Can we use a tenant's details, collected for their lease, to market other properties to them?

Q: Is our collection notice enough to make marketing lawful?

Not for email or SMS, and it is worth stating bluntly: a collection-notice line saying "we may send you property updates" is not Spam Act consent. A notice tells; s 16(2) asks whether the account-holder consented, and s 16(5) puts the evidential burden of showing that on the sender. A collection notice does useful work. It sets the reasonable expectation that APP 7.2(b) turns on, where APP 7 is the operative rule, and it is required in its own right under APP 5.1. But the Spam Act asks a different question about the message itself, and it wants consent, not notification. So keep a clean record of consent per contact, and be able to say how you got it. Publication is not a shortcut: Sch 2 cl 4(1) says consent "may not be inferred from the mere fact that the relevant electronic address has been published", and the cl 4(2) exception reaches only work and role addresses of employees, officers and office-holders, never a tenant's personal address. Pick ten contacts and ask how consent arose for each. If you cannot answer, those contacts are a risk rather than an asset. (s 16(2), s 16(5), APP 7.2(b).)

Not automatically, and this is not an APP 6 question. APP 6.7 says APP 6 does not apply to the use or disclosure by an organisation of personal information for the purpose of direct marketing, because that is covered by APP 7. APP 7 is then itself displaced under APP 7.8 to the extent the Spam Act 2003 or the Do Not Call Register Act 2006 applies, and what drops away is the whole principle, the APP 7.6 opt-out and source-request rights included. So for an email or an SMS, the Spam Act is the operative law, and a line in your collection notice is not Spam Act consent.

By Jon Oates, Founder of Privaproof · Last updated 26 July 2026 · Start the free 2-min audit →

General information, not legal advice. Your obligations depend on your circumstances.

Does this apply to your agency?

The Privacy Act binds “organisations”. An agency whose annual turnover for the previous financial year was more than A$3 million is one (ss 6C, 6D, 6DA). Turnover is the income the business itself earns in the course of carrying it on, so for an agency that is commission, management and letting fees and referral income. Rent you collect for a landlord and hold in trust is generally the landlord’s money passing through rather than your income, so a large rent roll does not by itself put you near the threshold. If it is close enough to decide the answer, check the figure with your accountant. Note also that once turnover has exceeded A$3 million in a financial year that has ended, the exemption does not return by later dropping below it (s 6D(4)(a)). A smaller agency is generally exempt, but is still covered if any of these apply: it provides AML/CTF designated services, i.e. brokering the sale, purchase or transfer of real estate (since 31 March 2026, for the personal information it handles in connection with those obligations, s 6E(1A)); it is related to a body corporate that is not a small business operator, such as a group or franchise entity (s 6D(9)); it operates a residential tenancy database (s 6E(2)); it is a contracted service provider under a Commonwealth contract (s 6D(4)(e)); it trades in personal information (s 6D(4)(c)–(d), subject to the consent and authorised-by-law carve-outs in s 6D(7)–(8)); or it has opted in (s 6EA). Merely listing a tenant on, or searching, someone else’s database does not automatically make you covered. Work out whether the Privacy Act applies to you. Privacy Act 1988 (Cth) ss 6C, 6D, 6DA, 6E.

Note that the Spam Act and the Do Not Call Register Act apply to your messages regardless of whether the Privacy Act binds you. Both bind "a person" (Spam Act s 16(1); Do Not Call Register Act s 11(1)), not only APP entities.

Not sure it's you?

Does this apply to you?

Tap what's true for your agency. Nothing is saved.

We collect ID from buyers or sellers Our agency turns over under $3m We keep client records digitally We use a rent-roll or PM CRM

Tap what's true above to see where you stand.

Check the Kit against your setupA$539 / year incl GST · founding price, rising to A$649 on 1 Oct 2026

Orientation only, not a compliance assessment. General information and tools, not legal advice.

Which law are you actually under?

Work this out before asking whether you may send it. Reasoning carefully through the wrong principle produces a confident wrong answer, and the confidence is the dangerous part.

