Privacy guides for Australian real-estate agencies
Every guide we publish on the Privacy Act as it applies to real-estate work, 57 in all, grouped by what you are trying to sort out. Plain English, written for agencies, kept current as the law moves.
Start here
- Does the Privacy Act apply to real estate agents in Australia?The A$3m small-business exemption, when it falls away, and how AML Tranche 2 pulls sales agencies in. Check if you're covered in 2 minutes, free.
- Privacy Act compliance for Australian real-estate agencies: the 2026 guideWhat Australian agencies must do under the Privacy Act in 2026: obligations, what changed, penalties, and a free 2-minute check of where you stand.
Collection notices
- AML Collection Notice for Real Estate: What to Tell Customers When You Collect IDFrom 1 July 2026 the ID you collect for AML falls under the Privacy Act. What your APP 5 AML onboarding notice must tell customers, plus the pitfalls.
- Collection notices for real estate agencies: what APP 5 actually requiresA collection notice is the APP 5 statement you give people when you collect their information. What a real-estate agency's notice must include, and when.
- Do real estate agents need a privacy policy and a collection notice?Why real estate agencies need both an APP 1 privacy policy and an APP 5 collection notice, what each must contain, and the gaps agencies miss.
- Website Enquiry Privacy Notice for Real Estate: What APP 5 RequiresWhat your online enquiry and contact form privacy notice must say under APP 5, plus the lead-form pitfalls the OAIC looks for in real estate.
- Open Home Sign-In: What Your Privacy Notice Must Say (APP 5)The open-home sign-in sheet is a key collection point. What an APP 5 privacy notice must tell attendees, and the pitfalls to avoid.
- Reception Collection Notice: What Your Front Desk Must Tell PeopleWhat an APP 5 collection notice at your office reception must cover for walk-in enquiries, plus the common pitfalls that trip up real estate agencies.
- Tenancy Application Collection Notice: What Your Rental Application Must Tell ApplicantsA tenancy application collects ID, income and references. What your APP 5 rental application notice must tell applicants, plus the pitfalls.
Marketing and photography
- Texting or emailing open-home visitors: the consent you needSigning in to enter a property is not consent to be marketed to. Texts and emails are the same question under the Spam Act, and there is no bulk exemption.
- Cold-calling property owners: the Do Not Call Register rulesProspecting calls to owners found on a title search are governed by the Do Not Call Register Act. Wash your list first, and the exceptions.
- Direct marketing and privacy for real-estate agencies: APP 7 and the Spam ActCan a real-estate agency email or text past clients? How APP 7 and the Spam Act 2003 stack up: consent, opt-out and unsubscribe rules explained.
- Marketing to a database you bought or inherited with a rent rollConsent does not transfer with the data, and paying to collect personal information can cost a small business its exemption under s 6D(4)(d).
- Can we market to tenants using details collected for their lease?Details a tenant gave for their lease are not consent to market other properties. What APP 6 and the Spam Act allow, and what needs fresh consent.
- Do we need the tenant's consent to photograph an occupied rental?Entry is the easy part. The limb offices miss: an inspection or condition-report photo needs the renter's written consent before it can be used in advertising.
The principles, one by one
- The 13 Australian Privacy Principles: what each one means for a real-estate agencyAll 13 Australian Privacy Principles in plain English, mapped to what each one means in a real-estate agency: applications, open homes and the CRM.
- Keeping tenant and owner records accurate: what APP 10 requiresAPP 10.1 asks for reasonable steps to keep what you collect accurate. APP 10.2 adds relevance when you use or disclose it. Neither limb is a guarantee.
- Anonymity and pseudonyms: when a real-estate business can require a name (APP 2)APP 2 lets people deal with you anonymously or by pseudonym, unless that is impracticable or a law requires ID. When you can insist, and cannot.
- Government identifiers in a real-estate business: licence numbers, Medicare and TFNs (APP 9)APP 9 generally stops an agency adopting a licence or Medicare number as its own file key. What that means for your CRM, and the exceptions.
- Information you did not ask for: APP 4 for a real-estate businessAn applicant sends documents you never asked for. APP 4 makes you decide whether you could have collected them, and destroy them if not.
- What a real estate agent can legally ask for on a rental applicationWhat an agent can lawfully collect on a rental application under APP 3.2, and the fields the OAIC found were not reasonably necessary.
- Who can a real-estate business share tenant and client information with? (APP 6)APP 6 limits you to the purpose the information was collected for. Who you can pass tenant and owner details to, and when consent is needed.
AML/CTF and privacy
- AML/CTF for real estate agents: your 2026 action checklist (and the privacy trap)Since 1 July 2026 agencies are AUSTRAC reporting entities. The checklist: enrol, verify ID, report, keep records, plus the privacy trap.
- What the 1 July 2026 AML/CTF (Tranche 2) changes mean for real estate agentsProperty-sales agencies are now AUSTRAC reporting entities, and the customer-ID data you collect brings Privacy Act duties too. What to do, plainly.
- Does AML compliance cover your privacy obligations? (real-estate agencies)No. From 1 July 2026 the ID data you collect for AML falls under the Privacy Act, even under $3m turnover. What that means, and what to do.
- What do I do with the ID documents AUSTRAC makes me collect? (the privacy side)The AML ID documents you collect fall under the Privacy Act. Four things to do: collection notice, secure storage, retention, breach plan.
Tenancy databases
- A tenant says their tenancy-database listing is wrong: what the agency must doState tenancy law sets the real clock. Notify the database operator within 7 days of becoming aware, well inside the 30 days APP 13 usually allows.
- How to fix your rental application form after the 2Apply decisionThe 2Apply decision found excessive, unfairly-collected data under APP 3.2 and 3.5. How to fix your rental application form and its framing.
