Do we have to keep tenant and owner records accurate and up to date?

Q: What happens once someone tells us a record is wrong?

The duty shifts to APP 13 , which requires such steps (if any) as are reasonable in the circumstances to correct information that is inaccurate, out of date, incomplete, irrelevant or misleading, having regard to the purpose for which it is held . Under APP 13.1(b)(i) that duty runs on your own initiative once you are satisfied the record is wrong, not only when the individual asks. Under APP 13.2 , where you have corrected information you previously disclosed to another APP entity and the individual asks you to notify them, take such steps (if any) as are reasonable in the circumstances to do so unless it is impracticable or unlawful. A tenancy-database operator that trades in tenants' information sits outside the small-business exemption under s 6D(4)(c) or (d) , subject to the consent carve-outs in s 6D(7) and (8), so its turnover does not decide the question. A private landlord usually is not an APP entity, so notifying an owner is supported by APP 10.2 rather than compelled by APP 13.2. (APP 13, APP 13.1(b)(i), APP 13.2.)

You must take such steps (if any) as are reasonable in the circumstances. APP 10.1 applies to information you collect, requiring reasonable steps to ensure it is accurate, up to date and complete. APP 10.2 applies to information you use or disclose, adding that it must also be relevant, and judged having regard to the purpose of that use or disclosure. Neither limb is a guarantee of accuracy, and APP 10.2 is not a higher standard of care, it is the same reasonable-steps duty with a different content.

By Jon Oates, Founder of Privaproof · Last updated 26 July 2026 · Start the free 2-min audit →

General information, not legal advice. Your obligations depend on your circumstances.

Does this apply to your agency?

The Privacy Act binds “organisations”. An agency whose annual turnover for the previous financial year was more than A$3 million is one (ss 6C, 6D, 6DA). Turnover is the income the business itself earns in the course of carrying it on, so for an agency that is commission, management and letting fees and referral income. Rent you collect for a landlord and hold in trust is generally the landlord’s money passing through rather than your income, so a large rent roll does not by itself put you near the threshold. If it is close enough to decide the answer, check the figure with your accountant. Note also that once turnover has exceeded A$3 million in a financial year that has ended, the exemption does not return by later dropping below it (s 6D(4)(a)). A smaller agency is generally exempt, but is still covered if any of these apply: it provides AML/CTF designated services, i.e. brokering the sale, purchase or transfer of real estate (since 31 March 2026, for the personal information it handles in connection with those obligations, s 6E(1A)); it is related to a body corporate that is not a small business operator, such as a group or franchise entity (s 6D(9)); it operates a residential tenancy database (s 6E(2)); it is a contracted service provider under a Commonwealth contract (s 6D(4)(e)); it trades in personal information (s 6D(4)(c)–(d), subject to the consent and authorised-by-law carve-outs in s 6D(7)–(8)); or it has opted in (s 6EA). Merely listing a tenant on, or searching, someone else’s database does not automatically make you covered. Work out whether the Privacy Act applies to you. Privacy Act 1988 (Cth) ss 6C, 6D, 6DA, 6E.

Not sure it's you?

Does this apply to you?

Tap what's true for your agency. Nothing is saved.

We collect ID from buyers or sellers Our agency turns over under $3m We keep client records digitally We use a rent-roll or PM CRM

Tap what's true above to see where you stand.

Check the Kit against your setupA$539 / year incl GST · founding price, rising to A$649 on 1 Oct 2026

Orientation only, not a compliance assessment. General information and tools, not legal advice.

Does APP 10.2 set a higher standard once information leaves the office?

No. The standard is the same in both limbs: such steps (if any) as are reasonable in the circumstances. What changes is what those steps are measured against. Passing a stale arrears figure to a landlord, lodging a database listing from an unreconciled ledger, or issuing a notice to a former address is a use or disclosure, so APP 10.2 asks whether the information was relevant as well as accurate, up to date and complete, having regard to the purpose of that use or disclosure.

The untidy record is not free, because APP 13.1 engages once you are satisfied it is wrong. But acting on it is the moment that turns admin sloppiness into a compliance problem.

