The OAIC's 2026 privacy sweep: what it checked, and what your policy needs now
The OAIC's 2026 privacy compliance sweep reviewed the privacy policies of approximately 60 entities across six sectors, and rental and property was the first sector the OAIC listed. The Australian Information Commissioner reported on 20 May 2026 that the sweep "found instances of non-compliance in a significant proportion" of those entities. It tested one thing: whether a privacy policy meets APP 1.4.
By Jon Oates, Founder of Privaproof · Last updated · Start the free 2-min audit →
General information, not legal advice. Your obligations depend on your circumstances.
Not sure it's you?
Does this apply to you?
Tap what's true for your agency. Nothing is saved.
Orientation only, not a compliance assessment. General information and tools, not legal advice.
What is the 2026 OAIC privacy sweep?
In 2026 the Office of the Australian Information Commissioner (OAIC) ran a privacy compliance sweep: a coordinated review of how a group of organisations handle personal information. It began in the first week of January 2026 and covered approximately 60 entities across six sectors that collect personal information in person. Rental and property is the first of the six sectors the OAIC listed, defined by the collection of personal information during property inspections. The OAIC put the scope in its own words when it announced the sweep on 9 December 2025:
"The OAIC will review the privacy policies of approximately 60 entities from the following 6 sectors"
The six sectors were rental and property, chemists and pharmacists, licensed venues, car rental companies, car dealerships, and pawnbrokers and second-hand dealers. Real estate was not an afterthought in the announcement: it was the worked example the OAIC chose.
"For example, real estate agents asking for phone numbers at open houses, or car rental agencies presenting customers with lengthy forms."
Privacy Commissioner Carly Kind gave the reason in the same release:
"When confronted with in-person requests for their personal information from retailers, licenced venues, car hire companies or real estate agents, consumers often don't have access to all the information they might need to make an informed decision."
>
Carly Kind, Privacy Commissioner, OAIC media release, 9 December 2025
The OAIC has reported the outcome. Launching Privacy Awareness Week at the IAPP Sydney KnowledgeNet on 20 May 2026, the Australian Information Commissioner said: "Our Privacy Sweep of sixty entities earlier this year found instances of non-compliance in a significant proportion." No sector-by-sector breakdown has been published, so how rental and property fared on its own is not on the record. APP 1.4 is a standing obligation under the Privacy Act 1988 (Cth) rather than a sweep requirement, so it applied before the sweep and applies now.
The focus of the sweep was narrow but important: it assessed organisations' privacy policies against Australian Privacy Principle 1.4 (APP 1.4). APP 1.4 sets out what a privacy policy must actually contain: the kinds of personal information an entity collects and holds, how it collects and holds it, why it collects it, how an individual can access or correct their information or make a complaint, and whether information is likely to be disclosed overseas. A privacy policy that is missing, out of date, or silent on these points is squarely the kind of thing this sweep was designed to catch.
The stakes are not merely reputational, and the provision at issue is the very one the sweep tested. APP 1.4 is named in s 13K(1)(b)(ii) of the Privacy Act 1988 (Cth) as a civil penalty provision, and s 80UB(1)(a) makes it one for which the Commissioner can issue an infringement notice directly, without going to court. The court maximum for that tier is 200 penalty units, and five times that, 1,000 penalty units, for a body corporate (s 13K(4); Regulatory Powers (Standard Provisions) Act 2014 s 82(5)). At the $364 penalty unit in force from 1 July 2026 that is A$72,800 and A$364,000. The limit is worth stating as plainly as the ceiling: the far larger s 13G maximum bites only where the interference with privacy is serious (s 13G(1)(b)), and a policy that falls short of APP 1.4 is not automatically that. These are ceilings a court may impose, not the typical outcome. For a real estate agency that has never had its privacy policy reviewed against the current Australian Privacy Principles, the sweep was a clear signal that a compliant, up-to-date policy is now table stakes.
You can read the OAIC's announcement here: Privacy compliance sweep to put privacy policies under the spotlight.
What enforcement is backing up the sweep?
A sweep on its own might be easy to shrug off. What makes 2026 different is that the OAIC has been handing down determinations against operators in the property sector, showing it is willing to enforce, rather than only review. Neither of the two operators below is a typical estate agency: one is a RentTech platform and the other was a property-education business that generated its own leads. But both cases show the regulator's direction of travel on how personal information may be collected in the property world, and the principles apply directly to how agencies run their own collection.
