Do real estate agents need a privacy policy and a collection notice?
If the Privacy Act applies to your agency, then yes, you need both. APP 1 requires a clearly-expressed, up-to-date privacy policy containing specified information, and APP 5 requires you to give a collection notice when you collect someone's personal information. Even agencies that are technically exempt increasingly need them, because clients, landlords and suppliers expect it.
By Jon Oates, Founder of Privaproof · Last updated · Start the free 2-min audit →
General information, not legal advice. Your obligations depend on your circumstances.
Not sure it's you?
Does this apply to you?
Tap what's true for your agency. Nothing is saved.
Orientation only, not a compliance assessment. General information and tools, not legal advice.
What must the privacy policy (APP 1) contain?
A compliant policy is more than a page on your website; under APP 1.4 it must set out specified content, including:
| Must cover |
|---|
| The kinds of personal information you collect and hold |
| How you collect and hold it, and why |
| How someone can access or correct their information |
| How to complain, and how you'll handle it |
| Whether you're likely to disclose information overseas (and, if practicable, which countries) |
A generic template that doesn't match how your agency actually operates can look compliant but fail; this is a common gap.
What is the collection notice (APP 5)?
Separately, when you collect personal information (from a tenant, applicant, landlord or buyer), APP 5 requires you to take reasonable steps to notify them, at or before collection, of matters such as who you are, why you're collecting it, and who you might disclose it to. The privacy policy alone doesn't satisfy this; the notice is a distinct, at-the-point-of-collection step.
Where do agencies fall short?
The three most common gaps: a policy that's generic or out of date, no collection notice on application forms, and missing overseas-disclosure information (when the CRM or admin sits offshore).
Common questions
What must a privacy policy contain under APP 1.4?
The kinds of personal information you collect and hold, how you collect and hold it and why, how someone can access or correct their information, how to complain and how you'll handle it, and whether you're likely to disclose information overseas (and, if practicable, which countries).
Does my privacy policy also count as a collection notice?
No. The privacy policy alone doesn't satisfy APP 5; the collection notice is a distinct, at-the-point-of-collection step given when you collect someone's personal information.
When do I have to give a collection notice?
At or before the time you collect personal information from a tenant, applicant, landlord or buyer, notifying them of matters such as who you are, why you're collecting it, and who you might disclose it to.
Where do agencies most often fall short?
A policy that's generic or out of date, no collection notice on application forms, and missing overseas-disclosure information when the CRM or admin sits offshore.
Check yours in 2 minutes: free self-audit →
General information, not legal advice. Sources: OAIC (oaic.gov.au); Privacy Act 1988 (Cth).