Home › Guides › Does the Privacy Act apply to real estate agents in Australia?

Does the Privacy Act apply to real estate agents in Australia?

Yes, for many agencies, and increasingly so. Businesses with annual turnover of A$3 million or less have generally been exempt under the Privacy Act 1988 (Cth) "small business exemption." But several exceptions can override that, and since 31 March 2026, agencies providing property-sale services have been drawn in for part of their operations, because that is when brokering a property sale became a designated service, regardless of turnover.

By Jon Oates, Founder of Privaproof · Last updated 9 September 2026 · Start the free 2-min audit →

General information, not legal advice. Your obligations depend on your circumstances.

Want to check your own agency rather than read the general position? The Am I Covered? check walks you through the four questions that decide it, in about two minutes.

Most agents have heard the shorthand: under A$3 million turnover, you're exempt. It was never quite that simple, and since 31 March 2026 it's less true again. Here's who's actually caught, and why turnover is only the starting point.

What is the small-business exemption?

Under section 6D of the Privacy Act 1988 (Cth), a business whose annual turnover for the previous financial year was A$3 million or less is generally exempt from the Act and the Australian Privacy Principles (APPs). Many small agencies have relied on this, but the exemption is not automatic, and it falls away in several common situations.

When does the small-business exemption NOT apply?

Your agency may be covered by the Privacy Act, even under $3m turnover, if it:

Whether an ordinary agency "trades in" personal information is fact-specific. Sections 6D(7) and 6D(8) each carry two carve-outs: the disclosure or collection is not caught if the individual consented, or if it was required or authorised by or under legislation, and "authorised" is materially wider than "required". Tenancy databases sit under a different provision, and it catches the operator, not the user: Privacy Regulations 2025 s 7(1), made under s 6E(2), prescribes a small business operator that operates a database other people can access. Searching TICA or NTD, or listing a tenant on one, is not that trigger.

How does the 31 March 2026 AML change affect real-estate agents?

From 31 March 2026, real-estate agencies providing designated services around property transactions (buying and selling) have been reporting entities under the Anti-Money Laundering and Counter-Terrorism Financing Act. The obligations applied from 1 July 2026, with AUSTRAC enrolment due by 29 July 2026 for agencies already providing those services. Whether a particular agency is caught depends on the specific designated services it provides.

Here's the privacy link, and it's narrower than the headlines suggest: under section 6E(1A) of the Privacy Act, a small reporting entity is treated as an organisation only in relation to the activities it carries on for the purposes of, or in connection with, its AML/CTF obligations, even below the $3m threshold. That is wider than a photocopied licence: section 28(2) customer due diligence reaches beneficial owners, politically-exposed-person and sanctions screening, and the nature and purpose of the relationship, and section 111(3)(b) requires records of the risk analysis and decisions you made about a named customer, kept for seven years after the relationship ends.

It does not pull the rest of your agency into the Act. "Real estate" is defined to exclude a leasehold of 30 years or less, so ordinary residential leasing, and commercial leasing on terms of 30 years or less, is not a designated service at all. Rent rolls and general marketing stay outside this trigger.

Note: this is separate from the proposed reform that would remove the small-business exemption entirely; that is not law as at 2026.

Does the exemption protect you from everything?

No. The statutory tort of serious invasion of privacy, in Schedule 2 of the Privacy Act, gives an individual a cause of action against "another person" (cl 7(1)). It is not limited to entities covered by the Australian Privacy Principles, and cl 6(3) directs that the rest of the Act be disregarded in construing the Schedule. Being exempt from the APPs is not the same as being beyond reach. The tort does have real limits, though: cl 7(1)(c) requires the invasion to have been intentional or reckless, and cl 7(1)(d) requires it to be serious, so carelessness or an honest mistake is not enough to found a claim.

So, is your agency caught?

You're more likely to be covered if you: handle property sales (since 31 March 2026), turn over more than $3m or ever have, are part of a larger group, or disclose client data in ways that count as "trading." And even if you're technically exempt, it is worth checking what your CRM contract, your franchisor agreement and your supplier terms already commit you to.

The fastest way to see where your agency actually stands, across the obligations that apply to you, is the free 2-minute Privacy Readiness self-audit.

Start the free 2-minute self-audit →

This is general information, not legal advice, and does not assess the AML/CTF Act, Spam Act, Do-Not-Call Register or state tenancy laws. Sources: Office of the Australian Information Commissioner (oaic.gov.au); Privacy Act 1988 (Cth).