Nine Million Files: The ATO's Visa Data-Matching Program, Renewed to 2029

On 21 September 2026 the Commissioner of Taxation registered a notice in the Federal Register of Legislation announcing a visa data-matching program. The Australian Taxation Office will acquire visa data from the Department of Home Affairs for 2026–27, 2027–28 and 2028–29.

Not one line of that notice changes what you owe. It does not create a tax, alter a rate, add a return, or attach a condition to anybody's visa. Your obligations on 22 September were exactly what they were on 20 September.

What it changes is visibility. The ATO is telling the public, in advance and as the privacy guidelines require, that it will hold a structured record of who was on which visa, when, at what address, sponsored by whom, prepared by which migration agent, studying with which provider — and every time they crossed the border.

Stripped of everything else, the notice says five things:

1. The ATO will acquire visa data from Home Affairs for the 2026–27, 2027–28 and 2028–29 financial years.
2. It estimates records relating to approximately 9 million individuals will be obtained each financial year.
3. Eleven categories of data are listed — identity, address and contact history, visa history and status, travel movements, sponsor details, migration agent details and education providers.
4. The stated purpose is tax and superannuation compliance, including ABN integrity and support for foreign investment compliance.
5. The program follows the Privacy Act 1988 and the Information Commissioner's 2014 data-matching guidelines, with a protocol published at ato.gov.au/dmprotocols.

This is a continuation, not an invention. The previous notice covered 2023–24 to 2025–26 and carried the same approximate nine-million figure. What the September 2026 notice does is extend the field of view to 30 June 2029.

The notice lists eleven categories, reproduced below in the order it gives them, each with a plain reading of what it means in practice.

Items transcribed from Government Notices Gazette C2026G00617, registered 21 September 2026.

Most coverage of data-matching programs stops at the person whose data is collected. This notice does not. It names three populations: the people who hold visas, the businesses that sponsor them, and the agents who prepare the applications.

That reframes what the dataset is for. It is not only a list of temporary residents to check against tax returns. It is a structure that lets the ATO look at a sponsor across all of its sponsored workers, or at an adviser across all of their clients, and ask whether a pattern is present.

For our own profession it is a plain statement of fact: registered migration agents are inside the dataset by name, address, contact history and client list.

The notice sets out nine objectives. Most are the language you would expect from a revenue agency describing its own risk work — reporting obligations, voluntary compliance, risk models, treatment strategies, fraud detection. Two carry a harder edge for temporary residents.

Data-matching notices attract a particular kind of commentary. Five things this notice does not say:

• It is not a visa crackdown. The data moves from Home Affairs to the ATO, and the objectives are tax, super, ABN integrity and foreign investment compliance. The notice announces no migration consequence.
• A tax problem does not cancel your visa. Nothing in the notice says that. Visa conditions and cancellation powers sit in the Migration Act 1958 and the Migration Regulations 1994 and are administered by Home Affairs. If you are worried about how a tax matter interacts with your visa, that is a migration question — see our refusal and risk guidance.
• It is not new law. There is no commencement, no transitional rule and nothing to comply with.
• It does not only affect people doing something wrong. The overwhelming majority of the nine million records will describe people whose affairs are entirely in order.
• It is not general surveillance. Eleven categories of visa data, conducted under the Privacy Act 1988 and the Australian Privacy Principles.

A matching program only produces something to look at where two records describe the same fact differently. These are the divergences that come up most often in a migration practice — none of them wrongdoing, all worth knowing about.

• Your address with Home Affairs vs with the ATO. People update one and not the other, sometimes for years. The two agencies do not update each other. An unanswered letter is a worse position than an answered one.
• The dates you remember vs the dates on the record. Tax residency is not decided by a visa label, but day counts feed the analysis — and the day count is no longer yours to estimate.
• The nominated salary vs what was actually paid. This is the real crossover point for sponsors: where what an employer undertook in a nomination and what reached the employee diverge, two separate frameworks are engaged. See our 482 sponsorship guide.
• An ABN you hold vs an ABN you use. Resolve a dormant one deliberately rather than leaving it to be resolved for you.
• The provider on your visa vs where you actually studied. Course and provider changes are ordinary and lawful — but the intended provider on the record and the actual one can differ. Relevant if you are mapping a student-to-PR pathway.

The notice states the program follows the Office of the Australian Information Commissioner's Guidelines on data matching in Australian Government administration (2014), which set standards for using data matching in a way that complies with the Australian Privacy Principles and the Privacy Act 1988.

The gazette notice does not set out how long data is kept, how records are matched, or what happens when a discrepancy is found. Those sit in the ATO's published protocol. The protocol published for the previous cycle described a five-year retention period — confirm the current position at ato.gov.au/dmprotocols rather than relying on a figure quoted in an article, including this one.

The ATO's privacy policy at ato.gov.au/privacy covers how personal information is handled, how to seek access to it and how to complain.

Primary sources

• Gazette notice C2026G00617 — Commissioner of Taxation, Notice of a visa data-matching program, registered 21 September 2026.
• ATO data-matching protocols — ato.gov.au/dmprotocols (matching methodology and retention).
• ATO privacy policy — ato.gov.au/privacy.
• Privacy Act 1988 (Cth) and the Australian Privacy Principles.
• OAIC — Guidelines on data matching in Australian Government administration (2014).

This article provides general information about an Australian Government data-matching program and its relevance to visa holders, sponsors and advisers. It is not tax advice and it is not migration advice for any particular person. Global Migrations is a registered migration practice; we are not registered tax agents. Data-matching protocols, administrative practice and the underlying law can change. Where a matter may affect a visa application or a sponsorship obligation, obtain migration advice on your own facts before acting.