Am I covered? Does the Privacy Act apply to your agency?
Four quick questions and you will know where your agency stands.
Answer it yourself in four steps
The interactive version of this check needs JavaScript, and it has not loaded. The same four questions, with the same answers, are written out in full further down this page. Nothing is missing: the interactive tool is only a faster way through the identical logic.
General information to help you find your position, not legal advice. This tool reflects the answers you give. It is a free guide, not one of the solicitor-reviewed documents in the Kit, and it does not account for every circumstance, so confirm your position before you rely on it. It covers the Privacy Act 1988 (Cth), the small-business exemption (ss 6C to 6E), and the AML/CTF Tranche 2 changes commencing 1 July 2026. Current as at 2 August 2026.
The short answer
The Privacy Act applies to an Australian real-estate agency if any of the following is true. Its annual turnover has been over A$3 million in a financial year that has ended, counting the income the agency itself earns, so commission, management and letting fees and referral income, but not the gross rent it collects into its trust account for landlords, and excluding capital gains. Another small-business exception applies, such as being a related body corporate of a company that is not a small business, trading in personal information, holding a Commonwealth contract or subcontract, operating a residential tenancy database, being a credit reporting body, or opting in. Or the agency does property-sales work, which since 1 July 2026 makes it an AML/CTF reporting entity, in which case the Act applies to the personal information it handles for that work whatever its turnover. If none apply and turnover has never exceeded A$3 million, the small-business exemption still covers the agency. That exemption remains law; its removal has been proposed but is not in force.
Same logic on a flow chart
Where to go from here
The fourteen documents themselves: privacy policy, collection notices, retention schedule, breach plan. Written for real-estate operations and kept current as the law changes.
A different question. This page tells you whether the Act applies. The audit tells you where you stand: eight questions about what your agency already has, scored against eight Privacy Principles plus the breach scheme, with the gaps named in the order worth fixing. Free, no email to start.
The same logic, written out step by step
Start Does your agency handle personal information about people?
Buyers, vendors, tenants, landlords, referees, identity documents, CRM leads.
1 Has annual turnover ever been over $3 million in a financial year?
Any year since 2002, not just last year. Count the fees the agency earns. Rent you hold in trust is generally the landlord's money, so if it is close, check the figure with your accountant. Exclude capital gains.
2 Does any other small-business exception apply?
Being a related body corporate of a company that is not a small business (a franchisee alone is not enough), trading in personal information such as buying a lead list without consent, a Commonwealth contract or subcontract, operating a residential tenancy database, being a credit reporting body, opting in, or being prescribed.
3 Do you do property sales work?
Acting for a buyer or a seller. Leasing and property management on their own are not caught: a lease of thirty years or less is not real estate for this purpose.
The four things that decide it
1. Turnover, and it is a one-way door
A business is not a small business operator if it has had an annual turnover of more than A$3 million for a financial year that has ended. Not last year. Any year, back to the provision commencing in December 2001. Nothing in the section restores the exemption once that has happened, so dropping back under the threshold does not bring it back. The regulator asks the question the same way: has your small business had an annual turnover of more than $3,000,000 in any financial year since 2002?
The limit worth knowing: it attaches to the business that had the turnover, and runs while that business is carried on. A genuinely new entity carrying on a genuinely new business is assessed on its own turnover. It does not mean you can never restructure.
2. What counts as turnover, which is where most agencies go wrong
Annual turnover is the total of the listed kinds of income earned in the year in the course of the business. Rent, leasing and hiring income is on that list, which is why this is so often misread. The words doing the work are “earned in the course of the business”.
Rent you collect for a landlord and hold in trust is not earned by your agency. It is the landlord’s money passing through. What your agency earns is the commission and the management fee. So a rent roll moving A$4 million a year might represent a couple of hundred thousand in agency income and sit well under the threshold. The listed category catches rent an agency earns as lessor in its own right, owning the property rather than managing someone else’s.
Said honestly: nothing in the Act deals expressly with money held on trust or as agent. The reading rests on the word “earned”, and there is no case law on the point. If your rent roll is large enough that this decides your answer, get the figure from your accountant rather than from a web page.
3. The exceptions that remove the exemption whatever your size
Some things take small-business status away outright, which means the whole agency is covered rather than one slice of it. Disclosing or collecting personal information in a way that counts as trading in it is one, unless the person consented or a law required or authorised it. That second limb matters in real estate, because State tenancy legislation authorising a database listing sits inside it.
Others: being a contracted service provider under a Commonwealth contract, which reaches subcontractors and not only parties to the contract; being related to a body corporate that is not a small business, where “related” carries its Corporations Act meaning and runs in every direction, so being the parent of a large subsidiary counts as much as being owned by one; operating a residential tenancy database; being a credit reporting body; and choosing to opt in.
Two companies that merely share the same individual owner are not related for this purpose. A person is not a body corporate, so common personal ownership does not aggregate.
4. Sales work, since 1 July 2026
An agency that brokers the sale, purchase or transfer of real estate is a reporting entity under the anti-money-laundering rules, and must carry out customer due diligence on both parties. The Privacy Act then applies to the activities carried on for those obligations. That is wider than the identity documents: the beneficial-ownership and screening checks, and the customer risk assessment you are required to keep, are all inside it.
It does not reach the rest of the agency. “Real estate” excludes a leasehold of thirty years or less, so ordinary residential and commercial leasing is not a designated service at all. A rentals-only agency is outside this trigger entirely.
One thing worth knowing even if you are exempt
The statutory tort of serious invasion of privacy gives an individual a cause of action against “another person”. It is not limited to entities covered by the Australian Privacy Principles. Being outside the APPs is not the same as being beyond reach, and the exemption does not answer what happens when a tenant asks for access to their personal information, or a spreadsheet of landlord details goes to the wrong address.
Where to go next
This page answers whether the Act reaches you. If you want the fuller explanation of how the exemption works and where it came from, read Does the Privacy Act apply to real-estate agents? If you already know you are covered and want to see where your gaps are, the free two-minute self-audit scores your paperwork against the Principles. For the money-laundering side specifically, see AML/CTF Tranche 2 for real estate agents.
General information and tools, not legal advice. Privaproof is not a law practice. Whether the Privacy Act applies to your business depends on your turnover, your structure and the services you provide.
We add one to a daily tally of how many people reach each of the five results, so we can see which situations bring people here. That tally is the only thing recorded: no email, no cookie, no account, nothing tied to you or your device.