Collection notices for real estate agencies: what APP 5 actually requires
A privacy collection notice is a short statement you give people when you collect their personal information, telling them who you are, what you're collecting, why, and who you might share it with. It's required by Australian Privacy Principle 5 (APP 5), and is not a "notice to remedy" or debt-collection letter. If your agency takes rental applications, runs open homes, or does ID checks, APP 5 almost certainly applies.
By Jon Oates, Founder of Privaproof · Last updated · Start the free 2-min audit →
General information, not legal advice. Your obligations depend on your circumstances.
Not sure it's you?
Does this apply to you?
Tap what's true for your agency. Nothing is saved.
Orientation only, not a compliance assessment. General information and tools, not legal advice.
Is a collection notice the same as a tenancy notice?
In real estate the phrase "collection notice" gets used two different ways:
- A tenancy/debt "notice", e.g. a notice to remedy a breach or a rent-arrears letter under state residential-tenancy law. That's a property document.
- A privacy collection notice, the APP 5 statement about how you handle someone's personal information. That's a privacy document.
This page is about the second one, the privacy collection notice, because it's the one most agencies miss, and the one the Privacy Act requires.
What does APP 5 require you to tell people?
Under APP 5, at or before the time you collect personal information (or as soon as practicable after), you must take reasonable steps to make the person aware of certain things. In plain terms, a compliant collection notice covers:
- Who you are: your agency's identity and contact details.
- That you're collecting, and how: the fact and circumstances of collection.
- Whether the law requires it: if the collection is required or authorised by law (for example, identity information collected for AML/CTF purposes).
- Why: the purposes you're collecting the information for.
- What happens if they don't provide it: the main consequences of not collecting it.
- Who you share it with: any other organisations you usually disclose the information to (a tenancy database, a landlord, a trust-account provider).
- How to access, correct or complain: that your privacy policy explains this.
- Overseas disclosure: whether you're likely to send the information overseas, and if so, which countries.
It doesn't need to be long. It needs to be clear, given at the right moment, and accurate about what your agency actually does.
When does a real-estate agency have to give one?
APP 5 bites at your collection points, the moments personal information comes in. For most agencies that includes:
- Rental applications (including 2Apply-style online forms): the biggest one; tenants hand over identity documents, income evidence and references.
- Open-home and inspection sign-in: names, contact details, sometimes ID.
- Appraisals and vendor onboarding: landlord and vendor personal information.
- Tenancy databases: if you check or list, there are specific notice obligations.
- AML/CTF identity checks: from 1 July 2026, agencies providing property-sale services collect customer-ID information for AML purposes, which the Privacy Act reaches even below the usual small-business threshold.
If any of these describe your agency, you need collection notices that match, not a generic one copied from another business.
Doesn't our website privacy policy cover this?
No, and there is direct authority on the point. In Commissioner initiated investigation into 7-Eleven Stores Pty Ltd (Privacy) [2021] AICmr 50 (AustLII) the Commissioner held that a privacy policy is a transparency mechanism and "is not generally a way of providing notice under APP 5", adding that "it is not reasonable to assume that customers will have searched for the respondent's Privacy Policy online and read through it" before the collection happened (at [121]).
The Commissioner said what should have been done instead: a collection notice "on, or in the vicinity of" the point of collection, given before the information was captured (at [122]).
Read across to an agency, that is the difference between a privacy policy sitting on your website and an actual notice on the open-home sign-in sheet, on the rental application form, and at the front counter. The policy is a standing statement under APP 1. The notice is what you give someone at the moment you take their details, and one does not do the other's job.
The same determination is a warning about blanket consent wording. A sign at the store entrance reading "By entering the store you consent to facial recognition cameras capturing and storing your image" was held not to produce valid consent: it was unclear, it was not given at the time of collection, and it was bundled with other things (at [90]–[94]). A sign-in sheet carrying a single catch-all "by signing you agree to..." line has the same weakness.
(7-Eleven concerned sensitive biometric information, and the consent analysis under APP 3.3 turns on that. The APP 5 notice reasoning above is general and applies to ordinary collections like yours.)
What does a good collection notice look like?
- Short and plain: a few sentences at the point of collection, not a wall of legalese.
- Matched to the form: the notice on a rental application should reflect what a rental application actually collects; the one at an open home is different again.
- Consistent with your privacy policy: the notice points to the policy (APP 1) for the detail on access, correction and complaints.
- Kept current: as the law changes (AML in 2026, tenancy-data rulings, OAIC guidance), the wording needs to keep up.
A one-off template downloaded once can't do that last part on its own, which is the gap a maintained set of documents is built to close.
Common questions
Is a privacy collection notice the same as a tenancy notice?
No. A tenancy or debt "notice", like a notice to remedy a breach or a rent-arrears letter, is a property document. A privacy collection notice is the APP 5 statement about how you handle someone's personal information. This page is about the second.
What must a collection notice tell people under APP 5?
Who you are, that you're collecting and how, whether the law requires it, why you're collecting it, what happens if they don't provide it, who you usually share it with, how to access, correct or complain, and whether you're likely to disclose the information overseas.
When does a real estate agency have to give a collection notice?
At your collection points: rental applications, open-home and inspection sign-in, appraisals and vendor onboarding, tenancy-database checks, and AML/CTF identity checks from 1 July 2026.
Can I use one generic collection notice for everything?
No. Each notice should be matched to the form: the notice on a rental application should reflect what a rental application actually collects; the one at an open home is different again.
How does Privaproof help?
The Privaproof Kit includes collection notices written for the specific ways real-estate agencies collect information (rental applications, open homes, appraisals and AML identity checks), reviewed by Matthew Hodgkinson, an Australian practising solicitor (Papillon Lawyers), and kept current as the rules change. They're templates you tailor to your agency: tools and general information, not legal advice.
See where your agency stands: free 2-minute self-audit →
This is general information, not legal advice. Privaproof provides privacy tools and general information; it is not a law practice and does not provide legal advice. Sources: OAIC: APP 5 notification of the collection of personal information; OAIC: Australian Privacy Principles; Privacy Act 1988 (Cth).