Can someone deal with a real-estate business anonymously or under a pseudonym?

Q: When can we require someone to identify themselves?

Whenever one of the two exceptions in APP 2.2 applies, and in a real-estate business they apply more often than the principle's reputation suggests. APP 2.2(a): an Australian law or a court or tribunal order requires you to deal with identified individuals. The clearest current example is AML/CTF customer due diligence on the property sales side, where you are required to identify and verify the customer. Ordinary leasing and property management are not designated services, so this limb does not reach them. APP 2.2(b): it is impracticable to deal with an unidentified person. This is the one that does the everyday work. You cannot assess a tenancy application from an anonymous applicant, because you cannot verify income, contact referees, run the checks or enter into a lease with someone whose identity you do not know. You cannot manage a tenancy, hold a bond or serve a notice anonymously either. Note the shape of the test. Impracticable is a higher bar than inconvenient, and it is judged against the particular matter , not against your whole business. "We prefer to know who we are talking to" is a preference. "We cannot perform this function at all without knowing" is impracticabil

Q: Does APP 2 mean we have to let people stay anonymous through a whole tenancy?

No. APP 2.1 gives the option in relation to a particular matter , so it is assessed transaction by transaction rather than as a status somebody keeps. That is why the same person can legitimately be anonymous at one stage and identified at the next. An anonymous enquiry about rent is one matter. Submitting an application is a different matter, where impracticability under APP 2.2(b) plainly applies. Signing a lease is another again. What you cannot do is use the later requirement to backfill the earlier one, for example refusing to answer a price question until someone registers, on the basis that they would have to identify themselves eventually if they applied.

APP 2.1 gives individuals the option of not identifying themselves, or of using a pseudonym, when dealing with you about a particular matter. It is an option for them, not an absolute right, and APP 2.2 switches it off in two situations: where an Australian law or a court or tribunal order requires you to deal with identified individuals, or where it is impracticable for you to deal with someone who has not identified themselves. So you can require identification where you genuinely need it, and the everyday anonymous case is the casual enquiry about price or availability.

By Jon Oates, Founder of Privaproof · Last updated 27 July 2026 · Start the free 2-min audit →

General information, not legal advice. Your obligations depend on your circumstances.

Does this apply to your agency?

The Privacy Act binds “organisations”. An agency whose annual turnover for the previous financial year was more than A$3 million is one (ss 6C, 6D, 6DA). Turnover is the income the business itself earns in the course of carrying it on, so for an agency that is commission, management and letting fees and referral income. Rent you collect for a landlord and hold in trust is generally the landlord’s money passing through rather than your income, so a large rent roll does not by itself put you near the threshold. If it is close enough to decide the answer, check the figure with your accountant. Note also that once turnover has exceeded A$3 million in a financial year that has ended, the exemption does not return by later dropping below it (s 6D(4)(a)). A smaller agency is generally exempt, but is still covered if any of these apply: it provides AML/CTF designated services, i.e. brokering the sale, purchase or transfer of real estate (from 1 July 2026, for the personal information it handles in connection with those obligations, s 6E(1A)); it is related to a body corporate that is not a small business operator, such as a group or franchise entity (s 6D(9)); it operates a residential tenancy database (s 6E(2)); it is a contracted service provider under a Commonwealth contract (s 6D(4)(e)); it trades in personal information (s 6D(4)(c)–(d), subject to the consent and authorised-by-law carve-outs in s 6D(7)–(8)); or it has opted in (s 6EA). Merely listing a tenant on, or searching, someone else’s database does not automatically make you covered. Work out whether the Privacy Act applies to you. Privacy Act 1988 (Cth) ss 6C, 6D, 6DA, 6E.

Not sure it's you?

Does this apply to you?

Tap what's true for your agency. Nothing is saved.

We collect ID from buyers or sellers Our agency turns over under $3m We keep client records digitally We use a rent-roll or PM CRM

Tap what's true above to see where you stand.

