You cannot hide your details behind a privacy service on a .com.au or other .au domain. auDA's rules do not allow it, but the public WHOIS also shows less than a typical .com record: no street address and no phone number. The real risk is typing personal information into fields that are meant to be public.
According to auDA's WHOIS Policy, the public record includes the domain name, registrar and reseller details, status, name servers, DNSSEC status, the registrant's legal name and registrant ID (such as an ABN or ACN), and the eligibility type, name and ID. The registrant contact name appears on the web and Port 43 services, and the registrant and technical contact email addresses appear on the web WHOIS only.
Registrant street address, telephone and fax numbers are not disclosed, and creation, renewal and expiry dates are not shown. The web service uses a CAPTCHA and rate limits to deter scraping, and the policy prohibits automated queries and bulk access. You can see for yourself with the WHOIS lookup.
The Licensing Rules say applicants must not use a proxy or privacy service to apply, and the registrant warrants that it is not using one. In other words, auDA wants the real, eligible registrant on the record, because eligibility (an ABN, a company, a trade mark) is the whole point of the namespace.
Registrars that sell "ID protection" on other extensions say plainly that it does not exist for .au. VentraIP's help page says AU namespace policy prevents WHOIS details from being hidden, and that its protection is offered only where the extension supports it. If a seller offers you a privacy add-on on a .com.au name, ask exactly what it does before paying. Our general guide to domain privacy explains how it works on extensions where it is allowed.
On 18 June 2026 auDA said that in limited cases personal information of registrants had been visible on the public WHOIS. The cause, it said, was inadvertent entry of information during registration into fields meant for public business details. An initial review found about 100 cases where entries matched the format of government-issued identifiers or were a postal address. The fields affected were Registrant ID, Registrant Name, Eligibility ID and Eligibility Name.
auDA removed the identified information from public view, said it was contacting affected registrants, engaged registrars, notified the Office of the Australian Information Commissioner and began a review of its policies and processes. It also said support through IDCARE was available to impacted registrants. As of that statement the review was at an early stage.
Treat the ID and name fields as public business identifiers only. Use your ABN or ACN, not a driver licence or passport number, and use a business name, not a home address. auDA's WHOIS Policy and its Licensing Rules Review both point towards role-based contacts rather than personal details, so a role address such as accounts or admin at your business domain is a sensible choice for the registrant email. Check the current policy wording for the exact requirement.
If you think personal information is showing, contact your registrar first, since registrars and resellers are responsible for validating eligibility, and then auDA. Our guide to the Australian Privacy Principles covers the wider obligations if you handle customers' data on your website.
Possibly at the edges. auDA's Licensing Rules Review lists, among its recommendations, that role-based contacts, business addresses or PO boxes, and business phone numbers can be used in the WHOIS context. The board approved the recommendations in principle in August 2026, and draft rules are still to go to consultation, so nothing in this section is in force yet. This is general information, so confirm current rules with auDA.
Whatever the registrar, your domain only needs to point at your hosting. HostBible can move an existing site and email across for free, with a free SSL certificate included.
See website migration