Does consent transfer when we buy the database?

Generally no. In the ACMA's words, express consent means the person "knows and accepts that they will receive marketing emails or messages from you", and inferred consent needs "a provable, ongoing relationship with your business". A different business sending different messages is neither. Two qualifications worth knowing, because the answer is not always a flat no: How the consent was originally framed matters. Where the wording genuinely extended to a successor or to the business rather than the individual sender, there may be something to rely on. That is a question about the actual words used, so ask the vendor for the consent records rather than accepting an assurance. Continuity of service is usually not marketing, but the test is the purpose of the message. A message is commercial if one of its purposes is to promote goods, services, land or a supplier of them (s 6(1)), so a plain notice telling a landlord who now manages their property is not marketing. The ACMA warns that "breaches can occur even if a message is mostly 'factual'", so ask what the last paragraph of your transfer notice is doing. What you should not do is treat a spreadsheet with a "subscribed" column as ev

Can we market to a database we bought or inherited with a rent roll?

Not on the strength of the purchase. Consent under the Spam Act is given to a particular sender for particular messages, so it does not transfer with a business asset, and buying the data does not buy the permission. Before any email or SMS you need consent that covers you, and there is no bulk threshold, so a single message to one inherited contact is enough to contravene. The data transfer itself is a separate question under the Privacy Act.

By Jon Oates, Founder of Privaproof · Last updated 9 September 2026 · Start the free 2-min audit →

General information, not legal advice. Your obligations depend on your circumstances.

Does this apply to your agency?

The Privacy Act binds “organisations”. An agency whose annual turnover for the previous financial year was more than A$3 million is one (ss 6C, 6D, 6DA). Turnover is the income the business itself earns in the course of carrying it on, so for an agency that is commission, management and letting fees and referral income. Rent you collect for a landlord and hold in trust is generally the landlord’s money passing through rather than your income, so a large rent roll does not by itself put you near the threshold. If it is close enough to decide the answer, check the figure with your accountant. Note also that once turnover has exceeded A$3 million in a financial year that has ended, the exemption does not return by later dropping below it (s 6D(4)(a)). A smaller agency is generally exempt, but is still covered if any of these apply: it provides AML/CTF designated services, i.e. brokering the sale, purchase or transfer of real estate (since 31 March 2026, for the personal information it handles in connection with those obligations, s 6E(1A)); it is related to a body corporate that is not a small business operator, such as a group or franchise entity (s 6D(9)); it operates a residential tenancy database (s 6E(2)); it is a contracted service provider under a Commonwealth contract (s 6D(4)(e)); it trades in personal information (s 6D(4)(c)–(d), subject to the consent and authorised-by-law carve-outs in s 6D(7)–(8)); or it has opted in (s 6EA). Merely listing a tenant on, or searching, someone else’s database does not automatically make you covered. Work out whether the Privacy Act applies to you. Privacy Act 1988 (Cth) ss 6C, 6D, 6DA, 6E.

Note that the Spam Act applies to your messages whether or not the Privacy Act binds your business.

Not sure it's you?

Does this apply to you?

Tap what's true for your agency. Nothing is saved.

We collect ID from buyers or sellers Our agency turns over under $3m We keep client records digitally We use a rent-roll or PM CRM

Tap what's true above to see where you stand.

Check the Kit against your setupA$539 / year incl GST · founding price, rising to A$649 on 1 Oct 2026

Orientation only, not a compliance assessment. General information and tools, not legal advice.

Generally no. In the ACMA's words, express consent means the person "knows and accepts that they will receive marketing emails or messages from you", and inferred consent needs "a provable, ongoing relationship with your business". A different business sending different messages is neither.

Two qualifications worth knowing, because the answer is not always a flat no:

How the consent was originally framed matters. Where the wording genuinely extended to a successor or to the business rather than the individual sender, there may be something to rely on. That is a question about the actual words used, so ask the vendor for the consent records rather than accepting an assurance.
Continuity of service is usually not marketing, but the test is the purpose of the message. A message is commercial if one of its purposes is to promote goods, services, land or a supplier of them (s 6(1)), so a plain notice telling a landlord who now manages their property is not marketing. The ACMA warns that "breaches can occur even if a message is mostly 'factual'", so ask what the last paragraph of your transfer notice is doing.

What you should not do is treat a spreadsheet with a "subscribed" column as evidence. The ACMA is blunt: "Under the Spam Act, it's up to you to prove that you have a person's consent." Ask what the person was actually shown, and when.

Sources: Spam Act 2003 (Cth), s 16(1), (2) and (5) and Sch 2 cl 2 (consent); Privacy Act 1988 (Cth), APP 7 (Schedule 1) · ACMA spam rules

What should we get from the vendor at the point of sale?

Treat this as due diligence, because after settlement the exposure is yours and the vendor is gone.

