What ID Can I Ask Customers For in Australia?
What APP 9 actually restricts, why TFNs are a separate category, and the free tools to check your ID-collection practices.
APP 9 doesn't ban asking for ID, but it restricts adopting a government identifier — a Tax File Number, Medicare number, driver's licence or passport number — as your own identifier, or using one to identify a person, unless a specific exception applies. Tax File Numbers carry an extra layer of restriction under the TFN Rule 2015.
Last updated: 2 July 2026
What's restricted, and what isn't
| Practice | Status under APP 9 |
|---|---|
| Viewing ID once to verify identity | Generally permitted |
| Using a driver's licence number as a customer account number | Restricted |
| Collecting a TFN outside tax/super purposes | Restricted — TFN Rule 2015 |
| Retaining ID copies where a specific law requires it (e.g. AML checks) | Permitted, within scope of that law |
The common mistake
The most frequent APP 9 breach isn't collecting ID — it's what happens after. Businesses that photocopy a driver's licence for a one-off verification, then use that licence number as the customer's permanent account reference, have adopted a government identifier as their own — exactly what APP 9 restricts.
TFNs need separate handling entirely. The TFN Rule 2015 sits alongside the Privacy Act and limits TFN collection, storage and use to specific tax and superannuation purposes — a payroll or bookkeeping context, not general customer records.
Relevant free tools
Check whether you're allowed to collect, use or adopt government identifiers.
Check whether you need to offer an anonymous or pseudonymous option at any touchpoint.
Check whether the personal information you hold is accurate and up to date.
Related Privacy Act questions
When to check your ID-collection practices
- — You use a driver's licence, passport or Medicare number as a customer reference number
- — You collect Tax File Numbers outside a payroll or superannuation context
- — You retain photocopies of ID longer than a specific legal requirement demands
- — You're not sure whether your 100-point identity check process is APP 9 compliant
- — You've never reviewed which government identifiers your systems store
Frequently asked questions
What ID can I ask customers for in Australia?
APP 9 of the Privacy Act 1988 (Cth) doesn't ban asking for ID, but it restricts adopting a government identifier — a Tax File Number, Medicare number, driver's licence or passport number — as your own identifier, or using one to identify a person, unless a specific exception applies, such as a legal requirement to verify identity.
Can I use a driver's licence number as a customer account number?
No, not by default. APP 9 restricts adopting a government-related identifier, like a driver's licence number, as your own identifier for a person within your systems, unless a specific exception applies. Use a system-generated customer ID instead.
Are Tax File Numbers treated differently?
Yes. Tax File Numbers carry an extra layer of restriction under the TFN Rule 2015, a legislative instrument made under the Taxation Administration Act 1953, in addition to APP 9. TFNs should generally only be collected, held and used for the specific tax and superannuation purposes the Rule permits.
Can I photocopy a customer's ID for a 100-point check?
Only where a specific legal requirement — such as anti-money-laundering identity verification — requires it. Outside that context, retaining a copy of a government identifier beyond what's necessary can breach both APP 3 (collection necessity) and APP 9 (government identifiers).
Run the free government ID checker to see whether your identity-verification process meets APP 9.
Check my ID practices →