Privacy statement
Your privacy is important to us. Please read this privacy statement before entering a secure transaction on the Australian Business Register (ABR) website – it outlines our commitment to safeguarding your details.
Part 1: General principles and practices applied to the ABR website:
- introduction to the ABR website and its operations
- scope of the privacy statements
- collection of personal information
- use and disclosure of personal information
- information publicly available on ABN Lookup
- information not available on ABN Lookup or to the public
- information available to government agencies
- quoting your tax file number (TFN)
- data security
- use of cookies
- data quality
- privacy concerns.
Part 2: Details about the applications hosted on the ABR website:
- applying for an Australian business number (ABN) or other registrations
- accessing or changing ABN details.
Introduction to the ABR website and its operations
The ABR website provides numerous transactions built around the ABN and enables business people to view and change their ABN registration details. Certain taxation applications are also available on the ABR website.
The two major parts of the ABR website are ABN Lookup and ABRsecure.
ABN Lookup provides the public search of ABN details available from the www.business.gov.au website. A successful public search for an ABN on the business.gov.au website will list the ABN details as specified at Information publicly available on ABN Lookup.
ABRsecure provides a secure environment for online applications. A menu of secure transactions can be found on the ABR homepage. Applications available include:
- apply for an ABN
- access my details
- change my details
- other registrations:
- apply for a non-individual TFN
- register for goods and services tax (GST)
- register for pay as you go (PAYG) withholding.
Collection of the information requested in ABN or tax applications is authorised by one or more of the following Acts:
- A New Tax System (Australian Business Number) Act 1999
- Income Tax Assessment Act 1936
- A New Tax System (Goods and Services Tax) Act 1999
- A New Tax System (Wine Equalisation Tax) Act 1999
- A New Tax System (Luxury Car Tax) Act 1999
- Fuel Tax Act 2006
- Energy Grants Credits Scheme Act 2003
- Product Grants and Benefits Administration Act 2000
- Fringe Benefits Tax Assessment Act 1986
- Taxation Administration Act 1953
- Superannuation Industry (Superannuation) Act 1993.
The information will help us to administer those Acts and the taxation law.
The Tax Office operates this website (www.abr.gov.au). The Privacy Act 1988 and the Crimes Act 1914 govern Commonwealth Government agencies (including the Tax Office) and their personnel.
Some private sector consultants may work on the ABR website. These consultants must comply with the Privacy Act 1988 and are also required, by their contract, to acknowledge their awareness of the relevant provisions of the Crimes Act 1914.
Tax Office personnel welcome feedback on the design of the website and practices. You should address your feedback to abrhelp@ato.gov.au - other contact details are published on the Contact Us page.
The primary delivery mechanism used for the ABR website is the internet. You should note there are inherent risks associated with transmission of information via the internet. Therefore, you should make your own assessment of the potential risks to the security of your information when deciding to use the ABR website. For details on how information is secured by the ABR website, please read our security policy.
There are alternative ways to complete ABR registrations if you do not wish to use public networks such as the internet. For more information on these alternatives, phone the Tax Office on 13 28 66 between 8.00am and 6.00pm, Monday to Friday.
For more information on the operation of the Privacy Act 1988, and privacy in general, visit the Privacy Commissioner’s website at www.privacy.gov.au.
Scope of the privacy statements on the ABR website
The privacy statements address privacy matters under the Privacy Act 1988. This statement does not extend to all security matters, which are addressed by our security policy.
There are three privacy statements.
- This privacy statement, which covers the entire ABR website (including information on the collection of clickstream data and the use of cookies).
- An Information Privacy Principle 2 (IPP 2) statement which is presented each time you enter an online transaction.
- A privacy statement which is presented before viewing or changing your ABN details.
Collection of personal information
As the operator of the ABR, the Tax Office collects and records personal information gathered while processing applications made on the website.
Under the Privacy Act 1988, Information Privacy Principles 1-3 regulate an agency’s collection of personal information.
