Can we cold-call property owners we found on a title search or a property-data platform?

Only after you have washed the numbers, and the wash is only good for 30 days. Prospecting calls to owners are telemarketing calls because one of their purposes is to promote a supplier of land (s 5(1)(j)), so the Do Not Call Register Act 2006 governs them and APP 7 is displaced to that extent under APP 7.8. Section 11(1) makes the call to a registered number the contravention, and s 11(9) deems the business that engaged the caller to have caused it.

By Jon Oates, Founder of Privaproof · Last updated 27 July 2026 · Start the free 2-min audit →

General information, not legal advice. Your obligations depend on your circumstances.

Does this apply to your agency?

The Privacy Act binds “organisations”. An agency whose annual turnover for the previous financial year was more than A$3 million is one (ss 6C, 6D, 6DA). Turnover is the income the business itself earns in the course of carrying it on, so for an agency that is commission, management and letting fees and referral income. Rent you collect for a landlord and hold in trust is generally the landlord’s money passing through rather than your income, so a large rent roll does not by itself put you near the threshold. If it is close enough to decide the answer, check the figure with your accountant. Note also that once turnover has exceeded A$3 million in a financial year that has ended, the exemption does not return by later dropping below it (s 6D(4)(a)). A smaller agency is generally exempt, but is still covered if any of these apply: it provides AML/CTF designated services, i.e. brokering the sale, purchase or transfer of real estate (since 31 March 2026, for the personal information it handles in connection with those obligations, s 6E(1A)); it is related to a body corporate that is not a small business operator, such as a group or franchise entity (s 6D(9)); it operates a residential tenancy database (s 6E(2)); it is a contracted service provider under a Commonwealth contract (s 6D(4)(e)); it trades in personal information (s 6D(4)(c)–(d), subject to the consent and authorised-by-law carve-outs in s 6D(7)–(8)); or it has opted in (s 6EA). Merely listing a tenant on, or searching, someone else’s database does not automatically make you covered. Work out whether the Privacy Act applies to you. Privacy Act 1988 (Cth) ss 6C, 6D, 6DA, 6E.

Note that the Do Not Call Register Act applies to your calls whether or not the Privacy Act binds your business: s 11(1) binds "a person", with no turnover threshold. Penalties are penalty units ordered by the Federal Court on ACMA's application (ss 24, 25): 100 units for a body corporate with no prior record, 2,000 for two or more contraventions on one day.

Not sure it's you?

Does this apply to you?

Tap what's true for your agency. Nothing is saved.

We collect ID from buyers or sellers Our agency turns over under $3m We keep client records digitally We use a rent-roll or PM CRM

Tap what's true above to see where you stand.

Check the Kit against your setupA$539 / year incl GST · founding price, rising to A$649 on 1 Oct 2026

Orientation only, not a compliance assessment. General information and tools, not legal advice.

What does washing a list actually involve?

Submitting your numbers to the Register's checking service so that listed numbers are stripped out before you call, and doing it on a current basis rather than once.

Three practical points that catch agencies out:

A wash lasts 30 days, not a campaign. The s 11(3) defence runs only where the Register told you the number was not listed during the 30-day period ending at the end of the day of the call. Day 31 needs a fresh wash.
Keep the evidence. Retain the submission dates and what the Register sent back, not just the cleaned list. Section 11(6) puts the evidential burden of the wash defence on you, and s 11(3) is built on the s 19 response rather than the number's true status.
It applies to the number, not the person. An owner whose mobile is listed is off limits on that number even if you have their email and could lawfully write to them.

Sources: Do Not Call Register Act 2006 (Cth); Privacy Act 1988 (Cth), APP 7.8 (Schedule 1) · ACMA Do Not Call Register · Do Not Call Register

When can we call a number that is on the Register?

One is a real exception. The other two are situations where the prohibition never applied at all, and that difference is what most summaries leave out.

Consent. Consent under s 11(2) defeats the listing, but Schedule 2 clause 3 is the catch: express consent that does not state a period is taken to be withdrawn 3 months after it was given. Consent can also be inferred from conduct and from business and other relationships (Sch 2 cl 2(b)). Consent given to your agency does not extend to a business you refer them to.

