Government ID Check · APP 9 government related identifiers

Am I Misusing a Driver's Licence or Medicare Number?

Q: What does APP 9 of the Privacy Act require?

APP 9 (Adoption, use or disclosure of government related identifiers) prohibits a business from adopting a government-issued identifier — such as a Tax File Number, Medicare number, driver's licence number or passport number — as its own identifier for an individual, unless required or authorised by law. It also restricts using or disclosing that identifier unless it's reasonably necessary to verify identity, required to fulfil an obligation to an agency, required or authorised by law, or reasonably necessary for enforcement activities by an enforcement body.

Q: Can a business use a driver's licence number as a customer ID?

No. APP 9.1 prohibits adopting a government related identifier — including a driver's licence number, Medicare number or passport number — as the business's own identifier for the individual, regardless of consent. An internally generated customer or account number should be used instead.

Q: When can a business record a government related identifier?

Recording it is generally permitted under APP 9.2(a) where it's reasonably necessary to verify the individual's identity for the business's activities — for example, sighting a driver's licence for an age-restricted sale. It's also permitted where required or authorised by law, such as AML/CTF customer identification or a TFN declaration.

Select the ways your business handles TFNs, Medicare numbers, driver's licences and passports. Get an instant APP 9 check across 18 common Australian scenarios.

Under APP 9 of the Privacy Act 1988 (Cth), a business must never adopt a government-issued identifier — a Tax File Number, Medicare number, driver's licence number, passport number or similar — as its own identifier for an individual. Using or disclosing one is also restricted to identity verification, obligations to an agency, or a legal requirement. Select the practices below to see where your gaps sit.

Last updated: 2 July 2026

How each practice is scored

Result	Meaning
Compliant	Required or authorised by law, or genuinely necessary to verify identity for your business's activities
Gap	Banned outright as an adoption or unrelated use of the identifier, or you can't confirm a genuine verification necessity

Why "just sighting ID" isn't the same as adopting it

APP 9 draws a sharp line most businesses don't realise exists. Sighting or recording a driver's licence to verify someone's age or identity is usually fine — it's reasonably necessary for the transaction. But turning that same number into your customer ID, patient record ID, or database primary key crosses into "adoption", which APP 9.1 prohibits outright, with no consent-based workaround.

The exceptions that do apply are narrow and specific: AML/CTF identification, a TFN declaration for tax reporting, or a genuine court order. A debt collector isn't automatically an "enforcement body" under the Act, and sharing an identifier across business units for unrelated purposes isn't covered either — both are common gaps this check flags.

Free diagnostic tool

Government ID check

Select every way your business currently handles government related identifiers. For each one that isn't automatically exempt or banned outright, tell us whether it's genuinely necessary to verify identity. You'll get an instant APP 9 report at a permanent URL you can revisit or share.

Business name (optional)

Which practices apply to your business?

Select all that apply. Where identity verification necessity isn't automatically covered by an exemption or ban, tell us whether it genuinely applies.

Adopting identifiers as your own ID

Using a customer's driver's licence number as their loyalty program or membership ID Banned outright Generate an internal member number instead — never reuse a driver's licence number as your own reference number.

Using a patient's Medicare number as the clinic's internal patient record ID Banned outright Store the Medicare number as a field on the record for billing, but don't let it become the record's primary identifier.

Using a passport number as a customer's account or booking reference number Banned outright Generate a separate booking reference and keep the passport number only as supporting verification data.

Using an employee's Tax File Number as their internal payroll or staff ID Banned outright Assign a separate payroll number generated by your HR or payroll system.

Verifying identity

Using identifiers beyond verification

Adding a customer's driver's licence number to their marketing profile for internal analytics Banned outright Strip the identifier from marketing and analytics datasets — retain it only where actually needed for verification or a legal requirement.

Making a government related identifier the searchable primary key in your customer database Banned outright Search and link records using your own internally generated customer ID, with the government identifier stored as a separate field.

Disclosing to third parties

Disclosing a driver's licence or passport number to a third-party identity verification provider (e.g. for Document Verification Service checks) Permitted under APP 9.2(a) where the disclosure is reasonably necessary to verify identity for your business functions — check the provider only uses the number for that verification purpose.

Yes, it is No / not sure

Disclosing a customer's driver's licence number to a debt collection agency for enforcement purposes Banned outright Refer the debt using your own internally generated account or reference number, not the customer's driver's licence number.

Sharing a customer's Medicare or driver's licence number across unrelated business units or franchises for their own separate purposes Banned outright If another business unit needs to identify the same individual, issue its own reference number rather than passing on the government identifier.

Regulated & required uses

Collecting a new employee's Tax File Number via a TFN declaration for ATO reporting Usually exempt Use the TFN only for taxation, superannuation and the other purposes the TFN Rule allows — never as an internal identifier.

Disclosing an employee's Tax File Number to an outsourced payroll provider to meet ATO reporting obligations Usually exempt Confirm the payroll provider's contract restricts TFN use to the same reporting purpose.

Disclosing a customer's identifying number to police investigating a reported crime Usually exempt Keep a short record of the request and the basis for disclosure in case it's later reviewed.

Disclosing a government related identifier in response to a subpoena or court order Usually exempt Disclose only what the order specifically requires, not the individual's full record.

When you need a government ID check

— Your account, membership or patient records have never been reviewed against APP 9
— You're newly covered by the Privacy Act following the 1 July 2026 threshold removal
— You sight or record driver's licences, passports, Medicare numbers or Centrelink CRNs as part of onboarding
— You disclose customer identifiers to payroll providers, verification services, or debt collectors
— You're preparing for an OAIC inquiry or a compliance audit

Frequently asked questions

What does APP 9 of the Privacy Act require?

APP 9 prohibits adopting a government related identifier as your own identifier for an individual, and restricts using or disclosing one to identity verification, obligations to an agency, a legal requirement, or enforcement activity by an enforcement body.

Can a business use a driver's licence number as a customer ID?

No. APP 9.1 bans adopting a government related identifier — including a driver's licence, Medicare or passport number — as your own identifier for the individual, regardless of consent. Use an internally generated customer number instead.

When can a business record a government related identifier?

Generally where it's reasonably necessary to verify identity for your business's activities, or required or authorised by law — such as AML/CTF customer identification or a TFN declaration.

What does the free government ID check check?

It checks the practices you select against a catalogue of 18 common Australian scenarios, flagging which are banned outright, which need a genuine verification necessity you haven't confirmed, and which are exempt.

Select your practices above to get an instant APP 9 government ID report.

Get my government ID report →