- Can we list a defaulting tenant on a tenancy database?The listing conditions come from your state's tenancies Act, not the Privacy Act. Using a database does not make you covered; operating one does.
Data breaches
- Data-breach response plans for real estate agencies: what the NDB scheme requiresWhat the Notifiable Data Breaches scheme requires of Australian real-estate agencies, and how to build a data-breach response plan. Plain-English guide.
- What are the penalties for a privacy breach for a real estate agency?Penalties for a real-estate privacy breach: what the Privacy Act maximum actually is, realistic OAIC outcomes, notification duties and the right to sue.
Keeping and deleting
- Tenant access requests: what a real-estate agency must hand over (APP 12)A tenant can ask for the personal information you hold about them. APP 12.1 requires access, and refusal is limited to the ten grounds in APP 12.3.
- Can a real-estate agency refuse a tenant's access request? (APP 12.3)Refusal is limited to the ten grounds in APP 12.3, and only so far as a ground applies. APP 12.9 requires written reasons and a way to complain.
- Can a landlord see the personal information an agency holds about their tenant?Not under APP 12, which gives people access to their own information only. Sharing tenant information with the landlord is a separate APP 6 question.
- Data security for a small real-estate business: what APP 11.1 actually asksAPP 11.1 asks for reasonable steps, not enterprise security. The practical minimum for a small agency: access control, cloud storage, staff.
- How long should a real-estate agency keep personal information? (retention & destruction, APP 11)How long a real-estate agency keeps personal information: APP 11 retention and destruction, the AML 7-year record rule, and how the two reconcile.
- How long does a real-estate agency have to answer a tenant's access request?The hard 30-day deadline applies to Commonwealth agencies. A real-estate agency is an organisation under APP 12.4(a)(ii) and owes a reasonable period.
Overseas and vendors
- Does putting tenant or vendor details into an AI tool send their information overseas?Putting tenant or vendor details into an AI tool can be an overseas disclosure under APP 8. When it applies, and the reasonable steps to take and show.
- Offshore VAs and overseas staff: privacy obligations for a real-estate business (APP 8)Whether APP 8 applies turns on two things people skip: is the overseas person a separate entity, and is this a disclosure or a use of the information.
- Overseas disclosure and offshore CRMs: APP 8 for real-estate agenciesIs your real-estate CRM hosted overseas? How APP 8 cross-border disclosure applies, the AML identity-data carve-in (s 6E), and what your agency must do.
Deadlines and changes
- From 10 December 2026, must a real-estate agency's privacy policy disclose automated decision-making?From 10 December 2026, APP 1.7 requires real-estate privacy policies to disclose automated decision-making, like automated tenancy screening. What to do.
- The OAIC's 2026 privacy sweep: what it checked, and what your policy needs nowThe OAIC's 2026 sweep assessed privacy policies against APP 1.4 and named rental and property a target sector. What it checked, and what yours needs.
- The privacy and AML compliance calendar for Australian real-estate agencies (2025–2026)The dated privacy and AML compliance calendar for Australian real-estate agencies: the 2025 tort, 1 July 2026 AML Tranche 2, and the 10 Dec 2026 ADM rule.
- The 2026 privacy & AML obligations map for Australian real-estate agenciesEvery Privacy Act and AML/CTF obligation an Australian real-estate agency meets in 2026, mapped in one table. General information only.
- What must your privacy policy contain? The APP 1.4 checklistAPP 1.4 sets what a privacy policy must state: what you collect, how and why, access, correction, complaints and overseas disclosure. Item by item.
Costs and comparisons
- What's the cheapest way for a real estate agency to get privacy-compliant in 2026?The lowest-cost route for an agency in 2026: free OAIC and AUSTRAC tools, digital open-home sign-in, and when a paid kit is worth it.
- Do I need a privacy lawyer for my real estate agency, or is a template kit enough?Most agencies do not hire a lawyer for standard privacy documents; a Kit whose documents are solicitor-reviewed is usually enough.
- Are free privacy policy templates enough for a real estate agency?A good free template is a valid starting point, but it is not written for real estate and does not update. Where that leaves agencies exposed.
More guides
- Correcting a tenant's personal information: what APP 13 requires of an agencyAPP 13.1 has two triggers and a request is only one of them. The duty also arises when you are satisfied the information is wrong. Correction is free.
- Can a real-estate business keep a copy of a tenant's driver licence or passport?APP 11.2 points toward destruction once the purpose has passed. Queensland requires an unsuccessful applicant's information destroyed within 3 months.
- Privacy Act compliance checklist for property managersAn 8-point Privacy Act checklist for property managers, each mapped to the Australian Privacy Principles. Score your agency in 2 minutes.
- The privacy compliance kit for Australian real-estate agenciesWhat a real-estate privacy compliance kit is, what it contains, and why its fourteen solicitor-reviewed documents beat a free template. Plain-English guide.
- Kept current: the Privaproof privacy Kit update logOur public, dated changelog of the Privaproof Kit: what version is current, and what we update as Australian privacy law changes.
- Privacy policy subscription for Australian real estate: why 'kept current' mattersWhy a privacy policy needs keeping current as the law changes, and how a maintained subscription differs from a one-off template for an Australian agency.
- Selling a rent roll: what you can do with the tenant and landlord dataThe sale is a disclosure, so APP 6 governs it. What the buyer may then do with tenant and landlord information is limited by why it was collected.
- Destroying tenant records securely: what APP 11.2 expectsAPP 11.2 asks for reasonable steps to destroy or de-identify personal information once you no longer need it, unless a law requires you to keep it.
- When does a real-estate agency actually need consent? (APP 3, APP 6, sensitive information)When agencies need consent vs a collection notice: sensitive information, secondary use (APP 6) and marketing. Plain-English guide for real estate.