Collection notices for real estate agencies: what APP 5 actually requires
A privacy collection notice is a short statement you give people when you collect their personal information, telling them who you are, what you're collecting, why, and who you might share it with. It's required by Australian Privacy Principle 5 (APP 5), and is not a "notice to remedy" or debt-collection letter. APP 5 binds APP entities, not every business: a small business operator under s 6D may genuinely sit outside it, and that is the first thing to settle.
By Jon Oates, Founder of Privaproof · Last updated · Start the free 2-min audit →
General information, not legal advice. Your obligations depend on your circumstances.
Not sure it's you?
Does this apply to you?
Tap what's true for your agency. Nothing is saved.
Orientation only, not a compliance assessment. General information and tools, not legal advice.
Is a collection notice the same as a tenancy notice?
In real estate the phrase "collection notice" gets used two different ways:
- A tenancy/debt "notice", e.g. a notice to remedy a breach or a rent-arrears letter under state residential-tenancy law. That's a property document.
- A privacy collection notice, the APP 5 statement about how you handle someone's personal information. That's a privacy document.
This page is about the second one, the privacy collection notice, and it is the one the Privacy Act requires. It is also the one your website privacy policy does not discharge, which the Commissioner has said in terms.
What does APP 5 require you to tell people?
APP 5.1 sets the timing: at or before the time you collect personal information or, if that is not practicable, as soon as practicable after. The fallback is conditional, not a free choice. You must take such steps (if any) as are reasonable in the circumstances to notify the person of the ten matters in APP 5.2, or otherwise ensure they are aware of them. In plain terms:
- Who you are: your agency's identity and contact details.
- That you're collecting, where they might not know: if you collect from someone other than the person (a referee, a previous agent, a database), or they may not be aware you have collected it, the fact of collection and the circumstances of it.
- Whether the law requires it: if the collection is required or authorised by an Australian law or a court or tribunal order, that fact and the name of the law (for example, the AML/CTF Act for identity information).
- Why: the purposes you're collecting the information for.
- What happens if they don't provide it: the main consequences of not collecting it.
- Who you share it with: any other organisations you usually disclose the information to (a tenancy database, a landlord, a trust-account provider).
- How to access, correct or complain: that your privacy policy explains this.
- Overseas disclosure: whether you're likely to send the information overseas, and if so, which countries, where it is practicable to specify them.
It doesn't need to be long. It needs to be clear, given at the right moment, and accurate about what your agency actually does.
When does a real-estate agency have to give one?
APP 5 bites at your collection points, the moments personal information comes in. In an agency those typically include:
- Rental applications (including 2Apply-style online forms): applicants hand over identity documents, income evidence and references in one go.
- Open-home and inspection sign-in: names, contact details, sometimes ID.
- Appraisals and vendor onboarding: landlord and vendor personal information.
- Tenancy databases: separate state notice duties sit on top of APP 5. In NSW, if you use a database and the applicant is listed, s 211(2) of the Residential Tenancies Act 2010 requires a written notice within 7 days, stating four specified things. Every state has its own version.
- AML/CTF identity checks: real-estate sales services became designated services on 31 March 2026, with the obligations, including customer identification, from 1 July 2026. Under s 6E(1A), a small business operator that is a reporting entity is treated as an organisation for its activities connected with the AML/CTF Act, whatever its turnover. That scope is those activities, not the whole agency.
If any of these describe your agency, you need collection notices that match, not a generic one copied from another business.
Doesn't our website privacy policy cover this?
No, and there is direct authority on the point. In Commissioner initiated investigation into 7-Eleven Stores Pty Ltd (Privacy) [2021] AICmr 50 (AustLII) the Commissioner held that a privacy policy is a transparency mechanism and "is not generally a way of providing notice under APP 5", adding that "it is not reasonable to assume that customers will have searched for the respondent's Privacy Policy online and read through it" before the collection happened (at [121]).
The Commissioner said what should have been done instead: a collection notice "on, or in the vicinity of" the point of collection, given before the information was captured (at [122]).
Read across to an agency, that is the difference between a privacy policy sitting on your website and an actual notice on the open-home sign-in sheet, on the rental application form, and at the front counter. The policy is a standing statement under APP 1. The notice is what you give someone at the moment you take their details, and one does not do the other's job.
The same determination is a warning about blanket consent wording. A sign at the store entrance reading "By entering the store you consent to facial recognition cameras capturing and storing your image" (at [90]) was held not to produce valid consent at [93]-[94]: it was unclear, it was not contemporaneous with the collection, it was not specific, and it was bundled with other things. A sign-in sheet carrying a single catch-all "by signing you agree to..." line has the same weakness.
(7-Eleven concerned sensitive biometric information, and the consent analysis under APP 3.3 turns on that. The APP 5 notice reasoning above is general and applies to ordinary collections like yours.)
What does a good collection notice look like?
- Short and plain: a few sentences at the point of collection, not a wall of legalese.
- Matched to the form: the notice on a rental application should reflect what a rental application actually collects; the one at an open home is different again.
- Consistent with your privacy policy: the notice points to the policy (APP 1) for the detail on access, correction and complaints.
- Kept current: as the law changes (AML in 2026, tenancy-data rulings, OAIC guidance), the wording needs to keep up.
A one-off template downloaded once can't do that last part on its own, which is the gap a maintained set of documents is built to close.
Common questions
Is a privacy collection notice the same as a tenancy notice?
No. A tenancy or debt "notice", like a notice to remedy a breach or a rent-arrears letter, is a property document. A privacy collection notice is the APP 5 statement about how you handle someone's personal information. This page is about the second.
What must a collection notice tell people under APP 5?
APP 5.2 lists ten matters: who you are and how to contact you; where the person may not know, the fact and circumstances of collection; if the collection is required or authorised by an Australian law or court order, that fact and the name of the law; why you're collecting it; the main consequences if it isn't collected; who you usually disclose that kind of information to; that your privacy policy explains access and correction; that it explains complaints; whether you're likely to disclose overseas; and, where practicable, which countries.
When does a real estate agency have to give a collection notice?
At or before the time you collect the information or, if that is not practicable, as soon as practicable after. In practice that means at your collection points: rental applications, open-home and inspection sign-in, appraisals and vendor onboarding, tenancy-database checks, and AML/CTF identity checks, whose obligations start 1 July 2026.
Can I use one generic collection notice for everything?
No. Each notice should be matched to the form: the notice on a rental application should reflect what a rental application actually collects; the one at an open home is different again.
How does Privaproof help?
The Privaproof Kit includes collection notices written for the specific ways real-estate agencies collect information (rental applications, open homes, appraisals and AML identity checks), reviewed by Matthew Hodgkinson, an Australian practising solicitor (Papillon Lawyers), and kept current as the rules change. They're templates you tailor to your agency: tools and general information, not legal advice.
See where your agency stands: free 2-minute self-audit →
This is general information, not legal advice. Privaproof provides privacy tools and general information; it is not a law practice and does not provide legal advice. Sources: OAIC: APP 5 notification of the collection of personal information; OAIC: Australian Privacy Principles; Privacy Act 1988 (Cth).