Does a landlord have the right to see the personal information we hold about their tenant?

Q: Why is a landlord's request not an access request?

Because APP 12 gives a person access to their own personal information. A tenant can ask you for their file. A landlord cannot ask you for the tenant's file using that right, and framing it as "the owner is entitled to see it" confuses two different things: the landlord's commercial interest in the tenancy, and a statutory right that belongs to the tenant. Note the one exception that does travel: a request made on the tenant's behalf by a solicitor, advocate or attorney under an enduring power is still the tenant's APP 12 request. Ask for evidence of the authority.

Q: What is the risk if we just forward the whole application?

Both APP 6 and APP 11.1 are engaged, not one or the other. An earlier version of this page said the exposure was APP 6 and not APP 11. That was too neat. APP 6 asks whether the disclosure was within the primary purpose, or within consent or an exception in APP 6.2. APP 11.1(b) asks a different question: whether you took such steps as are reasonable in the circumstances to protect the information you hold from unauthorised disclosure . That duty is judged at the moment you pressed send, when you did still hold the file, so an over-disclosure is a security failure as well as a use-and-disclosure failure. And an unauthorised disclosure is the entry point to the Part IIIC eligible-data-breach assessment: unauthorised disclosure plus a likelihood of serious harm is what an eligible data breach is made of, and sending a full application containing identity documents and bank details to the wrong recipient can meet it. What is true, and worth keeping, is that APP 11 gives you no purchase on the copy now sitting in the landlord's inbox . The security and destruction duties bite on information you hold, meaning in your possession or control, and that copy is neither. The practical consequen

Not under APP 12, which gives individuals access to their own information, so a landlord cannot use it to obtain a tenant's file. Whether you may share tenant information with the landlord is a different question governed by APP 6, and the practical answer is that the landlord gets what they need to make and manage the leasing decision, not the raw file.

By Jon Oates, Founder of Privaproof · Last updated 26 July 2026 · Start the free 2-min audit →

General information, not legal advice. Your obligations depend on your circumstances.

Does this apply to your agency?

The Privacy Act binds “organisations”. An agency whose annual turnover for the previous financial year was more than A$3 million is one (ss 6C, 6D, 6DA). Turnover is the income the business itself earns in the course of carrying it on, so for an agency that is commission, management and letting fees and referral income. Rent you collect for a landlord and hold in trust is generally the landlord’s money passing through rather than your income, so a large rent roll does not by itself put you near the threshold. If it is close enough to decide the answer, check the figure with your accountant. Note also that once turnover has exceeded A$3 million in a financial year that has ended, the exemption does not return by later dropping below it (s 6D(4)(a)). A smaller agency is generally exempt, but is still covered if any of these apply: it provides AML/CTF designated services, i.e. brokering the sale, purchase or transfer of real estate (from 1 July 2026, for the personal information it handles in connection with those obligations, s 6E(1A)); it is related to a body corporate that is not a small business operator, such as a group or franchise entity (s 6D(9)); it operates a residential tenancy database (s 6E(2)); it is a contracted service provider under a Commonwealth contract (s 6D(4)(e)); it trades in personal information (s 6D(4)(c)–(d), subject to the consent and authorised-by-law carve-outs in s 6D(7)–(8)); or it has opted in (s 6EA). Merely listing a tenant on, or searching, someone else’s database does not automatically make you covered. Work out whether the Privacy Act applies to you. Privacy Act 1988 (Cth) ss 6C, 6D, 6DA, 6E.

Not sure it's you?

Does this apply to you?

Tap what's true for your agency. Nothing is saved.

We collect ID from buyers or sellers Our agency turns over under $3m We keep client records digitally We use a rent-roll or PM CRM

Tap what's true above to see where you stand.

Check the Kit against your setupA$539 / year incl GST · founding price

Orientation only, not a compliance assessment. General information and tools, not legal advice.

Why is a landlord's request not an access request?

Because APP 12 gives a person access to their own personal information. A tenant can ask you for their file. A landlord cannot ask you for the tenant's file using that right, and framing it as "the owner is entitled to see it" confuses two different things: the landlord's commercial interest in the tenancy, and a statutory right that belongs to the tenant.

Note the one exception that does travel: a request made on the tenant's behalf by a solicitor, advocate or attorney under an enduring power is still the tenant's APP 12 request. Ask for evidence of the authority.

Can a tenant require the landlord's name and address for service?

