The ATO isn't collecting more data. It's connecting it more effectively — and it has been doing so, quietly and systematically, for years.
What "Data Matching" Actually Means
Data matching is the process of comparing two or more sets of data — usually information the ATO has received from a third party, and information a taxpayer has reported themselves — to look for discrepancies. The ATO doesn't need to open an audit to do this. The comparison happens automatically, at scale, once the data has been collected and validated.
Each large-scale data collection the ATO runs sits under its own published protocol, setting out the legal authority for the collection (generally a formal notice under section 353-10 of the Taxation Administration Act 1953), what data will be collected, from which providers, and how it will be used. These protocols are publicly available and are notified through the Commonwealth Gazette in line with guidance from the Office of the Australian Information Commissioner.
Where the Data Comes From
The range of third-party sources feeding into the ATO's systems is broader than most taxpayers expect:
- Banks and financial institutions — interest income, loan details, and account holder information, extended since 2013 to cover investment accounts and term deposits
- State and territory land title offices — every property purchase, sale, and transfer
- Motor vehicle registries — vehicle registration and transfer data, used to help identify people who aren't participating in the tax and super systems
- Insurers — data on high-value assets such as cars, boats, and artwork, used to check that declared income is consistent with what a taxpayer actually owns
- Digital platforms and online marketplaces — income earned through online selling and the sharing economy
- Cryptocurrency exchanges — crypto asset transaction data
- Property management software providers and rental bond authorities — rent, expenses, and tenancy data for investment properties
- Government payment agencies — data matched against income support and other government payments
Each of these sits under its own protocol and its own schedule — some run for a single financial year, others (like the property-related programs) span several years at once. Property is a good example of how layered this can get: see our related articles on the property management data-matching program protocol and the ATO's broader property data-matching program.
How the ATO Matches Data to You
Getting a data match right depends on getting the identity match right first. The ATO uses more than 60 identity-matching techniques, drawing on identifiers such as tax file number, name, and date of birth to link a piece of third-party data to the correct taxpayer. Once a match is made, the record is appended with an ATO identifier and a three-character outcome code that indicates how confident the system is in that match — not every match is treated as certain, and low-confidence matches are handled differently to high-confidence ones.
Data quality matters here too. Information from a third-party provider's own systems isn't always in a format the ATO can process directly, so extra layers of scrutiny and analytics are applied to validate the data before it's matched against a taxpayer's return.
If a data match doesn't align with what you've lodged, the ATO's letter is usually the first sign — not a warning that arrives before the fact. A records review now costs far less than untangling a discrepancy later.
Book a Free Consultation →What Happens When the ATO Finds a Discrepancy
Where a discrepancy needs verification, the ATO will typically contact the taxpayer directly — by phone, letter, or email — and allow up to 28 days to respond before taking any administrative action. Where it looks like income may not have been reported, but there's a chance it was reported under someone else's return (a common co-ownership issue, for example), taxpayers are generally given the opportunity to clarify the position first. That's the procedural fairness built into the process — it is not designed to assess first and ask questions later, but the response window is real and worth acting on promptly.
Your Privacy Protections
Data-matching activity is not unconstrained. It operates within the Privacy Act 1988 and the strict secrecy provisions found in the Income Tax Assessment Act 1936, the Taxation Administration Act 1953, and other tax laws. ATO staff are prohibited from accessing, recording, or disclosing a person's tax information except in the performance of their official duties, and each specific data-matching program is required to be publicly notified before it runs.
Why This Matters for Your Records
The practical takeaway is simple: the ATO very likely already holds data relevant to your return before you lodge it. Rental income, bank interest, property transactions, crypto disposals, and high-value asset purchases are all points where third-party data and self-reported figures are compared, sometimes years after the event. Keeping contemporaneous records — not reconstructing them after a letter arrives — is the most reliable way to make sure your position holds up when it's checked.
How Phan Campbell & Associates Can Help
At Phan Campbell & Associates in Footscray, our accounting team helps clients across Melbourne and Victoria understand what data the ATO is likely to hold about their affairs, and reviews positions before — not after — a data-matching letter arrives.
If you've already received a letter referencing a discrepancy, our combined legal and accounting team can review the position, draft a response, and manage a voluntary disclosure where one is warranted.
Selling or developing property? Our related article on GST and residential property covers the margin scheme and settlement withholding rules the ATO checks against.
Frequently Asked Questions
1. What third-party data does the ATO collect?
The ATO receives data from banks and financial institutions, state and territory land title offices, motor vehicle registries, insurers, digital platforms and online marketplaces, cryptocurrency exchanges, property management software providers, rental bond authorities, and government payment agencies, among other sources.
2. How does the ATO match data to the right person?
The ATO uses more than 60 identity-matching techniques, using identifiers such as tax file number, name, and date of birth to link data to the correct taxpayer. Each matched record is appended with an ATO identifier and a confidence code showing how strong the match is.
3. What happens if the ATO finds a discrepancy?
Where a discrepancy needs verification, the ATO will usually contact the taxpayer by phone, letter, or email and allow up to 28 days to respond before taking administrative action. Taxpayers are generally given an opportunity to explain the discrepancy before any adjustment is made, consistent with procedural fairness.
4. Is my data protected once the ATO has it?
Yes. Data-matching activity is subject to the Privacy Act 1988 and the secrecy provisions in tax legislation, including the Income Tax Assessment Act 1936 and the Taxation Administration Act 1953. ATO staff are prohibited from accessing, recording, or disclosing taxpayer information except in the course of their duties.