Privacy Commissioner Annual Report 2025: key takeaways for data users

The Privacy Commissioner's Annual Report for 2024/25 was released in August 2025, and it contains several findings directly relevant to businesses that access third-party data sources.

Complaint volumes

Privacy complaints increased 23% year-on-year, with third-party data collection complaints growing faster than any other category. The Commissioner noted that "too many businesses still treat IPP3A as optional rather than mandatory."

Enforcement activity

The OPC issued 18 compliance notices in the year, up from 7 the previous year. Six of these related specifically to IPP3A failures — businesses collecting personal information from third-party sources without notification or adequate consent.

Sectors of concern

The Commissioner singled out four sectors for particular attention:

• Motor vehicle dealers — for running Carjam and PPSR checks without notification.

• Finance companies — for inadequate consent processes around credit checks.

• Recruitment agencies — for running background checks beyond what is proportionate to the role.

• Property managers — for tenant screening without adequate notification.

The Commissioner's message

"The Privacy Act is not aspirational. It is the law. Businesses that collect personal information from third parties must notify individuals. I will continue to use compliance notices and, where necessary, refer matters for prosecution."

What this means for DEIS users

If you are using DEIS, you are already ahead of most businesses. Your compliance evidence is captured automatically and can be produced if the OPC investigates. But this report is a reminder to ensure your team is consistently selecting the correct IPP3A pathway for each lookup.