The habits that satisfy it are unglamorous. Reconcile before you report. Confirm contact details at renewal and each inspection cycle. Correct at the point the error is noticed rather than routing it to someone else. Make sure a correction in one system reaches the others.

What is reasonable scales with the consequences of the information being wrong, which is why tenancy-database and arrears data attract far more care than a marketing list.

Sources: Privacy Act 1988 (Cth), APP 10.1 and APP 10.2 (Schedule 1) · OAIC APP Guidelines chapter 10 · OAIC APP guidelines

What happens if we act on out-of-date information about a tenant or owner?

Acting on information you should have checked can be a failure to take reasonable steps under APP 10.2.

The scenarios repeat across the industry: a breach notice sent to a former address, a landlord told a tenant is in arrears when the payment had cleared, a database listing lodged from a ledger nobody reconciled, a rejection based on a superseded reference. Each is a use or disclosure of information that was not accurate at the moment it was relied on, and the harm lands on the person rather than on the file.

Build one check into the workflows where the consequence is highest. Before any notice, any landlord report and any external listing, confirm the record is current.

Where the error caused a disclosure to the wrong person, for example a notice containing personal information sent to a former address, consider whether the Notifiable Data Breaches scheme is engaged. Assess whether it is likely to result in serious harm. Section 26WH(2) requires a reasonable and expeditious assessment, and all reasonable steps to complete it within 30 days after you become aware there are reasonable grounds to suspect, so 30 days is the outer limit and not the schedule.

Sources: Privacy Act 1988 (Cth), APP 10.2 (Schedule 1) and s 26WH(2) · OAIC APP Guidelines chapter 10 · OAIC notifiable data breaches · See also data-breach response for real estate

Do we have to check that what a rental applicant tells us is actually true?

APP 10 is not a duty to investigate people, and it does not make you the guarantor of an applicant's honesty.

This is the misreading that pushes offices toward collecting more than they need, on the theory that accuracy requires verification and verification requires documents. It runs straight into APP 3.2, which bars an organisation from collecting personal information unless it is reasonably necessary for one or more of its functions or activities. The two reconcile easily: verify proportionately, using the least revealing evidence that answers the question, and record what you verified and when.

Where you cannot verify something, note that it is unverified rather than presenting it downstream as established fact. Passing an unverified claim to a landlord as though it had been checked is where APP 10.2 actually bites, because both relevance and purpose are in play at the moment of disclosure.

Reasonable steps scale with sensitivity and consequence, so identity and affordability warrant more care than a preferred move-in date.

Sources: Privacy Act 1988 (Cth), APP 3.2, APP 10.1 and APP 10.2 (Schedule 1) · OAIC APP Guidelines chapters 3 and 10 · OAIC APP guidelines

What happens once someone tells us a record is wrong?

The duty shifts to APP 13, which requires such steps (if any) as are reasonable in the circumstances to correct information that is inaccurate, out of date, incomplete, irrelevant or misleading, having regard to the purpose for which it is held. Under APP 13.1(b)(i) that duty runs on your own initiative once you are satisfied the record is wrong, not only when the individual asks.

Under APP 13.2, where you have corrected information you previously disclosed to another APP entity and the individual asks you to notify them, take such steps (if any) as are reasonable in the circumstances to do so unless it is impracticable or unlawful. A tenancy-database operator that trades in tenants' information sits outside the small-business exemption under s 6D(4)(c) or (d), subject to the consent carve-outs in s 6D(7) and (8), so its turnover does not decide the question. A private landlord usually is not an APP entity, so notifying an owner is supported by APP 10.2 rather than compelled by APP 13.2.

Sources: Privacy Act 1988 (Cth), APP 10.2, APP 13.1 and APP 13.2 (Schedule 1) · OAIC APP Guidelines chapters 10 and 13 · OAIC APP guidelines

→ When you correct a record in one system, does the correction reach the others? The free 2-minute audit scores how your agency handles access and correction requests, plus seven other checks across the Principles.