How long does a real-estate agency have to respond to an access request?

Q: What is the clock actually running on?

Responding, not finishing. Under APP 12.4(a)(ii) you must respond to the request within a reasonable period, and on the OAIC’s guidance you respond by giving access or by notifying a refusal. Giving access in the manner the person asked for is a separate obligation under APP 12.4(b), and no period is attached to it. Do not read that as breathing room. Because responding means giving access or notifying a refusal, an agency that is still compiling when the reasonable period expires has done neither, so an acknowledgement does not stop the clock. If a large compilation is going to run past the reasonable period, do three things before it expires: tell the person in writing that it will, give them a date, and give them access to the part you have already assembled. Partial access plus a dated commitment is a far better position than a complete file delivered late. (APP 12.4(a)(ii), APP 12.4(b).)

Q: What does APP 12 say about timing?

APP 12.4(a)(i) gives Commonwealth agencies 30 days. APP 12.4(a)(ii) requires organisations to respond within a reasonable period after the request is made. APP 12.4(b) deals separately with giving access in the manner requested, where reasonable and practicable. Where you refuse access, or refuse to give it in the manner requested, APP 12.9 requires a written notice. (APP 12.4(a)(i), APP 12.4(a)(ii), APP 12.4(b).)

Within a reasonable period. The hard 30-day deadline in APP 12.4(a)(i) applies to Commonwealth agencies; a real-estate agency the Act covers is an organisation under APP 12.4(a)(ii) and gets "a reasonable period". That is not a longer deadline. The OAIC’s guidance is that, as a general guide, a reasonable period should not exceed 30 calendar days, judged against the scope of the request and whether your records can be readily located and assembled.

By Jon Oates, Founder of Privaproof · Last updated 26 July 2026 · Start the free 2-min audit →

General information, not legal advice. Your obligations depend on your circumstances.

Does this apply to your agency?

The Privacy Act binds “organisations”. An agency whose annual turnover for the previous financial year was more than A$3 million is one (ss 6C, 6D, 6DA). Turnover is the income the business itself earns in the course of carrying it on, so for an agency that is commission, management and letting fees and referral income. Rent you collect for a landlord and hold in trust is generally the landlord’s money passing through rather than your income, so a large rent roll does not by itself put you near the threshold. If it is close enough to decide the answer, check the figure with your accountant. Note also that once turnover has exceeded A$3 million in a financial year that has ended, the exemption does not return by later dropping below it (s 6D(4)(a)). A smaller agency is generally exempt, but is still covered if any of these apply: it provides AML/CTF designated services, i.e. brokering the sale, purchase or transfer of real estate (since 31 March 2026, for the personal information it handles in connection with those obligations, s 6E(1A)); it is related to a body corporate that is not a small business operator, such as a group or franchise entity (s 6D(9)); it operates a residential tenancy database (s 6E(2)); it is a contracted service provider under a Commonwealth contract (s 6D(4)(e)); it trades in personal information (s 6D(4)(c)–(d), subject to the consent and authorised-by-law carve-outs in s 6D(7)–(8)); or it has opted in (s 6EA). Merely listing a tenant on, or searching, someone else’s database does not automatically make you covered. Work out whether the Privacy Act applies to you. Privacy Act 1988 (Cth) ss 6C, 6D, 6DA, 6E.

Not sure it's you?

Does this apply to you?

Tap what's true for your agency. Nothing is saved.

We collect ID from buyers or sellers Our agency turns over under $3m We keep client records digitally We use a rent-roll or PM CRM

Tap what's true above to see where you stand.

Check the Kit against your setupA$539 / year incl GST · founding price, rising to A$649 on 1 Oct 2026

Orientation only, not a compliance assessment. General information and tools, not legal advice.

Why do so many agencies think they have 30 days?

Because of a word collision. In the Privacy Act, "agency" means a Commonwealth public-sector body such as a Minister or a Department (s 6(1)). A private real-estate agency is none of those; where the Act covers it, it is an "organisation" (s 6C). The hard 30-day rule in APP 12.4(a)(i) attaches to the agency limb, so it is not the statutory deadline that binds a private business.

That is worth knowing, but it is only half the answer, and taking it as licence to run long is the mistake. The OAIC’s APP Guidelines (chapter 12, paragraph 12.67) say that for an organisation, as a general guide, a reasonable period should not exceed 30 calendar days. So 30 days is not your entitlement, it is the regulator’s outer marker. Going past it is not automatically a breach, because guidance is not a statutory cap. But could you show today what took the extra time?

The same 30-day guide is applied to correction requests, under APP 13.5(a)(ii) and chapter 13, paragraph 13.63.

What is the clock actually running on?

Responding, not finishing. Under APP 12.4(a)(ii) you must respond to the request within a reasonable period, and on the OAIC’s guidance you respond by giving access or by notifying a refusal.

Giving access in the manner the person asked for is a separate obligation under APP 12.4(b), and no period is attached to it.

Do not read that as breathing room. Because responding means giving access or notifying a refusal, an agency that is still compiling when the reasonable period expires has done neither, so an acknowledgement does not stop the clock. If a large compilation is going to run past the reasonable period, do three things before it expires: tell the person in writing that it will, give them a date, and give them access to the part you have already assembled. Partial access plus a dated commitment is a far better position than a complete file delivered late.

What does "a reasonable period" mean in practice?

It is assessed against the circumstances: the OAIC lists the scope and clarity of the request, whether the information can be readily located and assembled, and whether consultation is needed. An agency with a tidy CRM and a defined process is in a very different position from one reconstructing a file from four inboxes, and "our records are a mess" is not a defence that improves with repetition.

A workable approach for a small agency:

Confirm who is asking before you collate anything. You must be satisfied the request comes from the individual, or from someone authorised to act for them. Verify proportionately, usually by matching details you already hold, and collect only the minimum needed to do it. Be careful about the channel in both directions: most requests come from former tenants whose contact details have changed, so do not act on new details supplied in the request itself without confirming the change independently through a channel you already have, and do not treat the details sitting on the file as automatically safe either, since those are the ones a former partner is most likely to control. Where a solicitor or advocate is acting, verify the authority, not the channel.
Acknowledge the request in writing straight away, so there is a dated starting point. An acknowledgement is not a response and does not stop the clock.
Tell the person what you are collating and when they will have it, then meet that date.
Work to a self-imposed internal deadline inside the 30-day marker rather than to the absence of a hard one.
If the request is very broad, it is legitimate to ask the person to narrow it, but asking must not become a delaying tactic.
Keep a dated record of each step, because a reasonable-period question is answered by your timeline, not by your intentions.

Remember that the request often arrives during a dispute. Handling it briskly and separately from the dispute is what stops it becoming a second front.

What does APP 12 say about timing?

APP 12.4(a)(i) gives Commonwealth agencies 30 days. APP 12.4(a)(ii) requires organisations to respond within a reasonable period after the request is made. APP 12.4(b) deals separately with giving access in the manner requested, where reasonable and practicable. Where you refuse access, or refuse to give it in the manner requested, APP 12.9 requires a written notice.

Sources: Privacy Act 1988 (Cth), ss 6(1) and 6C (the definitions of "agency" and "organisation"), APP 12.4 and APP 12.9, and APP 13.5(a)(ii) (Schedule 1) · OAIC APP Guidelines chapter 12, paragraph 12.66 (the agency limb) and paragraph 12.67 (the organisation limb, which is the one that applies to you); chapter 13, paragraph 13.63 · OAIC APP guidelines · legislation.gov.au

→ The free 2-minute audit checks whether your agency could actually assemble a tenant's file if it were asked today.