Do I need a privacy lawyer for my real estate agency, or is a template kit enough?
Most Australian agencies don't engage a lawyer individually just to produce their standard privacy documents. A solicitor-reviewed, real-estate-specific template Kit is usually enough for a privacy policy, collection notice and breach plan. You do need a lawyer for the non-standard situations: a live complaint or dispute, an actual data breach, or an unusual business set-up.
By Jon Oates, Founder of Privaproof · Last updated · Start the free 2-min audit →
General information, not legal advice. Your obligations depend on your circumstances.
Not sure it's you?
Does this apply to you?
Tap what's true for your agency. Nothing is saved.
Orientation only, not a compliance assessment. General information and tools, not legal advice.
Do most agencies hire a lawyer for their privacy documents?
Generally, no. A privacy policy, an APP 5 collection notice and a data-breach plan are standard documents that most agencies of a similar size and structure need in a similar form. Paying a lawyer to draft each one from scratch is expensive for something that is, for the vast majority of agencies, well-trodden ground.
The Privacy Act 1988 (Cth) applies to real-estate agencies in the same way it applies to comparable businesses, and the Australian Privacy Principles set out what your documents must contain. If your agency's collection practices are ordinary (open homes, rental applications, sales listings) your documents will look much like the next agency's. See our overview of whether the Privacy Act applies to real estate agents.
What are your three options?
There are really three paths, and the honest framing is that they are not equal in risk or cost:
- DIY from a free or generic template. Cheapest, but generic templates aren't written for real estate and go stale, and you are guessing at what "enough" looks like.
- A solicitor-reviewed, sector-specific Kit. The middle option: documents written for property work and reviewed by Matthew Hodgkinson, an Australian practising solicitor (Papillon Lawyers), that you tailor to your agency. Far cheaper than bespoke drafting, far safer than guessing.
- Bespoke drafting by your own lawyer. The most tailored, the most expensive, and worth it when your circumstances are genuinely unusual or something has gone wrong.
A Kit sits deliberately between risky DIY and expensive bespoke drafting. It won't, on its own, make you compliant: that depends on how you complete and apply the documents. But it removes most of the hard work and the guesswork.
When do you genuinely need a lawyer?
A template Kit is not a substitute for advice when the situation is specific to you. Engage a privacy lawyer if:
- You have a live complaint or dispute: an OAIC inquiry, a tenant or vendor complaint, or a threatened claim (including a serious-invasion-of-privacy action).
- You have an actual or suspected data breach: the Notifiable Data Breaches scheme has strict assessment and notification steps, and getting them wrong carries real consequences.
- Your set-up is unusual: offshore data storage or overseas contractors, a franchise or multi-entity structure, an acquisition, or a novel data product or platform.
- You are a reporting entity working through AML/CTF: from 1 July 2026, AML/CTF Tranche 2 draws property-sale work into the AUSTRAC regime, and the interaction with your privacy obligations can warrant advice.
For a live dispute or a breach in progress, get advice quickly. A Kit prepares you; it doesn't represent you.
At a glance
| Situation | Template Kit | Privacy lawyer |
|---|---|---|
| Standard privacy policy, collection notice, breach plan | Usually enough | Rarely needed just for this |
| Ordinary open-home / rental / sales collection | Well covered | Not typically required |
| Live complaint, OAIC inquiry or threatened claim | Not a substitute | Yes: get advice |
| Actual or suspected data breach | Prepares you; not a substitute | Yes: get advice |
| Offshore data, franchise, acquisition, novel product | Starting point only | Yes: advice recommended |
Why is "solicitor-reviewed" the point?
The value of a good Kit is that a lawyer has already looked at the documents. All fourteen Privaproof documents were reviewed by Matthew Hodgkinson, an Australian practising solicitor (Papillon Lawyers). That gives you the assurance of a legal eye over standard documents without paying for bespoke drafting of each one. It is tools and general information, not legal advice, and it doesn't replace your own lawyer when you genuinely need one.
Common questions
Do I legally need a lawyer to have a privacy policy?
No. There is no legal requirement to have a lawyer draft your privacy policy. You must have a clear, current policy that meets APP 1, but you can adopt a solicitor-reviewed template and tailor it to your agency. Most agencies do exactly that rather than commissioning bespoke drafting.
Is a template kit enough, or is it risky?
For standard privacy documents at an ordinary agency, a solicitor-reviewed, real-estate-specific Kit is generally enough and far less risky than a generic free template you complete blindly. It sits between DIY and bespoke drafting. It isn't enough for a live dispute, a breach, or an unusual set-up: those need a lawyer.
How much does a privacy lawyer cost versus a kit?
Bespoke drafting by a lawyer typically runs into the hundreds or thousands of dollars per matter and produces a static document. A maintained Kit like Privaproof is a flat A$539/yr incl GST and is kept current as the law changes. A lawyer is still the right call for disputes, breaches and unusual circumstances.
When should I definitely call a privacy lawyer?
Call a lawyer for a live complaint or OAIC inquiry, an actual or suspected data breach, a threatened claim, or an unusual set-up such as offshore data, a franchise or multi-entity structure, or an acquisition. For these, a template is a starting point, not a substitute for advice.
→ See where your agency stands: free 2-minute self-audit · Explore the Kit
This is general information, not legal advice. Privaproof provides tools and general information; it is not a law practice. For advice about your agency's specific circumstances, consult a lawyer. Sources: OAIC the Privacy Act; OAIC Australian Privacy Principles; OAIC Notifiable Data Breaches scheme.