Check the Kit against your setupA$539 / year incl GST · founding price

Orientation only, not a compliance assessment. General information and tools, not legal advice.

When can we require someone to identify themselves?

Whenever one of the two exceptions in APP 2.2 applies, and in a real-estate business they apply more often than the principle's reputation suggests.

APP 2.2(a): an Australian law or a court or tribunal order requires you to deal with identified individuals. The clearest current example is AML/CTF customer due diligence on the property sales side, where you are required to identify and verify the customer. Ordinary leasing and property management are not designated services, so this limb does not reach them.

APP 2.2(b): it is impracticable to deal with an unidentified person. This is the one that does the everyday work. You cannot assess a tenancy application from an anonymous applicant, because you cannot verify income, contact referees, run the checks or enter into a lease with someone whose identity you do not know. You cannot manage a tenancy, hold a bond or serve a notice anonymously either.

Note the shape of the test. Impracticable is a higher bar than inconvenient, and it is judged against the particular matter, not against your whole business. "We prefer to know who we are talking to" is a preference. "We cannot perform this function at all without knowing" is impracticability.

Sources: Privacy Act 1988 (Cth), APP 2.1 and APP 2.2(a) to (b) (Schedule 1); AML/CTF Act 2006 (Cth) · OAIC APP Guidelines chapter 2 · OAIC APP guidelines · AUSTRAC

Can someone ask about a rental or a listing without giving their details?

Yes, and this is the clean case. Asking what the rent is, whether a property is still available, when the next inspection is, or what the strata levies are does not require anybody to identify themselves, so APP 2.1 applies and the option must genuinely be available.

The common failure is not a refusal, it is a form. If your website makes name, email and phone mandatory before it will show a price, or your voicemail routes every enquiry into a lead capture, the option has been removed in practice even though nobody said no. Options removed by design are still removed.

Two practical fixes that cost nothing: publish the answers to the routine questions so people do not have to ask, and make the enquiry form's contact fields genuinely optional where the enquiry can be answered without them.

Sources: Privacy Act 1988 (Cth), APP 2.1 (Schedule 1) · OAIC APP Guidelines chapter 2 · OAIC APP guidelines

Does APP 2 mean we have to let people stay anonymous through a whole tenancy?

No. APP 2.1 gives the option in relation to a particular matter, so it is assessed transaction by transaction rather than as a status somebody keeps.

That is why the same person can legitimately be anonymous at one stage and identified at the next. An anonymous enquiry about rent is one matter. Submitting an application is a different matter, where impracticability under APP 2.2(b) plainly applies. Signing a lease is another again.

What you cannot do is use the later requirement to backfill the earlier one, for example refusing to answer a price question until someone registers, on the basis that they would have to identify themselves eventually if they applied.

Sources: Privacy Act 1988 (Cth), APP 2.1 (Schedule 1) · OAIC APP Guidelines chapter 2 · OAIC APP guidelines

Can we require a real name at an open home?

Recording a name and a contact number for people entering an occupied home is ordinarily defensible, because knowing who has been through a property you are responsible for is a genuine function, and doing it anonymously is impracticable.

Two limits worth keeping in view. First, what you may collect is a separate question governed by APP 3.2, which limits you to what is reasonably necessary, so the sign-in is not an invitation to gather more than a name and a contact. Second, collecting at the door triggers an APP 5 collection notice at or before the time of collection.

Requiring a photo ID document is a further step again, and a harder one to justify. That is covered separately.

Sources: Privacy Act 1988 (Cth), APP 2.2(b), APP 3.2 and APP 5 (Schedule 1) · OAIC APP Guidelines chapters 2, 3 and 5 · OAIC APP guidelines · See also can you require photo ID at an open home and the open-home sign-in collection notice

APP 2.1 covers pseudonyms as well as anonymity, so the option is to use a name that is not their legal name rather than to give no name at all. A pseudonym still lets you count and contact attendees, which is usually the function you actually needed.

