Do real estate agents need a privacy policy and a collection notice?
If the Privacy Act applies to your agency, then yes, you need both. APP 1.3 requires a clearly-expressed, up-to-date privacy policy, APP 1.4 sets out what it must contain, and APP 5 requires you to give a collection notice when you collect someone's personal information. All three bind APP entities, so an exempt small business is not caught by that route. The exemption is not permanent, though: s 6D(4)(a) puts a business outside it once any completed financial year has had an annual turnover of more than $3,000,000, and a later fall does not undo that.
By Jon Oates, Founder of Privaproof · Last updated · Start the free 2-min audit →
General information, not legal advice. Your obligations depend on your circumstances.
Not sure it's you?
Does this apply to you?
Tap what's true for your agency. Nothing is saved.
Orientation only, not a compliance assessment. General information and tools, not legal advice.
What must the privacy policy (APP 1) contain?
A compliant policy is more than a page on your website; under APP 1.4 it must set out specified content, including:
| Must cover |
|---|
| The kinds of personal information you collect and hold |
| How you collect and hold it, and why |
| How someone can access or correct their information |
| How to complain, and how you'll handle it |
| Whether you're likely to disclose information overseas (and, if practicable, which countries) |
A generic template that doesn't match how your agency actually operates can look compliant but miss the APP 1.4 content. That content is exactly what the OAIC's 2026 privacy sweep assessed: it reviewed the privacy policies of approximately 60 entities across six sectors, rental and property among them, and in a 20 May 2026 keynote the Commissioner said the sweep "found instances of non-compliance in a significant proportion".
What is the collection notice (APP 5)?
Separately, when you collect personal information (from a tenant, applicant, landlord or buyer), APP 5.1 requires you to take such steps as are reasonable in the circumstances to notify the individual, at or before collection or, if that is not practicable, as soon as practicable after, of the APP 5.2 matters: who you are, why you're collecting it, and who you usually disclose that kind of information to. Your privacy policy is not a substitute. The OAIC's APP guidelines note it "may describe only the general information handling practices of the entity", so the notice is a distinct, at-the-point-of-collection step.
How to check your own policy and notices
Three checks you can run on your own material, against the law rather than a benchmark: does the policy cover all seven APP 1.4 matters; is a collection notice actually given at the point of collection on rental applications and open-home sign-in sheets, rather than a link to the policy; and if the CRM, trust accounting or admin support sits offshore, does the policy say so and, where practicable, name the countries (APP 1.4(f) and (g))?
Common questions
What must a privacy policy contain under APP 1.4?
The kinds of personal information you collect and hold, how you collect and hold it and why, how someone can access or correct their information, how to complain and how you'll handle it, and whether you're likely to disclose information overseas (and, if practicable, which countries).
Does my privacy policy also count as a collection notice?
No. APP 5 is a separate obligation. The OAIC's APP guidelines say a privacy policy "may describe only the general information handling practices of the entity", so it will not cover the APP 5 matters for a particular collection; the collection notice is a distinct, at-the-point-of-collection step.
When do I have to give a collection notice?
At or before the time you collect personal information from a tenant, applicant, landlord or buyer or, if that is not practicable, as soon as practicable after (APP 5.1). The steps required are those that are reasonable in the circumstances, and the matters include who you are, why you're collecting it, and who you usually disclose that kind of information to.
How do I check my own policy and collection notices?
Against the law rather than a benchmark: does the policy cover all seven APP 1.4 matters; is a collection notice actually given on the rental application and the open-home sign-in, rather than a link to the policy; and if the CRM, trust accounting or admin support sits offshore, does the policy say so and name the countries where that is practicable (APP 1.4(f) and (g))?
How does Privaproof help?
The Privaproof Kit includes an APP 1.4 privacy policy and the matching APP 5 collection notices written for the ways a real-estate agency actually collects information (rental applications, open homes, appraisals and AML identity checks), reviewed by Matthew Hodgkinson, an Australian practising solicitor (Papillon Lawyers), and kept current as the rules change. They're templates you tailor to your agency: tools and general information, not legal advice.
How does Privaproof help?
The Privaproof Kit includes an APP 1.4 privacy policy and the matching APP 5 collection notices written for the ways a real-estate agency actually collects information (rental applications, open homes, appraisals and AML identity checks), reviewed by Matthew Hodgkinson, an Australian practising solicitor (Papillon Lawyers), and kept current as the rules change. They're templates you tailor to your agency: tools and general information, not legal advice.
How does Privaproof help?
The Privaproof Kit includes an APP 1.4 privacy policy and the matching APP 5 collection notices written for the ways a real-estate agency actually collects information (rental applications, open homes, appraisals and AML identity checks), reviewed by Matthew Hodgkinson, an Australian practising solicitor (Papillon Lawyers), and kept current as the rules change. They're templates you tailor to your agency: tools and general information, not legal advice.
Check yours in 2 minutes: free self-audit →
This is general information, not legal advice. Privaproof provides privacy tools and general information; it is not a law practice and does not provide legal advice. Sources: OAIC: APP 1 open and transparent management of personal information; OAIC: APP 5 notification of the collection of personal information; Privacy Act 1988 (Cth) Sch 1, APPs 1 and 5.