All personal information collected by the Tax Office, for example, through the use of online forms, will be:
- collected by lawful and fair means, and
- used for a lawful purpose that is directly related to the Tax Office’s functions.
The Tax Office will take reasonable steps to ensure that:
- information collected is relevant, up to date, and complete, and
- collection of the information is not unreasonably intrusive.
When requesting personal information, the Tax Office will normally tell the person:
- why it is collecting the information
- whether it has legal authority to collect the information, and
- to whom it usually gives that information.
The Tax Office will take reasonable steps to inform the user when they are entering or leaving the ABR website.
Each visit to this site is logged. Certain information is recorded for statistical purposes and is used to improve the site. This information is called 'clickstream data' and is supplied by the user's browser.
Clickstream data is the:
- user's server address
- user's operating system – for example, Windows, Macintosh
- user's top level domain name – for example, .com, .gov, .au, .uk
- date and time of the visit to the site
- pages accessed and the documents downloaded
- previous site visited, and
- type of browser used.
Clickstream data collected will not be disclosed to third parties unless the law authorises the disclosure.
When the Tax Office collects personal information via email it will:
- record the email address
- use the email address for the purpose for which it was provided
- not add the email address to a mailing list unless specifically requested, and
- not use the email address for any other purpose.
Use and disclosure of personal information
Under the Privacy Act 1988, Information Privacy Principles 9 and 10 regulate the use of personal information.
Under the Privacy Act 1988, Information Privacy Principle 11 regulates the disclosure of personal information. Additionally, taxation Acts have secrecy provisions that prohibit any officer of any government department from disclosing anyone's taxation information except in performing their duties or in specific situations permitted by taxation laws. There are severe penalties for breaking these provisions.
The Tax Office will only disclose personal information in accordance with the relevant taxation secrecy provisions and the information privacy principles.
For more information on use and disclosure, refer to Information publicly available on ABN Lookup, Information available to government agencies and ABR Partners.
Information relating to entities that are refused ABN registration is not made:
- publicly available
- available to other government agencies.
Information publicly available on ABN Lookup
Some of the information collected in this application form will appear on the Australian Business Register (ABR). The information listed below is available, for free, by phoning the Tax Office on 13 28 66 between 8:00am and 6:00pm, Monday to Friday or by visiting the business.gov.au website at (www.abr.business.gov.au):
- ABN
- ABN status (date of effect of your ABN registration)
- entity name
- entity type (such as company, sole trader, trust or superannuation fund)
- trading name (trading or business name)
- state (from the address you provide as your main business address)
- postcode (from the address you provide as your main business address)
- GST registration (status, date of effect and cancellation)
- deductible gift recipient status and date/s of effect (if applicable)
- tax concession charity status and date/s of effect (if applicable)
- income tax exempt fund status and date of effect (if applicable)
- Australian Company Number (ACN) or Australian Registered Body Number (ARBN) (if applicable)
- the date of an ABN change if the Registrar of the ABR (the Registrar) has changed the entity’s ABN, and
- the date of an ABN cancellation – if the Registrar has cancelled the entity’s registration in the ABR.
Some, or all, of the free, publicly available information may be regularly provided in bulk to third parties using the internet or alternate electronic means. A fee to cover administrative costs of providing this information may be charged for this service.
A printout of this information is also available as a certified extract of the ABR.
If an entity requests a certified copy of its own register details, this will be provided free of charge. The extract will contain all of the information set out above, plus additional information including the full address for service of notices, correspondence and email addresses.
If you request a certified copy of another entity’s register details, you will be charged a fee of $20 for the first page (a standard certified extract is usually one page), and 10 cents for any subsequent pages. You will be provided with the same information that is available to the public online (for free) through the business.gov.au website at www.business.gov.au
All requests for certified extracts need be in writing and sent to:
In exceptional circumstances, you can request that certain information, that would otherwise be made available to the public, be suppressed. This includes cases where a person fears for their safety or that of their family.
