Reporting Code 2025 sets operational standards for how CRBs and credit providers must handle your credit information. It covers:
- The form and content of default notices
- Timeframes for investigating disputes
- How and when information must be corrected
- How long can certain types of information stay in your file?
The Code supports your right to request corrections, have disputes investigated, and receive clear explanations of decisions. It also requires CRBs and credit providers to keep records that support the listings they place on your file.
Low Cost Credit Regulations 2025 and BNPL
The National Consumer Credit Protection Amendment, also called the Low Cost Credit Regulations 2025, brought BNPL products into the mainstream regulatory system. BNPL providers such as Afterpay and Zip now fall under similar responsible lending and reporting obligations as banks and other licensed credit providers.
This means:
- A BNPL default is treated in a similar way to a bank default for reporting and dispute purposes.
- BNPL listings must comply with notice and accuracy rules in the Privacy Act and Credit Reporting Code.
- You can dispute a BNPL listing using the same pathways you would use for a bank or credit card provider.
If you are asking whether you can dispute an Afterpay or Zip listing under the 2025 regulations, the answer is yes. You still need a clear accuracy or procedural issue that fits the legal tests in this guide.
Banking Code of Practice 2025
The Banking Code of Practice 2025 introduced stronger protections for customers in hardship or vulnerable circumstances. It requires banks to recognise and respond appropriately to financial hardship requests and vulnerability indicators.
In practice, this means:
- Banks must not report adverse information during an active, genuine hardship review, except in limited and clearly defined situations.
- If a bank lists a default while a hardship variation or vulnerability assessment is still in progress, there may be grounds to argue non-compliance with the Code and privacy rules.
If you are asking whether you can seek removal of a listing where a bank ignored your hardship request, start by checking whether you lodged a clear hardship request, whether it was acknowledged, and whether the listing occurred during that process.
Statutory tests for data accuracy
Not every negative listing is unlawful. To know whether you can dispute a listing, you need to understand how the law defines an accurate and compliant entry.
Accuracy and completeness test
Under Australian credit reporting law, information on your file must be:
- Accurate
- Up to date
- Complete
- Relevant
- Not misleading
If the amount listed is wrong, the account status is not updated after payment, the dates are incorrect, or the listing creates a misleading impression about your conduct, you may have grounds for correction.
You can dispute a default if:
- The amount recorded is higher than the amount actually overdue.
- The listing still shows unpaid, even though you settled the debt weeks ago.
- The default date is wrong, which can affect how long it stays in your file.
A default cannot be removed just because it is inconvenient or because you regret the previous debt. The key question is whether it meets the legal tests above.
Procedural compliance under sections 6Q and 21D
Australian law does not only look at the final outcome. The process used to list the default matters as well.
Section 6Q relates to notices about the disclosure of your credit information to a CRB. Section 21D sets out requirements for disclosure of default information to a CRB. Together, they form a notice-and-timing process that must be followed.
To lawfully list a default, a credit provider must:
- Issue a notice of their intention to list the default.
- Allow a minimum 14-day period from that notice before lodging the default.
- Send the notice to your last known address or agreed communication channel in a way that aligns with the law and the Code.
If you wonder what happens if you never received a section 6Q or 21D notice, or if the default notice went to an old address, the law looks at whether the provider can prove they sent it correctly to the last contact details you provided. They must be able to show evidence of sending. It is not enough to simply state that it was sent.
Financial hardship and vulnerability protections
When a hardship variation or vulnerability assessment is active, there are limits on adverse reporting. Under the 2025 Banking Code and the Credit Reporting Code, lenders must treat hardship cases carefully and avoid unfair reporting while a request is being considered.
If you lodged a hardship request and then saw a default recorded around the same time, you can ask the lender for a timeline. If they listed the default while your hardship case was still open and they did not clearly explain why this was allowed, you may be able to challenge the listing based on hardship protections.
Clinical observations from practice
From ongoing work with Australian consumers and lenders, some patterns appear frequently. These patterns can help you spot issues in your own file.
Many digital-first lenders and BNPL providers are still adjusting their systems to the detailed notice and timing obligations clarified in 2025. Automated systems sometimes progress to default listings without confirming that a compliant intent to list notice was sent and that the full 14-day window was respected.
Regular non-compliance issues include:
- Generic reminder letters are used as default notices that do not clearly meet section 21D requirements.
- Notices are sent to old postal addresses when more recent email or phone details exist on file.
- Failure to update a listing to Paid within the required period after a customer clears the balance
- Amount errors caused by fees or charges that were later reversed but never corrected in the report
These patterns do not mean every listing is invalid. They show why it is worth cross-checking your notices, dates, and amounts against your own records.
The evidence Standards for a formal dispute
A strong dispute is built on clear evidence, not just a sense that something is unfair. Before lodging a dispute, collect as much documentation as you can.
Helpful documents include:
- Account statements showing payment history and balances
- Copies of any letters, emails, or SMS messages from the credit provider about arrears or default
- Screenshots from BNPL apps showing payment status and timelines
- Bank statements showing when payments were made
- Copies of hardship applications and responses from the lender
- Police reports or statutory declarations if your identity was stolen.
- Any reference numbers or confirmations from previous complaint calls
When you lodge your dispute with a CRB or credit provider, be clear and specific. State:
- Which listing are you disputing?
- Why do you believe it is inaccurate, incomplete, or not compliant?
