APP 9: Adoption, Use or Disclosure of Government Related Identifiers

Last updated 22 July 2026 · Reviewed by The PrivacyReady compliance team

The short answer

Australian Privacy Principle 9 prohibits adopting a government-assigned identifier — such as a Tax File Number, Medicare number, driver licence number, or passport number — as your own identifier for an individual, and restricts using or disclosing such identifiers to narrow circumstances, subject to specific exceptions. Tax File Numbers carry an additional, stricter layer of regulation under the TFN Rule 2015 made under s 17 of the Privacy Act.

Governing provision	Privacy Act 1988 (Cth), Schedule 1, APP 9
Prohibited	Adopting a government identifier as your own customer/account identifier
Common identifiers	TFN, Medicare number, driver licence, passport number
Extra layer for TFNs	TFN Rule 2015 (Cth), made under s 17
Typical lawful use	Identity verification for a specific, permitted purpose — not as your reference number

What APP 9 actually prohibits

The core prohibition is "adoption" — using a government-assigned identifier, such as a Medicare number or driver licence number, as your own means of identifying a customer or account, for example as a customer reference number in your systems. APP 9.2 also restricts using or disclosing a government related identifier to identify an individual, except in specific circumstances, such as where necessary to verify identity for a purpose required or authorised by law.

Tax File Numbers are treated even more strictly. The TFN Rule 2015, made under s 17 of the Privacy Act, regulates the collection, storage, use, disclosure, and security of TFN information separately from the general APP framework, and applies to any organisation that handles TFNs — most commonly employers, financial institutions, and superannuation funds.

Who this applies to

Any business that collects government identifiers as part of identity verification, employment onboarding, or regulated services — recruitment agencies, allied health providers, financial services, and any employer collecting a new employee's TFN.

Common SME failure modes

Using a driver licence or passport number as an internal customer ID — a direct breach of the adoption prohibition.
Collecting a government identifier when a less identifying alternative would work — for example, asking for a full Medicare number where only confirming eligibility is needed.
Storing TFNs without the specific safeguards required by the TFN Rule 2015 — general APP 11 security measures are not automatically sufficient for TFN information.
Retaining government identifiers longer than necessary after the purpose they were collected for has ended.

Practical compliance steps

Audit whether any system uses a government identifier as an internal reference number, and replace it with an independently generated ID if so.
Only collect government identifiers where genuinely necessary — often, verifying an identifier rather than recording it in full is sufficient.
If your business handles TFNs, review your practices specifically against the TFN Rule 2015, separately from your general privacy policy.
Restrict access to stored government identifiers to staff who genuinely need it.
Set a defined retention and destruction period for government identifier information.

Frequently asked questions

Can I ask for a driver licence to verify someone's identity or age?

Generally yes, for a specific, legitimate verification purpose — the restriction under APP 9 is on adopting the number itself as your ongoing identifier for that person, not on verifying identity where reasonably necessary.

Do I need special handling for a new employee's TFN?

Yes. TFN information is subject to the TFN Rule 2015 in addition to the general APPs, which imposes specific requirements on storage, use, and destruction (the specific requirements are unconfirmed here — check current OAIC/ATO guidance). Standard APP 11 security practices for other personal information may not be sufficient on their own.

What if a customer chooses to give us their Medicare number voluntarily as a reference?

The prohibition applies to your business adopting it as an identifier, regardless of how the number was obtained. Even if offered voluntarily, use an independently generated reference number instead.

Use the free Government ID Check to see whether the way your business handles TFNs, Medicare numbers, and licence numbers meets APP 9.

Check my APP 9 exposure →