If you want to apply to the Registrar to withhold some of the details available to the public about the entity, please provide a letter detailing the information to be suppressed, a copy of any supporting material and the reasons for the suppression. You can enclose this information with the application and mail it to:
Information not available on ABN Lookup or to the public
Information relating to an entity that has been refused ABN registration is not made publicly available.
The remainder of the information you supply on this application will not be available to the public, but may be made available to government agencies as explained below.
Information available to government agencies authorised by law to receive it
The ABN has been implemented in response to requests from business for a single number to streamline their interactions with all levels of government. To help business and government interact more easily, under certain circumstances, the Registrar may disclose information provided by the entity to other Commonwealth, state, territory and local government agencies.
The Registrar may provide some of this information to other Australian government agencies authorised by law to receive it – for example, law enforcement agencies such as the National Crime Authority and Australian Federal Police, revenue agencies such as the Australian Customs Service, benefit payment agencies such as Centrelink and the Health Insurance Commission, and other agencies such as the Australian Bureau of Statistics.
Data may also be provided to state, territory and local government agencies such as law enforcement agencies, benefit payment agencies and revenue offices carrying out functions under taxation law.
Details of the government agencies regularly receiving information from the ABR is available at ABR partners or you can phone 13 28 66 between 8.00am and 6.00pm, Monday to Friday and request a list of agencies be emailed, faxed or posted to you.
These agencies may use ABR information for purposes authorised by their legislation or for carrying out other functions of their agency. Examples of possible uses include registration, reporting, compliance and validation and updating of databases.
The Registrar of the ABR requires all government agencies to detail their specific use of ABR information and sign a memorandum of understanding (MOU) before they can access ABR information or interact with the ABR. The MOU sets out a common understanding between parties and ensures the Registrar has considered the appropriate use of ABR information under the A New Tax System (Australian Business Number) Act 1999.
In addition to the publicly available information detailed above, the information available to these agencies includes the:
- name of the entity’s public officer
- name of the entity’s trustee or trustees
- entity’s address for service of notices
- entity’s principal place of business
- entity’s email address, and
- Australian and New Zealand Standard Industrial Classification (ANZSIC) code for the business conducted by the entity.
Taxation law also authorises the Tax Office to provide taxation information, including ABR information, to law enforcement agencies and state taxation authorities.
Information not available to government agencies
Information relating to an entity that has been refused ABN registration is not made available to government agencies.
Quoting your tax file number (TFN)
You are under no legal obligation to quote your TFN or the TFNs of associates in the ABN application form. However, failure to do so may increase the risk of administrative error and/or delay this registration.
The Tax Office is authorised by the Taxation Administration Act 1953 to request, but not compel, you to provide your TFN or that of an associate. This information is needed to correctly identify you as well as to administer the taxation laws.
Data security
Under the Privacy Act 1988, Information Privacy Principle 4 regulates storage and security of personal information. The ABR website has a security policy which outlines the steps taken to comply with Information Privacy Principle 4.
Secure socket layer (SSL) encryption protects information passing between the user and the ABR database while the user remains on the ABRsecure website. Users seeking more information about SSL in general are referred to W3C 'The World Wide Web Consortium' where a search on the word ‘SSL’ or browsing the ‘Security FAQs’ will provide current information.
Data storage and security arrangements are as follows.
- To complete a registration transaction, you do not need any form of electronic identification but you will be required to provide proof of identity – for example, name and TFN.
- Data that is sent between you and the ABR website in these applications is encrypted using SSL.
- To safeguard the integrity of applications, the ABR website makes back-up tapes that are retained in a highly secured environment for up to two weeks.
- Completed transaction details are stored in a highly secured environment indefinitely.
- Incomplete applications are stored in a highly secured environment for a maximum of seven days.
- Voluntary site feedback will be retained in archival storage indefinitely.
Use of cookies
Cookies used in session management
Cookies are pieces of information that a website can transfer to an individual's/user’s own computer for record keeping.
Cookies on the ABR website are session-based and are provided to assist in session management. On each use of the ABR website a 'session cookie' is temporarily placed on your computer. The ‘session cookie’ is used to maintain navigation information during your site visit. These session cookies are deleted from your computer at the end of each session.
