How to remove your personal information from the internet (Australia)

Your personal information sits in several different places, each needing a different removal method:

• Search results. Google indexing a page that shows your phone number, address or old photos.
• Data broker and people-search sites. Companies that compile public records into a profile page about you.
• Social media. Your own posts and profile fields, visible more widely than you intend.
• Old accounts. Logins you have forgotten, still holding your name, email and sometimes payment details.
• Breached data already circulating.Copies of your details from a past data breach, which may already be on forums or marketplaces outside anyone's control.

Trying to solve all five with one action is why these searches usually end in frustration. Work through them one at a time, starting with the fastest result: Google.

Google does not host most of the pages that expose you, it just indexes them, but it can remove specific results from search even when it cannot take down the original page. Expect 10 to 20 minutes to submit, and days to weeks for Google to process.

1. Use “Results about You”. Go to myactivity.google.com/results-about-you, sign in, enter your name and details, and Google surfaces matching results with a request-removal option.
2. Or remove a specific result from a search.Search your own name, click the three-dot “More” menu next to the result, choose “Remove result”, then “It shows my personal info”, and select the info type.
3. Know what qualifies. Google acts on contact details you do not control, such as phone, address, email, ID numbers and images. It generally will not remove government, court or news content, which is treated as public-interest information.
4. Check status. Requests show as in progress, approved or denied on your Results about You page.

In the US, data-broker removal is a big business because people-search sites (Whitepages, Spokeo, BeenVerified and similar) legally scrape public records at scale and resell profiles. Australia's Privacy Act 1988 means we never built the same ecosystem, and there is not a large, established list of Australian-specific people-search sites to work through. That is worth knowing before paying a US subscription service to solve a problem that mostly does not exist here in the same form.

What you should still check and action:

1. Search your own name plus city in a private or incognito window. Old directory listings, business registrations (ABN Lookup, ASIC), forum profiles and cached social posts are the common Australian equivalents.
2. Use each business's own opt-out process where one exists. Legitimate Australian directories provide one, since the Privacy Act requires a way to request correction or deletion.
3. Send an APP 12/13 request (below) to any site with no visible opt-out. This is a legal right, not a favour.
4. Be sceptical of paid broker-removal tools marketed to Australians. Several are built for the US market and do not clearly cover Australian data, so check current coverage before paying. Our round-up of the best digital footprint management tools in Australia covers what these tools actually do.

This is the part worth being straight about. If your email, password or other details were already exposed in a data breach and copied onto forums, marketplaces, or the parts of the internet search engines do not reach, there is no service, free or paid, that can delete that copy. Nobody controls it, so nobody can take it down. Any product promising to remove your data from the dark web is describing monitoring, telling you it is there, not removal.

Since deletion is not on the table, the realistic response is to make the leaked data useless:

1. Change the password on the breached account, and anywhere else you reused it. This is the single highest-impact step. It closes the door the leak opened, even though the leaked copy still exists somewhere.
2. Turn on multi-factor authentication (MFA) on your email and any financial accounts. Even if a password leaks again in future, MFA stops it being enough on its own.
3. Place a credit ban if ID numbers (driver's licence, Medicare, passport) were exposed. In Australia, apply through Equifax or Experian, and one application can flow through to other credit reporting bodies. A ban runs for 21 days initially, and you can extend it to 12 months if you are a confirmed or likely fraud target, per IDCare's credit ban fact sheet.
4. Call IDCare on 1800 595 160if you suspect identity theft, not just an exposed account. They are Australia's national identity and cyber support service and will walk you through next steps for free.
5. Report scams or misuse of your details to Scamwatch, and lodge a complaint with the OAIC if a business mishandled your data under its Notifiable Data Breaches obligations.

For the full response sequence, see what to do if your email is in a data breach, and how to secure your email after a data breach for locking down the inbox itself.

This is the section that costs nothing but time. Run through it in order:

1. Find what is out there first. Use our guide to find accounts linked to your email so you are working from a real list, not memory. The same approach for your mobile is in find accounts linked to your phone number.
2. Run a free breach check against your email address to see if any data is already circulating.
3. Remove exposed contact details from Google using the Results about You process above.
4. Lock down social media privacy. Set profiles to private, remove birth date, phone number and workplace from public fields, and review old public posts on Facebook, Instagram, LinkedIn and X.
5. Delete accounts you no longer use, especially anything caught in a breach or holding payment details. See how to delete old accounts for the method and a request template.
6. Send APP 12/13 requests to any remaining business holding data you want gone (below).
7. Re-check every few months. Removal is not permanent, listings and cached pages reappear. The digital footprint checklist is a good recurring audit.

The Privacy Act 1988 gives you two relevant rights when dealing with any Australian business or government agency covered by it:

• APP 12 (Access). You can ask an organisation what personal information it holds about you, and it generally must respond within a reasonable period, usually without charge for the request itself.
• APP 13 (Correction). You can ask it to correct inaccurate, out-of-date, incomplete or misleading information, and where it no longer has a legitimate reason to hold your data, ask it to delete or de-identify it under APP 11.2.

In practice: email the company's privacy contact, state that you are making an APP 12/13 request, specify what you want (a copy, correction, or deletion), and give a reasonable timeframe. If refused without a lawful reason, escalate to the OAIC. If you are not sure what a given company is likely to be holding, what personal data companies store about you is a useful starting point.

In The Event Of is built around turning scattered account records into a single map. You can connect a supported inbox (Gmail or Outlook) so it can scan for account-related metadata, sender addresses, subject lines and timestamps rather than the body of your emails, or add services manually. It then organises what it finds into a digital footprint, highlights breach exposure, and gives you guided steps for each account, which is exactly the working list this removal checklist needs. It does not delete data on your behalf, and it cannot remove anything already circulating from a past breach. You stay in control of every change.