- Which documents support your position
This helps the CRB or credit provider check whether the listing meets both the accuracy tests and the procedural requirements under the Privacy Act and Credit Reporting Code.
Role of Credit Reporting Bodies in disputes
CRBs play an active role in credit disputes. When you lodge a correction request with a CRB, it must:
- Record your dispute
- Ask the credit provider to verify the information.
- Block or flag the disputed listing during the investigation.
- Complete the investigation within a reasonable period, often around 30 days, unless extra time is justified and explained.
- Notify you in writing of the outcome and any changes made.
If you ask how long a bank or CRB has to respond to a credit dispute in 2026, the general expectation is around 30 days. When more time is needed, they should give you a reason and a new expected completion date.
Statutory escalation pathways
If you are not satisfied with the outcome from the CRB or credit provider, or if they do not respond in time, you can escalate your complaint.
Internal dispute resolution
Start with the credit provider or CRB internal dispute resolution process. Make sure your request is logged as a formal complaint. Ask for a written response and a reference number.
If 30 days pass without a resolution, or if you receive a response that you disagree with, you can move to external dispute resolution.
AFCA for lender disputes
The Australian Financial Complaints Authority can review disputes between consumers and financial firms. This includes banks, credit card providers, BNPL providers that fall under the credit rules, and other licensed credit providers.
You might go to AFCA if:
- A bank or lender refuses to correct a default you believe is not compliant.
- Your hardship request was ignored, and a default was listed instead.
- A BNPL provider will not correct a listing that appears wrong based on your records.
AFCA can order corrections and, in some cases, compensation. The service is free for consumers.
OAIC for privacy and credit reporting breaches
If your dispute is with a CRB or relates directly to how your credit information was handled under Part IIIA of the Privacy Act, you can complain to the Office of the Australian Information Commissioner.
The OAIC can investigate whether a CRB or credit provider has breached the Privacy Act or the Credit Reporting Code. It can require corrections, order changes to practices, and in some cases, direct other remedies.
Timeframes and how long listings remain
Time limits play a major role in what can be done with a credit listing. In general:
- Defaults usually remain on your report for five years from the date of default.
- Serious credit infringements can remain for up to seven years.
- Repayment history information is usually kept for two years.
If you ask whether you can remove a default more than five years old, the usual position is that it should fall off your report automatically after that period. If it remains after the maximum period, you can request its removal as out-of-date information.
Separate from reporting rules, some debts may become statute-barred when a long period passes without payment or acknowledgement. Often, this is around six years, depending on state law. A statute-barred debt generally cannot be enforced in court. This does not automatically remove a past default that was correctly listed before the limitation period expired, but it can change what the creditor is allowed to do next.
BNPL credit errors and unfair listings
Many people now ask whether BNPL defaults are treated the same as bank defaults. Under the Low Cost Credit Regulations 2025 and the Credit Reporting Code, the answer in practice is yes.
A BNPL provider must:
- Use accurate, up-to-date information.
- Follow notice requirements before listing a default.
- Respect hardship and vulnerability protections where they apply
- Respond to correction requests and disputes in line with the Code.
If you never received a clear notice of intent to default from a BNPL provider, if the amount listed is wrong, or if you were in an acknowledged hardship arrangement when the listing occurred, you may be able to dispute that BNPL listing on the same grounds as you would challenge a bank default.
Identity theft and mixed credit files
If your identity was stolen and used to take out credit, or if someone else’s debts appear on your file, you are dealing with a serious credit reporting error.
In these situations:
- Lodge a police report as soon as you can
- Tell all major CRBs that your identity has been compromised.
- Ask CRBs to place a temporary ban on your credit report.
- Contact the credit provider whose account is fraudulent and give them your police report reference and any supporting evidence.
- Lodge a dispute with CRBs for each fraudulent listing.
For mixed credit files, where another person’s account appears on your file because of a data match mistake, you can request that the CRB correct the error and separate the files. Provide copies of your identification and any evidence that the account does not belong to you. CRBs are required to investigate and correct these errors once they verify the mistake.
Your rights, free help, and what this guide can and cannot do
This guide walks through the main parts of Australian credit reporting law so you can better understand your rights and options before you take action. It does not replace personalised financial or legal advice, and it cannot assess every detail of your situation.
You can get free help and independent information from:
- Moneysmart for clear information on credit reports and step-by-step dispute processes
- AFCA for complaints about banks, lenders, and other financial firms
- OAIC for complaints about how your credit information is collected, used, or reported
These services are available at no cost to you. You can use them on your own or alongside professional help.
Professional Advocacy and Compliance Support
Navigating the procedural requirements of the Privacy Act and the 2025 Credit Reporting Code requires significant attention to detail. While consumers can manage these disputes independently through free pathways like Moneysmart and AFCA, many engage professional support to ensure their case meets the required legal thresholds.
Easy Credit Repair provides structured advocacy for Australians seeking to resolve credit reporting errors. Our process focuses on identifying procedural non-compliance and ensuring that lenders and CRBs adhere to their statutory obligations. We do not guarantee specific outcomes; we ensure that your rights under Australian law are fully exercised and that your credit file reflects accurate, lawful data.
Author: Kuldeep Singh (Authorised Credit Representative #552536)
Disclaimer: This information is current as of February 2026 and is based on our interpretation of Australian credit law. It is provided for educational purposes and is not legal or financial advice. Laws and regulatory codes are subject to change. For a review of a specific listing or reporting error, contact our compliance team.