A service call is not a telemarketing call at all. A call about the tenancy you already manage sits outside the s 5(1) definition. But s 5(1) bites where marketing is "one of the purposes", so adding "and are you thinking of selling?" turns the whole call into one. The Act has no existing-customer exception; a relationship goes only to inferred consent under Sch 2 cl 2(b).

Business numbers. Section 14 makes only four kinds of number eligible: used or maintained primarily for private or domestic purposes, exclusively for faxes, exclusively by a government body, or an emergency service number. A rival agency's office line is none of those. But the test is primarily, so an owner's mobile stays eligible even if the odd business call comes in on it, and a landlord's ABN is not an exemption.

⚠️ Do not stretch these. Schedule 2 clause 4 says consent "may not be inferred from the mere fact that the number has been published", which disposes of "we got it off a title search". A single past listing is not the business relationship Sch 2 cl 2(b) contemplates either.

Sources: Do Not Call Register Act 2006 (Cth) · ACMA Do Not Call Register

Does using a call centre or an outsourced prospector protect us?

No. Section 11(9) deems it: if you enter a contract, arrangement or understanding and the other party gives effect to it by making a telemarketing call, you are taken to have caused that call, and s 11(1) prohibits causing it. The exposure does not move to the dialler, it doubles, because you now also depend on their washing discipline and records.

Not best practice, s 12(1): entering the arrangement is itself a contravention unless the agreement expressly provides that the other party will comply with this Act and take all reasonable steps to ensure their employees and agents do too. A wash-only clause does not satisfy it, and under s 12(4) the non-compliant agreement stays valid. Layer the wash records, a right to inspect them, opt-out passthrough and accurate sender identification on top.

The same applies to an offshore prospecting team, with the added point that giving them your owner data engages APP 8 if they are a separate entity overseas. Where APP 8.1 applied, s 16C treats what they do with that data as something your business did.

Sources: Do Not Call Register Act 2006 (Cth); Privacy Act 1988 (Cth), APP 8 (Schedule 1) · ACMA Do Not Call Register · See also offshore VAs and overseas staff

Where the data came from matters too

The Do Not Call rules govern the call. Separately, the Privacy Act governs how you got the number and what else you do with it.

Owner details obtained from a title search or a property-data platform are personal information about that owner. Collecting them engages APP 3.2, which limits you to what is reasonably necessary for your functions, and holding them engages APP 11 security and destruction. If you build a prospecting database, that database is personal information you are responsible for.

Note also APP 7.6. APP 7.8 displaces APP 7 only "to the extent that" the Do Not Call Register Act applies, and that Act gives no source-disclosure right, so APP 7.6(e) still lets a person ask you to identify the source of their information, free of charge and within a reasonable period (APP 7.7). On a list built from third-party data that is the question you need to answer, so record the source per contact as you add them. It binds you only if the Privacy Act does.

Sources: Privacy Act 1988 (Cth), APP 3.2, APP 7.6 and APP 11 (Schedule 1) · OAIC APP Guidelines chapters 3, 7 and 11 · OAIC APP guidelines

What about SMS or email to the same owners?

Different law again, and the mistake is assuming one clearance covers everything.

The Do Not Call Register covers calls and marketing faxes (s 12B), not text. Email, SMS, MMS and instant messages are commercial electronic messages under the Spam Act 2003, which needs consent, accurate sender identification, and a withdrawal of consent actioned within 5 business days (Sch 2 cl 6). There is no bulk threshold: one message is enough. Absence from the Register says nothing about whether you may text.

So an owner list can legitimately be callable and not textable, or the reverse. Track the permission per channel rather than per contact.

Sources: Spam Act 2003 (Cth); Do Not Call Register Act 2006 (Cth); Privacy Act 1988 (Cth), APP 7.8 (Schedule 1) · ACMA spam rules · See also appraisal SMS to open-home leads

→ The free 2-minute audit covers the prospecting data an agency holds and where it actually came from.