Skip to content

Can we list a defaulting tenant on a tenancy database?

Much less often than the industry assumes. Listing is available only after the tenancy has ended, only against a named former tenant, and only on narrow grounds. Falling behind in rent is never, by itself, enough. You must give the tenant a copy of what you propose to list and at least 14 days to object, and consider what they say. Where family or domestic violence is anywhere in the picture, do not list and get advice.

By Jon Oates, Founder of Privaproof · Last updated · Start the free 2-min audit →

General information, not legal advice. Tenancy-database rules are state and territory law and they differ. Your obligations depend on your circumstances and your jurisdiction.

The tenancy-law rules on this page bind you whether or not the Privacy Act does, and a tenancy-database operator is bound by the APPs regardless of its turnover.

Not sure it's you?

Does this apply to you?

Tap what's true for your agency. Nothing is saved.

Tap what's true above to see where you stand.
Check the Kit against your setupA$539 / year incl GST · founding price, rising to A$649 on 1 Oct 2026

Orientation only, not a compliance assessment. General information and tools, not legal advice.

What has to be true before you can list anyone?

Every Australian state and territory regulates this, under broadly aligned provisions that nonetheless differ in detail. The common floor:

Arrears alone is never enough. The ground is the size of what is owed, or a tribunal order: NSW s 212(1)(c), Victoria s 439E(1)(c) and SA s 99F(1)(c) each require the debt to exceed the bond, or a termination or possession order. Ask what the section asks: is the reconciled amount owing more than the bond, and can you show it?

What if the tenant left because of family or domestic violence?

Do not list, and get advice. The absence of a statutory ban is not permission.

An express statutory prohibition exists in only two of the eight jurisdictions, and one of them is narrow:

Everywhere else it is a discretion, not a ban. In Queensland (s 461(3)(b)), the ACT (s 99(3)(b)) and the Northern Territory (s 134(2A)) family violence is a ground on which a tribunal may order a listing removed or barred, and Queensland can bar one outright under s 245(6). In Western Australia a listing is unjust where the circumstances result from family violence, but the order comes from a court (s 82J(2A)). South Australia has no "unjust" ground at all: its only anti-listing power is s 89A(4)(d), made in a domestic-abuse termination proceeding, and it is prospective only. Tasmania's database Part has no family-violence provision.

So the honest position is that in most of Australia nothing stops you listing. That is a reason for more care, not less. The statutes put the case themselves: Queensland's worked example of an unjust listing is a tenant listed for damage a domestic associate caused during a domestic violence incident, who then cannot obtain appropriate and affordable accommodation (s 461(3)(b), example 1; the ACT example at s 99(3)(b) is the same). A listing can stand for three years, and the exposure of having made it does not go away when it is removed.

If family violence appears anywhere in the tenancy history, stop before lodging anything and get advice.

One duty that is not discretionary: in Victoria, once the residential rental provider becomes aware that listed information relates to family or personal violence the person experienced, they must tell the operator within 7 days that it must be removed: s 439G(1)(b) and (2)(c), 150 penalty units for an individual and 750 for a body corporate. The duty is the provider's, not the agent's.

Sources: Residential Tenancies Act 2010 (NSW) ss 211 to 218, current version for 10 June 2026 · Residential Tenancies Act 1995 (SA) ss 89A(4)(d) and 99F to 99L, authorised version 15.1.2026 · Residential Tenancies Act 1997 (Vic) ss 439E to 439K, Authorised Version 113 · Residential Tenancies and Rooming Accommodation Act 2008 (Qld) ss 245 and 458 to 462, as at 17 August 2026 · Residential Tenancies Act 1987 (WA) s 82J · Residential Tenancy Act 1997 (Tas) ss 48ZE and 48ZF · Residential Tenancies Act 1997 (ACT) ss 87 to 101 · Residential Tenancies Act 1999 (NT) ss 123 to 134, each read at source for this page.