Most internet browsers are preset to accept cookies. If you prefer not to receive cookies, you can generally adjust your internet browser to refuse cookies or to warn you when cookies are being used. However, the ABR may not function properly if cookies are not enabled.
Cookies used for authentication
The ABR website uses an authentication session token to confirm the client’s identity when business details are accessed or changed. These tokens are contained within a HTTP session cookie and the Tax Office ensures that these cookies:
- only store the listed client-related fields:
- certificate holder (user) distinguishable name
- certificate issue – for example, Tax Office, distinguishable name
- certificate serial number
- certificate holder ABN, and
- universal principal name, (this is an internal user ID of the client – for example, for business clients this is a generic anonymous user).
- are non-persistent – that is, they are not written to a disk and are only stored in your browser’s process memory so that the cookie can be cleared when you log off
- are set to secure so that they can only be used across an established SSL link, and
- are securely encrypted.
For more information on cookies in general, refer to W3C 'The World Wide Web Consortium' where a search on the word ‘cookies’ will provide current discussions. Also, you can find advice about the internet and personal information on the Privacy Commissioner’s website www.privacy.gov.au
Data quality
Under the Privacy Act 1988, Information Privacy Principles 7 and 8 regulate data quality.
Information contained in ABR records is based on information supplied by registered entities. Accordingly, the Tax Office does not guarantee that the information is accurate, up to date, or complete – it is not possible to independently verify all such information or to guarantee that the information has been updated.
You should consider verifying any information obtained through this service from other sources.
Furthermore, the fact that an entity is listed on ABN Lookup is not a guarantee of the commercial viability or continuing existence of the entity, nor is it a guarantee that any apparent use by an entity of its ABN is in fact properly authorised by the entity.
Privacy concerns
If you have privacy concerns phone the Tax Office on 13 28 66, between 8.00am and 6.00pm, Monday to Friday. You can also obtain further information from the Privacy Commissioner’s website at www.privacy.gov.au or through direct contact.
The following are business registration applications that you can use to register for elements of the tax system:
- apply for an ABN
- access my details
- change my details (including cancel my details)
- other registrations:
- apply for a TFN
- register for GST and Fuel Tax Credits (FTC)
- register for pay as you go (PAYG) withholding.
Apply for an ABN or other registrations
In the following applications, the Tax Office is the collector and record-keeper of personal information:
- apply for an ABN
- other registrations:
- apply for a TFN
- register for GST and FTC
- register for PAYG withholding.
It is important to note that the TFN application can be used by non-individuals to register for a TFN, without necessarily registering for an ABN, GST, FTC or PAYG withholding.
Cookies are used when applying for an ABN and other registrations. Refer to Cookies used in session management.
Data storage and security arrangements are outlined under Data security.
It is important that you are aware of the Use and disclosure of personal information you are providing.
Access or change ABN details
A key objective of the ABR website is to provide routine transactions that enable you to access and change your information without having to exercise your legal rights under the Freedom of Information Act 1982.
The Freedom of Information Act 1982 provides the mechanism and process by which users of the ABR website have access to, and may change, records containing their personal information. A similar right is provided by the Privacy Act 1988. However, the Privacy Commissioner has asked people to exercise their access rights under the Freedom of Information Act 1982 before those under the Privacy Act 1988.
Business clients can securely access, change or cancel their own details over the internet once they have registered for a digital certificate. The digital certificate provides a high level of authorisation through the use of asymmetrical key-pairs. For more information about the digital certificate visit our Online Services website.
Authorised tax agents can access or change details on behalf of their clients once the agent has registered for a digital certificate.
Government agencies authorised to access ABR information will need to register for a digital certificate to look at details over the internet. Alternatively, they will need a valid user ID and password to access details via the Tax Office’s secure Corporate External Gateway.
Cookies are used when business clients wish to access or change their own business details. Refer Cookies used in session management and Cookies used for authentication.
It is important that you are aware of Use and disclosure of the information you are providing.
|
ABR Help
