Australian address data
An address lookup can reveal where your customers work
Review the information sent to lookup providers and stored in diagnostics. Address assistance should not quietly export access notes or unrelated customer details.
In this article
Draw the actual data path
List the fields sent as a person types, the provider that receives them and the logs created by your application. A search query can contain a home address, workplace or accidental free-text note before the user selects anything.
Send only what the lookup requires. Do not attach the customer name, account balance or internal job description for convenience. Separate access instructions from searchable address components so gate codes cannot become provider queries.
Review browser analytics and error capture as well as the main API. An input value can leak through a recorded event even when the address service itself receives a minimal request.
Restrict who can see each address role
A dispatcher may need the service location while a billing role needs the postal contact. Determine whether every user who can view the customer profile should also see private delivery or access notes.
Apply server-side authorisation to address retrieval and modification. Hiding a field in the interface does not prevent a client from requesting it directly.
Keep diagnostic exports narrow. A support investigation into missing unit numbers may need sanitised component structure rather than a full list of customer destinations.
Examine provider evidence and retention
Record the source and date of a match without assuming that a provider identifier grants unrestricted reuse of the underlying dataset. Review the selected service's terms, retention settings and permitted uses with the responsible owner.
G-NAF is a physical address reference with its own published licensing context. A postal validation service may have different capabilities and conditions. Treat them as distinct dependencies in the data inventory.
Define how long raw lookup queries and rejected candidates are retained. They can contain personal information even when no customer record is ultimately created.
Test changes across organisational boundaries
Use two synthetic organisations with similarly named sites. Attempt to fetch or update the other organisation's address by identifier. Verify that the server rejects the request and that cached suggestions do not expose private internal sites.
Also inspect shared-device form behaviour. A previous customer's address should not remain in a hidden field and be submitted for the next record. Clear the entire address state when its owning context changes.
Primary sources
Australian Government: G-NAF datasetReferences checked 11 September 2026.