Ask for, in writing:

The consent records themselves, per contact where they exist: what wording the person agreed to, when, and by what mechanism.
The source of each contact. Where it came from, when it was collected, and whether it was collected by the vendor or acquired from someone else. You will need this, see the source-request point below.
The suppression list. Everyone who has previously unsubscribed or asked to stop. Inheriting a database without the opt-out list is how a business emails the one person who has already objected twice.
A warranty and an indemnity on the lawfulness of collection and consent. It does not fix a contravention, but it prices the risk and it concentrates the vendor's mind during negotiation.

If none of that exists, you have bought a contact list you cannot market to. That is worth knowing before you pay for it.

Sources: Spam Act 2003 (Cth); Privacy Act 1988 (Cth), APP 5 and APP 7 (Schedule 1) · ACMA spam rules

Can we email the list to ask them to opt in?

No, and this is the single most common attempted fix.

A message asking somebody to subscribe is itself a commercial electronic message, so it needs prior consent in its own right. The ACMA is explicit: "You cannot send an electronic message to ask for consent, because this is a marketing message." The permission request is the contravention it was meant to cure.

There is no bulk threshold in the Spam Act. Section 16(1) is worded on "a commercial electronic message", singular, so sending it one at a time rather than as a campaign does not help.

What you can do instead:

Suppress rather than delete. Segment the unconsented contacts out of all sending, but keep the record so nobody re-imports them in six months.
Collect consent at a genuine interaction. When they enquire, attend an inspection, or you speak to them for a reason you already had, ask then and record it.
Use channels that are not electronic messages. An addressed letter is not caught by the Spam Act, which reaches only messages sent over a carriage service to an email, messaging or telephone address (s 5(1)), though APP 7 still governs the use of the personal information if the Privacy Act binds you.
Calls are a different regime again. A voice call is not an electronic message (s 5(5)), so prospecting calls engage the Do Not Call Register Act: wash the numbers, and a check clears those it reports unregistered for 30 days (s 11(1), (3)).

Sources: Spam Act 2003 (Cth); Do Not Call Register Act 2006 (Cth); Privacy Act 1988 (Cth), APP 7 (Schedule 1) · ACMA spam rules · See also cold-calling property owners and the DNC Register

Someone asks where we got their details. Do we have to tell them?

Yes, if the Privacy Act binds you, and this is the obligation that exposes an inherited list.

APP 7.8 switches APP 7 off only to the extent that the Spam Act or the Do Not Call Register Act applies, and neither gives anyone a right to be told where their details came from. So where the Privacy Act binds you, an individual can ask you to stop using or disclosing their information for direct marketing, ask you not to facilitate other organisations' direct marketing, and ask you to identify the source. You must give effect within a reasonable period and free of charge, and notify the source unless it is impracticable or unreasonable (APP 7.6, 7.7).

On an inherited database the honest answer is often "we acquired it from X when we bought their rent roll", which is exactly the answer that prompts a complaint if the person never dealt with X either. That is a reason to fix the list, not a reason to avoid answering.

Practically: record the source per contact at the point you import, not later. A field you can query is the difference between answering in a minute and reconstructing a chain of custody under pressure.

Sources: Privacy Act 1988 (Cth), APP 7.6 (Schedule 1) · OAIC APP Guidelines chapter 7 · OAIC APP guidelines

Does buying a list affect our small-business exemption?

It can, and the limb that catches it is not the one most people expect.

Section 6D removes the small-business exemption from an operator that trades in personal information. One limb is disclosing personal information about another individual to anyone else for a benefit, service or advantage (s 6D(4)(c)). The other is providing a benefit, service or advantage to collect personal information about another individual from anyone else (s 6D(4)(d)), which is paying for data rather than being paid to gather it. Paying for a contact list is the second of those.

There are carve-outs, and both turn on consent. Section 6D(7) means a disclosure does not cost you the exemption only because you disclosed, where the other individual consented or legislation required or authorised it, and s 6D(8) does the same for a collection you paid for. So a transfer the individuals actually consented to sits outside the trading analysis. Do the consent records you were shown say anything about a transfer?

The practical implication for a smaller business is that if you pay for the data and the individuals did not consent to that collection, s 6D(4)(d) is met on facts you control, and a business that was exempt the day before is an organisation bound by the APPs.

Sources: Privacy Act 1988 (Cth), s 6D(4)(d) (provides a benefit, service or advantage to collect personal information about another individual from anyone else) and its carve-out at s 6D(8) (the collection is with the individual's consent, or is required or authorised by or under legislation); the companion disclosure limb is s 6D(4)(c) with its carve-out at s 6D(7). Lettering confirmed against Compilation No. 104, compilation date 4 June 2026 · OAIC APP Guidelines chapter B · OAIC APP guidelines · See also selling a rent roll

→ The free 2-minute audit covers the contact data a business holds and whether it can actually be used.