A tenant is entitled to an address for service of notices, and privacy is not a reason to withhold what your state's tenancy law requires. The distinction that matters, and the one agencies get backwards, is name versus address.

Where an agent is acting, it is the landlord's ADDRESS that the agent's details replace, not the landlord's NAME. The tenancy agreement still has to identify who the landlord is. Substituting "care of the agency" for the owner's identity is a different thing from substituting the agency's address for the owner's home address, and only the second is what these provisions generally allow.

Four jurisdictions go further and require the landlord's own details to reach the tenant, though not all of them require it on the face of the agreement:

New South Wales, s 27(1): requires the landlord's own name and contact details, agent or no agent. ⚠️ But it offers a choice: written notice "before or when the tenant enters into the residential tenancy agreement" or inclusion in the agreement itself. A separate written notice discharges it, so this is not strictly an on-the-agreement requirement.
Western Australia, s 51(2)(a): requires the lessor's full name, plus the name and address of the property manager.
South Australia: both routes apply. s 48(1) is a written-notice duty, given before or at the time of entering the agreement. s 49(1)(b)(ii) is what puts it on the face of the written agreement: "the landlord's full name and postal or email address for service of documents (which must not be the agent's address for service)". The must-not-be-the-agent's-address carve-out appears in both.
Northern Territory, s 19(1) is a second exception of the same kind: the requirement is conjunctive, the landlord's full name and an address for service, so the agent's address does not displace the owner's name.

The ACT is genuinely unsettled. Whether an agent's address satisfies s 12(3)(b) is not resolved on the material available, and we are not going to pretend otherwise. Do not group the ACT with the "agent's address is fine" states. Get local advice or ask ACT Fair Trading before you decide what goes on the agreement.

The consequence of getting this wrong runs the way people do not expect. Handing over an owner's home address when your statute only required yours is a disclosure of the landlord's personal information, with its own foreseeable safety dimension, and no tenancy law compelled it. Getting it wrong the other way, by leaving the owner's name off, is a defect in the agreement.

Whether a failure is an offence also varies, and the exposure is real where it exists: Queensland 20 penalty units, Victoria 60 penalty units, Western Australia $5,000 (s 51), South Australia $20,000 (s 48), Tasmania 50 penalty units (Residential Tenancy Act 1997 (Tas) s 62(1)(a)). In New South Wales it is a term of the agreement rather than an offence (s 27(3)), enforceable at the tribunal. The ACT and the Northern Territory carry no penalty. So "you must, or it is unlawful" is not a safe national statement either.

The rule to work to: give what your statute requires, and no more, and check whether yours requires the owner's name as well as an address.

What is different is the landlord's other personal information: their home address if it is not the service address, their personal mobile, their financial circumstances, or their reasons for selling. Those are not automatically disclosable to a tenant, and the service-address obligation does not carry them along with it.

Sources: the relevant state or territory Residential Tenancies Act, including Residential Tenancies Act 2010 (NSW) s 27(1) and s 27(3), Residential Tenancies Act 1995 (SA) s 48(1) and s 49(1)(b)(ii), Residential Tenancies Act 1997 (Vic) s 66, Residential Tenancies and Rooming Accommodation Act 2008 (Qld) s 206, Residential Tenancies Act 1987 (WA) s 51(2)(a), Residential Tenancies Act 1995 (SA) s 48(1)(b), Residential Tenancy Act 1997 (Tas) s 62(1)(a), Residential Tenancies Act 1997 (ACT) s 12(3)(b), Residential Tenancies Act 1999 (NT) s 19(1); Privacy Act 1988 (Cth), APP 6 (Schedule 1) · OAIC APP guidelines

How much of a tenant's application can we give the landlord?

Enough for the landlord to make the leasing decision, not the raw file.

The primary purpose of a tenancy application is to assess and select a tenant for that property, and the landlord makes that decision, so a decision-ready summary is ordinarily within it: the applicant's name, the outcome of your assessment, whether employment and income were verified, and the result of rental-history and reference checks.

⚠️ A lawful disclosure under APP 6 can still be an unlawful discriminatory act. Several things that commonly appear in a summary are protected attributes or close proxies for them, including family responsibilities and the presence of children, source of income, and whatever a reference happens to surface about disability, race or pregnancy. Commonwealth, state and territory anti-discrimination laws govern how a tenancy decision is made, and an agent can be liable for causing or assisting an unlawful act by a landlord. Report on capacity to pay and on tenancy history, resist passing on personal characteristics, and do not collect what you should not be deciding on in the first place.

