Do I need a privacy lawyer for my real estate agency, or is a template kit enough?
Nothing in the Privacy Act requires a lawyer to draft your privacy documents: APP 1.3 and 1.4 say what a policy must contain, APP 5.2 lists the ten matters a collection notice must cover, and the OAIC publishes a guide to help entities write their own. A solicitor-reviewed, real-estate-specific template Kit is usually enough for a privacy policy, collection notice and breach plan. You do need a lawyer for the non-standard situations: a live complaint or dispute, an actual data breach, or an unusual business set-up.
By Jon Oates, Founder of Privaproof · Last updated · Start the free 2-min audit →
General information, not legal advice. Your obligations depend on your circumstances.
Not sure it's you?
Does this apply to you?
Tap what's true for your agency. Nothing is saved.
Orientation only, not a compliance assessment. General information and tools, not legal advice.
Does the law require a lawyer to draft your privacy documents?
No. The duty sits on your agency, and the Act says what the documents must contain, not who writes them: APP 1.4 lists the seven things a privacy policy must cover, and APP 5.2 the ten matters an APP 5 collection notice must state. The OAIC publishes a guide to developing an APP privacy policy to help entities prepare their own.
The Privacy Act 1988 (Cth) does not bind every agency, which is worth knowing before you pay anyone. A business with an annual turnover of A$3 million or less is generally exempt as a small business operator (s 6D(1)), but s 6D(4)(a) is one-way, so a single completed financial year above A$3m puts you outside the exemption for good, and s 6E can bring you in through your AML/CTF activities whatever your turnover. If you are covered, the Australian Privacy Principles set out what your documents must contain. See our overview of whether the Privacy Act applies to real estate agents.
What are your three options?
There are really three paths, and the honest framing is that they are not equal in risk or cost:
- DIY from a free or generic template. Cheapest, and the OAIC's own guide is written to support it. The test is whether the document covers your facts: does it name the countries your CRM stores data in (APP 1.4(g)), and will it carry the automated-decision disclosure APP 1.7 requires from 10 December 2026?
- A solicitor-reviewed, sector-specific Kit. The middle option: documents written for property work and reviewed by Matthew Hodgkinson, an Australian practising solicitor (Papillon Lawyers), that you tailor to your agency. One annual price covers all fourteen documents and their updates, rather than a fee for each document.
- Bespoke drafting by your own lawyer. The most tailored, the most expensive, and worth it when your circumstances are genuinely unusual or something has gone wrong.
A Kit sits deliberately between a generic template and bespoke drafting. It won't, on its own, make you compliant: that depends on how you complete and apply the documents. But it removes most of the hard work and the guesswork.
When do you genuinely need a lawyer?
A template Kit is not a substitute for advice when the situation is specific to you. Engage a privacy lawyer if:
- You have a live complaint or dispute: an OAIC inquiry, a tenant or vendor complaint, or a threatened claim. Since 10 June 2025 an individual can also sue directly for a serious invasion of privacy, without proving loss, though Sch 2 cl 7(1)(c) requires the invasion to be intentional or reckless, so carelessness alone will not ground it.
- You have an actual or suspected data breach: under the Notifiable Data Breaches scheme, s 26WH(2) puts the assessment on the entity itself, and requires all reasonable steps to complete it within 30 days. In Australian Information Commissioner v Australian Clinical Labs Ltd (No 2) [2025] FCA 1224 the Federal Court ordered A$5.8m, A$800,000 of it for the slow assessment and A$800,000 for the failure to notify.
- Your set-up is unusual: offshore data storage or overseas contractors, a franchise or multi-entity structure, an acquisition, or a novel data product or platform.
- You are a reporting entity working through AML/CTF: from 31 March 2026, AML/CTF Tranche 2 draws property-sale work into the AUSTRAC regime, with the program, due diligence, reporting and record-keeping obligations applying from 1 July 2026, and the interaction with your privacy obligations can warrant advice.
For a live dispute or a breach in progress, get advice quickly. A Kit prepares you; it doesn't represent you.
At a glance
| Situation | Template Kit | Privacy lawyer |
|---|---|---|
| Standard privacy policy, collection notice, breach plan | Usually enough | Not required by the Act |
| Ordinary open-home / rental / sales collection | Well covered | Not typically required |
| Live complaint, OAIC inquiry or threatened claim | Not a substitute | Yes: get advice |
| Actual or suspected data breach | Prepares you; not a substitute | Yes: get advice |
| Offshore data, franchise, acquisition, novel product | Starting point only | Yes: advice recommended |
Why is "solicitor-reviewed" the point?
The value of a good Kit is that a solicitor has already read the documents. All fourteen Privaproof documents were reviewed by Matthew Hodgkinson, an Australian practising solicitor (Papillon Lawyers): the three core documents on 14 July 2026, the remaining eleven by 29 July 2026, recorded in the changelog. That is a legal eye over standard documents without paying for bespoke drafting of each one. It is tools and general information, not legal advice, and it doesn't replace your own lawyer when you genuinely need one.
Common questions
Do I legally need a lawyer to have a privacy policy?
No. There is no legal requirement to have a lawyer draft your privacy policy. You must have a clear, current policy that meets APP 1.3 and 1.4, but you can adopt a solicitor-reviewed template and tailor it to your agency. The OAIC publishes its own guide to help entities prepare one.
Is a template kit enough, or is it risky?
For standard privacy documents, a solicitor-reviewed, real-estate-specific Kit is generally enough, on one condition: you have to tailor it, so the documents describe how your agency actually collects, uses and discloses information. It sits between a free template and bespoke drafting. It isn't enough for a live dispute, a breach, or an unusual set-up: those need a lawyer.
How much does a privacy lawyer cost versus a kit?
Legal fees are quoted per matter, and what you get is a document fixed at the date it was drafted. The Privaproof Kit is a flat A$539/yr incl GST founding price (our standard price for the real-estate Kit is A$649/yr incl GST from 1 October 2026), covering all fourteen documents and their updates. If you do get a quote for bespoke drafting, ask whether the fee includes updating the documents when the law moves.
When should I definitely call a privacy lawyer?
Call a lawyer for a live complaint or OAIC inquiry, an actual or suspected data breach, a threatened claim, or an unusual set-up such as offshore data, a franchise or multi-entity structure, or an acquisition. For these, a template is a starting point, not a substitute for advice.
→ See where your agency stands: free 2-minute self-audit · Explore the Kit
This is general information, not legal advice. Privaproof provides tools and general information; it is not a law practice. For advice about your agency's specific circumstances, consult a lawyer. Sources: OAIC the Privacy Act; OAIC Australian Privacy Principles; OAIC guide to developing an APP privacy policy; OAIC Notifiable Data Breaches scheme.