Email, SMS, MMS or instant message: the Spam Act governs. You need consent, express or, in limited circumstances, inferred. Every message must clearly identify who authorised it, with contact details reasonably likely to stay valid for at least 30 days (s 17(1)), and carry an unsubscribe address that keeps working for at least 30 days (s 18(1)(e)). When someone unsubscribes, consent is treated as withdrawn 5 business days after they send the request (Sch 2 cl 6), so that is the outside limit, not the target.
Telemarketing calls: the Do Not Call Register Act governs. s 11(1) bars making, or causing to be made, a call to a registered number, so a third-party call centre does not transfer the risk. Washing covers you for 30 days from the day you submitted the list (s 11(3)), and s 12 requires your agreement with that call centre to contain an express provision that it will comply with the Act; not having one is itself a civil penalty provision.
Anything else, such as a printed newsletter or a mailed appraisal offer: APP 7 governs directly. APP 7.1 prohibits using personal information for direct marketing, and which exception you reach turns on expectation. APP 7.2 needs information collected from the tenant, a reasonable expectation you would use it this way, and a simple opt-out. Where that expectation is missing, or you got the details from someone else, only APP 7.3 is open: it also wants consent or impracticability, plus a prominent opt-out statement in every communication (APP 7.3(d)).

Sources: Privacy Act 1988 (Cth), APP 6.7, APP 7 and APP 7.8 (Schedule 1); Spam Act 2003 (Cth); Do Not Call Register Act 2006 (Cth) · OAIC APP Guidelines chapters 6 and 7 · ACMA spam rules · ACMA Do Not Call Register

Is our collection notice enough to make marketing lawful?

Not for email or SMS, and it is worth stating bluntly: a collection-notice line saying "we may send you property updates" is not Spam Act consent. A notice tells; s 16(2) asks whether the account-holder consented, and s 16(5) puts the evidential burden of showing that on the sender.

A collection notice does useful work. It sets the reasonable expectation that APP 7.2(b) turns on, where APP 7 is the operative rule, and it is required in its own right under APP 5.1. But the Spam Act asks a different question about the message itself, and it wants consent, not notification.

So keep a clean record of consent per contact, and be able to say how you got it. Publication is not a shortcut: Sch 2 cl 4(1) says consent "may not be inferred from the mere fact that the relevant electronic address has been published", and the cl 4(2) exception reaches only work and role addresses of employees, officers and office-holders, never a tenant's personal address. Pick ten contacts and ask how consent arose for each. If you cannot answer, those contacts are a risk rather than an asset.

Sources: Privacy Act 1988 (Cth), APP 5 and APP 7 (Schedule 1); Spam Act 2003 (Cth) · ACMA spam rules · See also direct marketing, APP 7 and the Spam Act for real estate

Where is the line between servicing the tenancy and marketing to the tenant?

This is the distinction that decides most day-to-day questions.

Tenancy administration, which is the primary purpose and not marketing at all: a lease renewal reminder, an inspection notice, a rent-increase notice, a maintenance update.

Marketing, which needs its own basis: listings to buy, an appraisal offer for a property the tenant owns, a market-update newsletter, an invitation to an agency event, a "we have buyers for your area" message.

Being your tenant does not by itself supply consent for the second category. Sch 2 cl 2(b) does allow consent to be inferred from conduct and from business relationships, but the inference has to fit what that relationship is about, and a tenancy is about the tenancy. The relationship gives you their contact details for one purpose; it does not convert them into a marketing list.

Sources: Privacy Act 1988 (Cth), APP 6.1, APP 6.7 and APP 7 (Schedule 1); Spam Act 2003 (Cth) · OAIC APP Guidelines chapters 6 and 7 · OAIC APP guidelines

What has to happen when someone opts out?

Stop, across every system rather than the one list they clicked from. That is where agencies get caught: the person unsubscribes from the newsletter platform and keeps receiving SMS campaigns from the CRM, because nobody joined the two.

Under the Spam Act each message must carry an unsubscribe address reasonably likely to keep receiving requests for at least 30 days after it is sent (s 18(1)(e)). ACMA adds that the facility should be low-cost and should not require the person to log in, create an account or hand over extra personal information. Consent is treated as withdrawn 5 business days after the person sends the request (Sch 2 cl 6), so that is the outside limit rather than a target.

Where APP 7 is the operative rule, an individual can also ask you to stop marketing to them, to stop you passing their information on for other organisations' marketing, and to be told your source (APP 7.6). You cannot charge, and you must give effect within a reasonable period (APP 7.7). Those rights do not run alongside the Spam Act: APP 7.8 disapplies the whole principle, APP 7.6 included, to the extent the Spam Act applies.

Sources: Privacy Act 1988 (Cth), APP 7 (Schedule 1); Spam Act 2003 (Cth) · ACMA spam rules · OAIC APP guidelines

→ The free 2-minute audit checks whether an opt-out in one of your systems actually stops the messages from the others.