Forwarding the underlying documents is a different act again. Identity-document scans, bank statements, full referee notes and anything sensitive were collected so that you could verify, not so the landlord could hold copies.

Set the owner's expectation in the management agreement so it does not become an argument per application. "We assess and verify, and we give you what you need to decide" is a defensible position and an easy one to explain. Note what that agreement does and does not do: it is commercial expectation-setting between you and the owner. The expectation that matters under APP 6.2(a) is the tenant's, and that is set by your APP 5 collection notice, which is where you should say that an assessment summary goes to the owner.

Sources: Privacy Act 1988 (Cth), APP 6 (Schedule 1); Commonwealth, state and territory anti-discrimination law (outside the Privacy Act, and outside the scope of this page) · OAIC APP guidelines

What is the risk if we just forward the whole application?

Both APP 6 and APP 11.1 are engaged, not one or the other. An earlier version of this page said the exposure was APP 6 and not APP 11. That was too neat.

APP 6 asks whether the disclosure was within the primary purpose, or within consent or an exception in APP 6.2. APP 11.1(b) asks a different question: whether you took such steps as are reasonable in the circumstances to protect the information you hold from unauthorised disclosure. That duty is judged at the moment you pressed send, when you did still hold the file, so an over-disclosure is a security failure as well as a use-and-disclosure failure. And an unauthorised disclosure is the entry point to the Part IIIC eligible-data-breach assessment: unauthorised disclosure plus a likelihood of serious harm is what an eligible data breach is made of, and sending a full application containing identity documents and bank details to the wrong recipient can meet it.

What is true, and worth keeping, is that APP 11 gives you no purchase on the copy now sitting in the landlord's inbox. The security and destruction duties bite on information you hold, meaning in your possession or control, and that copy is neither.

The practical consequence is the same and it is worth saying to staff plainly: once it is in the landlord's inbox it is gone. You cannot secure it, recall it, or destroy it when the retention need ends. And because an individual residential landlord is usually not an APP entity at all, there is no equivalent duty sitting on them either, so the information simply has no privacy framework around it any more. That is the strongest practical argument for sending an assessment rather than the file.

Sources: Privacy Act 1988 (Cth), section 6 ("holds"), APP 6 and APP 11.1 (Schedule 1); Part IIIC (notifiable data breaches); ss 6C, 6D (who is an organisation) · OAIC APP guidelines

What about during the tenancy?

The same test applies to ongoing disclosure. Arrears status, breach history and inspection findings are ordinarily within managing the tenancy and the tenant would expect the owner to be told. A tenant's health information, family circumstances, forwarding address or the detail of a personal hardship conversation generally is not, and a landlord's curiosity is not a legal basis.

At a management transfer, ask what the incoming agency needs to keep managing the tenancy rather than shipping everything the file contains.

What does APP 6 actually require?

Read the structure of APP 6.1 carefully, because it is commonly stated backwards.

APP 6.1 is a prohibition. Where you hold personal information collected for a particular purpose (the primary purpose), you must not use or disclose it for another purpose (a secondary purpose) unless (a) the individual has consented, or (b) APP 6.2 or APP 6.3 applies. So 6.1(a) is the consent exception. It is not a permission to use information for the primary purpose. Use or disclosure for the primary purpose needs no exception at all, because the prohibition never reaches it. That is why the real work on this page is deciding what the primary purpose actually was.

For a secondary purpose without consent, APP 6.2(a) requires that the individual would reasonably expect the use or disclosure, and that the secondary purpose is:

APP 6.2(a)(i): where the information is sensitive information, directly related to the primary purpose; or
APP 6.2(a)(ii): where the information is not sensitive information, related to the primary purpose.

APP 6.2(b) covers use or disclosure required or authorised by or under an Australian law or a court or tribunal order, and further exceptions follow.

Sources: Privacy Act 1988 (Cth), APP 6.1 and APP 6.2 (Schedule 1) · OAIC APP Guidelines chapter 6 · OAIC APP guidelines · legislation.gov.au

→ The expectation that does the legal work under APP 6.2(a) is the tenant's, and it is set by your APP 5 collection notice: if the notice tells applicants plainly that an assessment summary goes to the owner, that is what they can reasonably expect. A management agreement cannot supply the tenant's expectation for them; it sets the owner's commercial expectation and keeps the conversation off the table per application. The Kit's collection notice does the first job and its management-agreement wording does the second.