⚠️ What we have and have not read. All eight jurisdictions were read at source for the family-violence, notice and correction provisions above, at the versions listed. We have not re-read every jurisdiction's full listing preconditions, so the bullets at the top of this page describe the pattern they share rather than any single Act. Where a section number is not printed, nobody here has checked it, and a citation nobody has checked is worse than none.

How long can a listing stay, and what happens if it is wrong?

Listings do not last forever, but note whose duty that is: the three-year limit falls on the database operator, not on you (NSW s 218, Victoria s 439K, Queensland s 459D). Do not assume a listing you made drops off because you left it alone, and do not tell a tenant you will remove it on that basis. Your own hook is the duty below, which is triggered by a listing being wrong or out of date.

If the tenant later says the listing is wrong, a much shorter clock applies than anything in the Privacy Act: whoever made the listing must notify the database operator within 7 days of becoming aware, and the operator must amend or remove within 14 days (NSW ss 214 and 215, Victoria ss 439G and 439H, Queensland ss 459A and 459B, SA ss 99H and 99I). ⚠️ In Victoria the duty is the rental provider's, not the agent's (s 439G(1)). Work to the state clock, not the APP 13 benchmark.

Sources: the relevant state or territory Residential Tenancies Act; Privacy Act 1988 (Cth), APP 13 (Schedule 1) · See also a disputed tenancy-database listing

What does the Privacy Act add on top?

The disclosure to the database operator is a use or disclosure of personal information, so APP 6 applies. And APP 10.2 requires such steps as are reasonable in the circumstances to ensure information you disclose is accurate, up-to-date, complete and relevant, having regard to the purpose of the disclosure. Reconcile the ledger before you lodge anything: an unreconciled figure is the case APP 10.2 is aimed at, and the listing it produces can stand for three years.

The database operator is bound by the APPs for its database activities regardless of its turnover, because operating a residential tenancy database is itself a trigger under s 6E(2). Note the limit of that: merely listing a tenant on, or searching, someone else’s database does not make your business covered. Whether the Privacy Act binds you is the separate turnover-and-triggers question in the box above.

And "residential tenancy database" is narrower than it sounds. The Regulations define it as a database that does both of two things: it stores personal information about an individual's occupation of residential premises as a tenant, and it can be accessed by someone other than the operator or a person acting for the operator. Both limbs have to be met. So an internal list kept inside your own agency, that nobody outside it can reach, is not a residential tenancy database on that definition, and keeping one does not make you an operator.

⚠️ That is a narrow point and it is not permission. If the Act binds you for some other reason, the APPs apply to whatever is on that list, and the accuracy and fairness duties bite in the ordinary way. Tenancy law may also have something to say about how you use it. The only thing limb (b) settles is that an internal list does not, by itself, turn you into a database operator.

Sources: Privacy Act 1988 (Cth), APP 6 and APP 10.2 (Schedule 1), and s 6E(2) with the Privacy Regulations 2025 (Cth) ss 5 and 7(1)-(2) (commenced 1 April 2026), which prescribe a small business operator that operates a residential tenancy database, confine that coverage to the prescribed database acts and practices, and define the database itself in the two-limb terms above ✅ (`CLAIMS-LEDGER.json`, VERIFIED)

✅ The Regulations were read at source on 2026-08-02, so the pinpoints above are pinned rather than inferred: the authorised PDF of `F2025L01377`, 17 pages, every page footed "Authorised Version F2025L01377 registered 14/11/2025". ⚠️ It is drafted with sections, not regs, which is why the citation reads `s 7` and not `reg 7`, and the instrument is the Privacy Regulations 2025, whose Schedule 1 repealed the Privacy Regulation 2013 that older guidance still names. · OAIC APP Guidelines chapters 6 and 10 · OAIC APP guidelines

→ The free 2-minute audit covers the disclosure points most likely to cause real harm, including database listings.