Where you can show that dealing with a pseudonymous attendee is impracticable for a particular purpose, APP 2.2(b) applies and you can require the real name for that purpose. Wanting a clean database is not that. Needing to link the attendee to a verified identity, for example because they are proceeding to an application or an AML-regulated transaction, may be.

In practice this rarely bites, because someone using a pseudonym at an open home and then applying for the property will be identified at the application stage anyway.

Sources: Privacy Act 1988 (Cth), APP 2.1 and APP 2.2(b) (Schedule 1) · OAIC APP Guidelines chapter 2 · OAIC APP guidelines

Can we refuse to deal with someone who will not identify themselves?

Only where an exception in APP 2.2 applies to that matter. If it does, you are not refusing an entitlement, you are dealing with a situation the principle does not cover.

The safe sequence in an office is: identify the matter, ask whether you can actually perform it without knowing who the person is, and if you cannot, say so and explain why. "We need your name because we cannot process an application without verifying who is entering into the lease" is a defensible answer that most people accept. "It is our policy" is not, and it is the phrasing that generates complaints.

Where you can perform the matter anonymously and choose not to, that is a contravention of APP 2.1, however reasonable it feels commercially.

Sources: Privacy Act 1988 (Cth), APP 2.1 and APP 2.2 (Schedule 1) · OAIC APP Guidelines chapter 2 · OAIC APP guidelines

Can we require registration before releasing property details?

Be careful here, because this is the most common APP 2 problem in the industry and it is usually built into a system rather than decided by a person.

Where the details are already public, in the listing, on a portal, on a sign board, requiring registration to receive them is difficult to justify as impracticability. You are able to provide them; you would prefer to capture a lead first.

Where genuine work is involved, the analysis changes. Booking a private inspection, holding a property, or providing a document pack that has to be prepared and tracked are matters where dealing with an unidentified person may well be impracticable, and a contact point is part of doing the thing.

The distinction to hold: the harder the question is to answer without knowing who is asking, the stronger your APP 2.2(b) position.

Sources: Privacy Act 1988 (Cth), APP 2.1 and APP 2.2(b) (Schedule 1) · OAIC APP Guidelines chapter 2 · OAIC APP guidelines

Can we ask for a phone number just to book an inspection?

Usually yes, because a booking is a matter you cannot sensibly perform without a way to contact the person if the time changes or the property is let. That is APP 2.2(b) impracticability doing its ordinary work.

The limit is APP 3.2: collect what the booking needs and no more. A name and one contact point is the booking. An address, a date of birth, an employer, a budget and a pre-approval status is a lead-qualification form wearing a booking's clothes, and each additional field needs its own justification.

Sources: Privacy Act 1988 (Cth), APP 2.2(b) and APP 3.2 (Schedule 1) · OAIC APP Guidelines chapters 2 and 3 · OAIC APP guidelines

What does "impracticable" actually mean?

It is the exception that decides most real questions, so it is worth understanding rather than reaching for.

Impracticable is judged objectively and against the particular matter. It asks whether you are genuinely unable to deal with an unidentified or pseudonymous person for that purpose, taking account of what the matter requires. Cost and inconvenience are relevant to the assessment, but preference is not, and a system that was built to capture identity does not make anonymity impracticable.

A useful internal test: could you complete this specific interaction, to the standard you owe, without knowing who the person is? If yes, the option stands. If no, write down why once, and apply it consistently rather than deciding case by case at the counter.

Where you rely on APP 2.2(a) instead, be able to name the law or the order. "AML requires it" is only true for the sales-side designated services that are actually regulated, and it is not a general answer for a leasing office.

Sources: Privacy Act 1988 (Cth), APP 2.2(a) and APP 2.2(b) (Schedule 1); AML/CTF Act 2006 (Cth) · OAIC APP Guidelines chapter 2 · OAIC APP guidelines

→ The free 2-minute audit checks the enquiry and sign-in points where agencies most often collect more than the matter requires.