Quick answer
A legitimate online lender should only collect information it needs to assess your application, share it with the parties involved in arranging and funding the loan, and protect it under the Privacy Act and the Australian Privacy Principles. You should be able to see what you're consenting to, withdraw bank-data consent, and ask to access or correct information held about you.
Key points
- Collect only what's needed, at the stage it's needed — that's the standard to expect.
- Bank-data sharing should be read-only and consent-based.
- Organisations covered by the Privacy Act must report eligible data breaches.
- Never share passwords or one-time codes — no legitimate lender needs them.
- Main law
- Privacy Act 1988 (Cth)
- Regulator
- OAIC
- Breach notices
- Notifiable Data Breaches scheme
- CDR consent
- Expires after 12 months
An online business loan application can involve a lot of information: your business’s bank transactions, accounting data, tax position, property details, and personal details and ID for the people behind it. That’s a reasonable amount to ask for when you’re borrowing money — but it’s also a lot to hand over, and you’re entitled to know how it’s handled.
This page sets out what to expect from a legitimate lender, the rights you have, and the habits that keep your data safe.
What information is collected, and when?
Good practice is to collect in stages, only asking for what’s needed at each point:
| Stage | Typical information |
|---|---|
| Enquiry | Name, contact details, business name, ABN, amount, purpose, state, basic trading details |
| Specialist call | More context: timing, property, existing debts, any tax arrangements |
| Application | Bank statements or data link, ID verification, company details, accounting reports if needed |
| Credit assessment | Credit reports, with your agreement |
| Settlement | Loan documents, security documents for secured loans, payment details |
If a site or caller asks for everything — ID, statements, passwords — before telling you who they are or what you’re applying for, that’s a warning sign. More in online loan scams.
What privacy protections apply?
Organisations covered by the Privacy Act 1988 must handle personal information in line with the Australian Privacy Principles. In practical terms, that means being open about what’s collected and why, using it for the purposes you were told about, keeping it secure, and letting you access and correct it.
The Notifiable Data Breaches scheme adds another layer. The OAIC explains that organisations covered by the Privacy Act have to tell the people affected, and the OAIC, about a data breach that’s likely to cause serious harm. If you ever receive such a notice, follow its advice — it usually includes steps to protect yourself.
Our own approach is set out in our privacy policy.
How is bank data protected?
There are two common ways bank data reaches a lender:
- A secure data connection. Under the Consumer Data Right, you authorise your bank to share read-only data with an accredited recipient. The OAIC says consent expires after 12 months, can be withdrawn at any time, and you can ask for data to be deleted. See open banking and CDR.
- Statements you download. You log in to your internet banking yourself, download PDFs and upload them through the lender’s secure portal.
Either way, the lender doesn’t need your password, and read-only data access doesn’t allow money to be moved. Repayments are collected under a separate direct debit authority you sign.
What should you look for in a lender’s process?
- A clear privacy policy that explains collection, use, sharing and your rights
- Secure upload portals rather than requests to email documents
- Verification links that arrive inside the application you started
- Plain-English consent screens for data sharing and credit checks
- A named contact person and a way to reach the business by phone
- A registered ABN you can check on ABN Lookup
If something feels off, pause and call the business on a number you’ve found independently. A legitimate lender won’t mind.
How can you protect your own business data?
Lenders are one side of the equation. The other is your own setup. Business.gov.au’s cyber security checklist recommends basics such as turning on multi-factor authentication, installing software updates promptly, backing up information, and learning to recognise scam messages that impersonate legitimate organisations.
For a loan application in particular:
- Turn on multi-factor authentication for your email, banking and accounting software.
- Use a business email address rather than a shared or personal one where possible.
- Don’t send ID or statements over public Wi-Fi without a secure connection.
- After the loan is decided, remove data connections you no longer need.
- Watch your credit reports for unexpected enquiries.
If you’re planning a broader security upgrade, our page on tech upgrades covers how businesses fund it.
Who sees your information with eBusiness Loans?
When you send an online enquiry, it’s reviewed by a lending specialist — not broadcast to a panel of lenders. If you decide to proceed, the information goes to the one lender we’ve matched you with, plus the service providers that lender needs to complete the loan, such as identity verification, credit reporting with your agreement, valuers for property-secured loans and settlement agents. We never ask for your banking password, and we don’t use your details for anything you haven’t been told about.
What if you’re worried your data has been misused?
Act quickly. Change passwords and turn on multi-factor authentication, contact your bank if banking details may be involved, and check your credit reports for enquiries you don’t recognise. If you believe a scam is involved, report it to Scamwatch. If a business hasn’t handled your personal information properly, you can complain to the business first and then to the OAIC if you’re not satisfied. Our scam page has a fuller checklist of who to contact and in what order.
Ready to apply with your data in safe hands?
You shouldn’t have to trade privacy for speed. Begin your enquiry in about 60 seconds — it doesn’t involve a credit check, your details stay with one specialist rather than being shared widely, and a real person will explain exactly what each lender needs before anything is collected. Accurate answers mean fewer follow-up requests, which keeps your data footprint as small as possible.
Frequently asked questions
Who will see my information if I enquire?
With eBusiness Loans, a lending specialist reviews your enquiry. If you choose to proceed, the matched lender and the service providers it uses for verification, valuation and settlement see what they need. Your enquiry isn't distributed to a long list of lenders.
What happens to my data if I don't go ahead?
Information should be kept only as long as needed for lawful purposes, then destroyed or de-identified. For CDR data, you can ask the recipient to delete it through its dashboard.
What is a notifiable data breach?
The OAIC says organisations covered by the Privacy Act have to tell the people affected, and the OAIC, about a data breach that's likely to cause serious harm.
Can I ask what information is held about me?
Yes. Under the Privacy Act you can request access to personal information an organisation holds about you, and ask for it to be corrected if it's wrong.
Will you ever ask for my internet banking password?
No. Bank data is shared through secure read-only connections or statements you download yourself. Nobody from eBusiness Loans will ask for your password or a one-time code.