Can we cold-call property owners we found on a title search or a property-data platform?

Q: Does using a call centre or an outsourced prospector protect us?

No. Liability can extend to the business that causes the call to be made, so engaging someone else to dial does not transfer the exposure. If anything it increases it, because you now depend on somebody else's washing discipline and record-keeping. If you do outsource, the minimum is: a contractual obligation to wash against the Register and to keep the records, a right to see those records, an obligation to pass opt-out requests to you immediately, and a scripted sender identification that names your agency accurately. The same applies to an offshore prospecting team, with the added point that giving them your owner data engages APP 8 if they are a separate entity overseas.

Only after you have washed the numbers against the Do Not Call Register. Prospecting calls to owners are telemarketing calls, so the Do Not Call Register Act 2006 governs them, and APP 7 is displaced to that extent under APP 7.8. The Register is not optional and it is not a courtesy: calling a listed number without consent or an exemption is the contravention, and using a third-party call centre does not move the liability off your business.

By Jon Oates, Founder of Privaproof · Last updated 27 July 2026 · Start the free 2-min audit →

General information, not legal advice. Your obligations depend on your circumstances.

Does this apply to your agency?

The Privacy Act binds “organisations”. An agency whose annual turnover for the previous financial year was more than A$3 million is one (ss 6C, 6D, 6DA). Turnover is the income the business itself earns in the course of carrying it on, so for an agency that is commission, management and letting fees and referral income. Rent you collect for a landlord and hold in trust is generally the landlord’s money passing through rather than your income, so a large rent roll does not by itself put you near the threshold. If it is close enough to decide the answer, check the figure with your accountant. Note also that once turnover has exceeded A$3 million in a financial year that has ended, the exemption does not return by later dropping below it (s 6D(4)(a)). A smaller agency is generally exempt, but is still covered if any of these apply: it provides AML/CTF designated services, i.e. brokering the sale, purchase or transfer of real estate (from 1 July 2026, for the personal information it handles in connection with those obligations, s 6E(1A)); it is related to a body corporate that is not a small business operator, such as a group or franchise entity (s 6D(9)); it operates a residential tenancy database (s 6E(2)); it is a contracted service provider under a Commonwealth contract (s 6D(4)(e)); it trades in personal information (s 6D(4)(c)–(d), subject to the consent and authorised-by-law carve-outs in s 6D(7)–(8)); or it has opted in (s 6EA). Merely listing a tenant on, or searching, someone else’s database does not automatically make you covered. Work out whether the Privacy Act applies to you. Privacy Act 1988 (Cth) ss 6C, 6D, 6DA, 6E.

Note that the Do Not Call Register Act applies to your calls whether or not the Privacy Act binds your business.

Not sure it's you?

Does this apply to you?

Tap what's true for your agency. Nothing is saved.

We collect ID from buyers or sellers Our agency turns over under $3m We keep client records digitally We use a rent-roll or PM CRM

Tap what's true above to see where you stand.

Check the Kit against your setupA$539 / year incl GST · founding price

Orientation only, not a compliance assessment. General information and tools, not legal advice.

What does washing a list actually involve?

Submitting your numbers to the Register's checking service so that listed numbers are stripped out before you call, and doing it on a current basis rather than once.

Three practical points that catch agencies out:

A wash has a shelf life. People join the Register continuously, so a list washed months ago is not a washed list. Re-wash before each campaign.
Keep the evidence. Retain the wash records and the dates. If a complaint arrives, your defence is the record that the number was not listed when you called it, and that is a documentary question.
It applies to the number, not the person. An owner whose mobile is listed is off limits on that number even if you have their email and could lawfully write to them.

Sources: Do Not Call Register Act 2006 (Cth); Privacy Act 1988 (Cth), APP 7.8 (Schedule 1) · ACMA Do Not Call Register · Do Not Call Register

When can we call a number that is on the Register?

There are real exceptions, and they are the part most summaries leave out.

Consent. If the person has consented to receiving telemarketing calls from you, the listing does not stop you. Consent can be express, and in limited circumstances inferred, and it must be able to be evidenced. Consent given to your agency does not extend to a business you refer them to.

An existing relationship. Where someone is already your client, a call about the engagement you are actually performing is not cold prospecting at all.

Business numbers. The Register covers numbers used primarily for private or domestic purposes, and there are provisions dealing with business numbers. That is why calling a rival agency's listed office number is a different question from calling an owner's personal mobile. Check the current position rather than assuming a blanket business exemption.

⚠️ Do not stretch these. "They listed a property once so we have a relationship" is not an existing relationship, and "their number was on a title search" is not consent. Both are the reasoning that produces complaints.

Sources: Do Not Call Register Act 2006 (Cth) · ACMA Do Not Call Register

Does using a call centre or an outsourced prospector protect us?

No. Liability can extend to the business that causes the call to be made, so engaging someone else to dial does not transfer the exposure. If anything it increases it, because you now depend on somebody else's washing discipline and record-keeping.

If you do outsource, the minimum is: a contractual obligation to wash against the Register and to keep the records, a right to see those records, an obligation to pass opt-out requests to you immediately, and a scripted sender identification that names your agency accurately.

The same applies to an offshore prospecting team, with the added point that giving them your owner data engages APP 8 if they are a separate entity overseas.

Sources: Do Not Call Register Act 2006 (Cth); Privacy Act 1988 (Cth), APP 8 (Schedule 1) · ACMA Do Not Call Register · See also offshore VAs and overseas staff

Where the data came from matters too

The Do Not Call rules govern the call. Separately, the Privacy Act governs how you got the number and what else you do with it.

Owner details obtained from a title search or a property-data platform are personal information about that owner. Collecting them engages APP 3.2, which limits you to what is reasonably necessary for your functions, and holding them engages APP 11 security and destruction. If you build a prospecting database, that database is personal information you are responsible for.

Note also APP 7.6, which survives the displacement: a person can ask you to stop marketing to them, ask you not to facilitate other organisations' marketing, and ask you to identify the source of their information. On a prospecting list built from third-party data, that last question is the one you need to be able to answer, so record the source per contact at the point you add them.

Sources: Privacy Act 1988 (Cth), APP 3.2, APP 7.6 and APP 11 (Schedule 1) · OAIC APP Guidelines chapters 3, 7 and 11 · OAIC APP guidelines

What about SMS or email to the same owners?

Different law again, and the mistake is assuming one clearance covers everything.

The Do Not Call Register covers calls. Email, SMS, MMS and instant messages are commercial electronic messages under the Spam Act 2003, which needs consent for the message, accurate sender identification, and a functional unsubscribe actioned within 5 business days. A number being absent from the Register says nothing about whether you may text it.

So an owner list can legitimately be callable and not textable, or the reverse. Track the permission per channel rather than per contact.

Sources: Spam Act 2003 (Cth); Do Not Call Register Act 2006 (Cth); Privacy Act 1988 (Cth), APP 7.8 (Schedule 1) · ACMA spam rules · See also appraisal SMS to open-home leads

→ The free 2-minute audit covers the prospecting data an agency holds and where it actually came from.