What's the cheapest way for a real estate agency to get privacy-compliant in 2026?
The cheapest compliant path for an Australian real estate agency in 2026: use free official resources first, then fill real-estate-specific gaps. Five steps: (1) an APP-compliant privacy policy built from the free OAIC guide or a real-estate one; (2) collect open-home/tenancy details digitally; (3) an AML/CTF program from the free AUSTRAC Real Estate Program Starter Kit; (4) multi-factor authentication and backups; (5) keep it current, the hidden cost is a document going out of date.
By Jon Oates, Founder of Privaproof · Last updated · Start the free 2-min audit →
Not sure it's you?
Does this apply to you?
Tap what's true for your agency. Nothing is saved.
Orientation only, not a compliance assessment. General information and tools, not legal advice.
Why is the OAIC looking at real estate now?
In early 2026 the OAIC ran its first-ever compliance sweep, reviewing the privacy policies of approximately 60 entities across six sectors that collect information in person. Rental and property is the first sector on the OAIC's own list, and the release's own example is real estate agents asking for phone numbers at open houses. The sweep assessed policies against Australian Privacy Principle 1.4, which is a standing obligation whether or not a sweep is running. A breach of APP 1.3 or APP 1.4 is itself a civil penalty provision (Privacy Act s 13K(1)(b), (3)), and it is one the Commissioner can act on by infringement notice without going to court (s 80UB). For an unlisted company that notice is capped at 60 penalty units, and 12 for an individual (Regulatory Powers (Standard Provisions) Act 2014 s 104(2)). Getting your documents in order now is cheaper and calmer than scrambling after an inquiry.
What are the five steps to getting compliant cheaply?
- An APP-compliant privacy policy: the single document the OAIC's 2026 sweep examined.
- Digital collection at open homes and for rental applications: not a paper sheet on the bench.
- An AML/CTF program (for sales agencies) built from the free AUSTRAC starter kit.
- Basic security: multi-factor authentication and backups.
- A way to keep it all current as privacy law changes.
1. Start with free official templates and tools
Your privacy policy: the free OAIC guide
You do not have to pay for expensive bespoke drafting to get started. The OAIC publishes a free Guide to developing an APP privacy policy that sets out what a compliant policy must contain. It is a solid, genuinely free starting point for the general Australian Privacy Principles.
Two things it can't do: it isn't written for real estate (it won't mention open-home sign-in sheets, tenancy databases, or copies of tenant ID), and it isn't a document you can adopt: it is a guide to writing your own, published 5 May 2014, and it won't update when the law moves. More on that below.
AML/CTF: the free AUSTRAC Real Estate Program Starter Kit
Since 1 July 2026, AML/CTF obligations apply to real estate professionals who broker the buying, selling or transfer of property. AUSTRAC provides a free Real estate program starter kit, the cheapest way to stand up a basic program. (The designated service is brokering a sale, purchase or transfer, and AUSTRAC excludes leases of 30 years or less from what counts as real estate, so managing rentals sits outside it.)
Free privacy and data-security checklists
Review your operational security against the OAIC's guidance and your state consumer-protection regulator's material: for example, WA Consumer Protection's "Data security in the real estate industry" bulletin sets out simple, free steps.
2. Collect open-home and tenancy data digitally
Swap the paper open-home register for a digital sign-in. A paper sheet on the bench lets the next visitor photograph everyone's name, phone number and address: a real Australian Privacy Principle 11 security risk. A digital form collects only what you need and makes access and deletion requests far easier to honour. In the 2Apply determination, Commissioner Initiated Investigation into IRE Pty Ltd (Privacy) [2026] AICmr 24 (1 April 2026), the Privacy Commissioner found a rental-application platform had collected more than was reasonably necessary (APP 3.2) and by unfair means (APP 3.5), and gave the decision to real estate peak bodies for agents, property managers and landlords to weigh against their own practices. Does your rental application still ask for gender, student status, citizenship status or visa expiry? IRE was ordered to stop collecting all four.
3. Tighten a few internal practices for next to nothing
- Turn on multi-factor authentication on email, your CRM and cloud storage.
- Back up your data and keep a copy offline.
- Set a retention rule: don't keep applicant data forever; destroy it when it's no longer needed.
- Name a privacy contact and have a simple plan for a data breach (the Notifiable Data Breaches scheme has applied since 22 February 2018).
Is a free template enough, or do you need a kept-current kit?
Is the free OAIC guide enough? It's a valid, no-cost starting point for the general APPs. But it isn't written for real estate, and it's static; it won't move when the law does, as it did with the 2024 Privacy Act amendments and AUSTRAC's Tranche 2 changes. A real-estate-specific set whose fourteen documents are reviewed by Matthew Hodgkinson, an Australian practising solicitor (Papillon Lawyers), and which is kept current, sits between "free but generic" and "expensive bespoke drafting." That's the middle option Privaproof provides. It won't, on its own, make you compliant (that also depends on how you complete the documents and your day-to-day practices), but it removes most of the hard work. These are tools and general information, not legal advice.
Common questions
Is the free OAIC privacy policy guide enough for a real estate agency?
It's a valid free starting point covering the general Australian Privacy Principles, but it is a guide to writing your own policy, not a real-estate document, and it doesn't update when the law changes. A real-estate-specific policy that addresses open-home collection, tenancy databases and applicant ID, and that's kept current, covers the risks a generic guide leaves open. What the sweep assessed was the policy itself, against APP 1.4.
Is the OAIC really checking real estate agents in 2026?
Yes. The OAIC ran its first-ever privacy compliance sweep from the first week of January 2026, and rental and property is the first of its six target sectors, named for collection during property inspections. On 20 May 2026 the Commissioner reported that the sweep of sixty entities found non-compliance in a significant proportion of them, across all six sectors.
Do real estate agents need an AML/CTF program?
Since 1 July 2026, real estate and buyer's agents who broker the purchase, sale or transfer of property must have an AML/CTF program. An agency already providing the service before that date had to be enrolled on AUSTRAC's Reporting Entities Roll by 29 July 2026. The free AUSTRAC Real estate program starter kit is the cheapest starting point.
General information and tools, not legal advice. Privaproof is not a law practice. For advice about your agency's specific circumstances, consult a lawyer.