Can we use a tenant's details, collected for their lease, to market other properties to them?

Not automatically, and this is not an APP 6 question. APP 6.7 says APP 6 does not apply to the use or disclosure by an organisation of personal information for the purpose of direct marketing, because that is covered by APP 7. APP 7 is then itself displaced under APP 7.8 to the extent the Spam Act 2003 or the Do Not Call Register Act 2006 applies. So for an email or an SMS, the Spam Act is the operative law, and a line in your collection notice is not Spam Act consent.

By Jon Oates, Founder of Privaproof · Last updated 26 July 2026 · Start the free 2-min audit →

General information, not legal advice. Your obligations depend on your circumstances.

Does this apply to your agency?

The Privacy Act binds “organisations”. An agency whose annual turnover for the previous financial year was more than A$3 million is one (ss 6C, 6D, 6DA). Turnover is the income the business itself earns in the course of carrying it on, so for an agency that is commission, management and letting fees and referral income. Rent you collect for a landlord and hold in trust is generally the landlord’s money passing through rather than your income, so a large rent roll does not by itself put you near the threshold. If it is close enough to decide the answer, check the figure with your accountant. Note also that once turnover has exceeded A$3 million in a financial year that has ended, the exemption does not return by later dropping below it (s 6D(4)(a)). A smaller agency is generally exempt, but is still covered if any of these apply: it provides AML/CTF designated services, i.e. brokering the sale, purchase or transfer of real estate (from 1 July 2026, for the personal information it handles in connection with those obligations, s 6E(1A)); it is related to a body corporate that is not a small business operator, such as a group or franchise entity (s 6D(9)); it operates a residential tenancy database (s 6E(2)); it is a contracted service provider under a Commonwealth contract (s 6D(4)(e)); it trades in personal information (s 6D(4)(c)–(d), subject to the consent and authorised-by-law carve-outs in s 6D(7)–(8)); or it has opted in (s 6EA). Merely listing a tenant on, or searching, someone else’s database does not automatically make you covered. Work out whether the Privacy Act applies to you. Privacy Act 1988 (Cth) ss 6C, 6D, 6DA, 6E.

Note that the Spam Act and the Do Not Call Register Act apply to your messages regardless of whether the Privacy Act binds you.

Not sure it's you?

Does this apply to you?

Tap what's true for your agency. Nothing is saved.

We collect ID from buyers or sellers Our agency turns over under $3m We keep client records digitally We use a rent-roll or PM CRM

Tap what's true above to see where you stand.

Check the Kit against your setupA$539 / year incl GST · founding price

Orientation only, not a compliance assessment. General information and tools, not legal advice.

Which law are you actually under?

Work this out before asking whether you may send it, because agencies routinely reason their way through the wrong principle and arrive at a confident wrong answer.

Email, SMS, MMS or instant message: the Spam Act governs. You need consent, which can be express or, in limited circumstances, inferred. Every message must accurately identify the sender with contact details that stay accurate. Every message must carry a functional unsubscribe, and you must action an unsubscribe request within 5 business days.
Telemarketing calls: the Do Not Call Register Act governs. Wash prospecting lists against the Register. Using a third-party call centre does not transfer the risk, because liability can extend to the business that causes the call.
Anything else, such as a printed newsletter or a mailed appraisal offer: APP 7 governs directly. It starts from a prohibition on using personal information for direct marketing, subject to exceptions, always with a simple opt-out that you honour.

Sources: Privacy Act 1988 (Cth), APP 6.7, APP 7 and APP 7.8 (Schedule 1); Spam Act 2003 (Cth); Do Not Call Register Act 2006 (Cth) · OAIC APP Guidelines chapters 6 and 7 · ACMA spam rules · ACMA Do Not Call Register

Is our collection notice enough to make marketing lawful?

Not for email or SMS. This is the single most common misunderstanding in agency marketing, and it is worth stating bluntly: a collection-notice line saying "we may send you property updates" is not Spam Act consent.

A collection notice does useful work. It sets the reasonable expectation that supports APP 7 where APP 7 is the operative rule, and it is required in its own right under APP 5. But the Spam Act asks a different question about the message itself, and it wants consent, not notification.

So keep a clean record of consent per contact, and be able to say how you got it. If you cannot point to how consent arose for a given contact, that contact is a risk rather than an asset.

Sources: Privacy Act 1988 (Cth), APP 5 and APP 7 (Schedule 1); Spam Act 2003 (Cth) · ACMA spam rules · See also direct marketing, APP 7 and the Spam Act for real estate

Where is the line between servicing the tenancy and marketing to the tenant?

This is the distinction that decides most day-to-day questions.

Tenancy administration, which is the primary purpose and not marketing at all: a lease renewal reminder, an inspection notice, a rent-increase notice, a maintenance update.

Marketing, which needs its own basis: listings to buy, an appraisal offer for a property the tenant owns, a market-update newsletter, an invitation to an agency event, a "we have buyers for your area" message.

Being your tenant does not by itself supply consent for the second category. The relationship gives you their contact details for one purpose; it does not convert them into a marketing list.

Sources: Privacy Act 1988 (Cth), APP 6.1, APP 6.7 and APP 7 (Schedule 1); Spam Act 2003 (Cth) · OAIC APP Guidelines chapters 6 and 7 · OAIC APP guidelines

What has to happen when someone opts out?

Stop, across every system rather than the one list they clicked from. That is where agencies get caught: the person unsubscribes from the newsletter platform and keeps receiving SMS campaigns from the CRM, because nobody joined the two.

Under the Spam Act the unsubscribe facility must be functional and low-cost, must not require the person to log in, create an account or hand over extra personal information, and you must action the request within 5 business days.

Where APP 7 is the operative rule, an individual can also ask you to stop using their information for direct marketing generally, and you must comply within a reasonable period and free of charge.

Sources: Privacy Act 1988 (Cth), APP 7 (Schedule 1); Spam Act 2003 (Cth) · ACMA spam rules · OAIC APP guidelines

→ The free 2-minute audit checks whether an opt-out in one of your systems actually stops the messages from the others.