IRE Pty Ltd (the 2Apply / InspectRealEstate platform)
In Commissioner Initiated Investigation into IRE Pty Ltd (Privacy) [2026] AICmr 24 (1 April 2026), the OAIC found that IRE, operator of the 2Apply and InspectRealEstate rental-application platform, collected personal information that was not reasonably necessary for its functions (APP 3.2) and collected it by unfair means (APP 3.5). That included prospective renters' gender, student status, bankruptcy status, citizenship status and visa expiry, and details of dependants including their names and ages. Announcing it on 22 April 2026 the OAIC called the decision "a first for the OAIC" for applying "the concept of online choice architecture", and said the Commissioner "emphasised the need for other RentTech providers to adapt their practices to be consistent with the findings". Two limits are worth stating plainly: the respondent was the platform operator, not any agency, and the OAIC's own APP Guidelines record that the determination is under review in the Administrative Review Tribunal, so the ruling is not settled.
Read the determination as published by the OAIC, and the OAIC's statement of 22 April 2026: RentTech platforms must stop unfair and excessive personal information collection, says Privacy Commissioner.
Property Lovers Pty Ltd
In Property Lovers Pty Ltd (Privacy) [2024] AICmr 249 (22 November 2024), the OAIC found that Property Lovers unfairly collected the personal information of vulnerable individuals, scraping daily court listings across Australia and published death and funeral notices to generate leads, in breach of APP 1.3, APP 3.5, APP 5.1 and APP 10.2.
The determination also answers the "we turn over under $3 million so we are exempt" assumption. At [26] the Commissioner accepted the respondent's own tax evidence that it did not turn over more than $3 million, and held it to the APPs anyway:
"the respondent carries on a business in which it discloses the personal information of individuals to paying Program participants... thereby deriving a financial benefit... Therefore, I am satisfied that the respondent is an APP entity." · Property Lovers Pty Ltd (Privacy) [2024] AICmr 249 at [26], applying s 6D(4)(c)
The company was ordered to cease collecting and distributing the leads, destroy all leads lists within 30 days, update its privacy policy, and publish a written apology. Whether a particular agency's own disclosures engage s 6D(4)(c) depends on its arrangements, and no court has decided that. The narrower question is the one worth asking: where does your prospect data actually come from?
Read the determination on AustLII, and the OAIC's statement: OAIC finalises investigation into Property Lovers and fastproperty.ai.
What does this mean for your agency?
Read together, the sweep and the determinations point to four practical priorities for any agency that collects personal information from vendors, buyers, landlords and, especially, prospective tenants.
- Collect only what is reasonably necessary. APP 3 allows collection of personal information only where it is reasonably necessary for your functions or activities. The IRE case is a warning shot: fields like gender, citizenship status, visa expiry and bankruptcy status were found to go beyond what was reasonably necessary. If you can't clearly justify why you need a piece of information, don't collect it.
- Have a current, APP 1.4-compliant privacy policy. This is exactly what the sweep assessed. Your policy should be easy to find, up to date, and cover what you collect, how and why, how people can access, correct or complain, and any overseas disclosure.
- Give a proper APP 5 collection notice. At or before the point of collection, tell people who you are, why you are collecting their information, who you might share it with, and how they can access it or complain. A collection notice is separate from your privacy policy and is often the weakest link in agency practice.
- Strip back excessive rental-application fields. Application forms and portals are the highest-risk area. Review every field a prospective tenant is asked to complete and remove anything that isn't reasonably necessary to assess the application.
What should you do now?
- Pull up your current privacy policy and check it against APP 1.4: does it actually describe what you collect, why, and how someone can access, correct or complain? If it is generic or years old, it needs work.
- Audit your rental-application and enquiry forms field by field, and delete anything you can't tie to a genuine, reasonably necessary purpose.
- Make sure a clear APP 5 collection notice is given at the point you collect information (on forms, portals and at inspections), not buried in a policy no one reads.
- Review how leads and prospect data are sourced; if any come from scraping, third parties or court-style lists, treat that as a red flag and get advice.
- Check that personal information you hold is kept securely under APP 11 and destroyed or de-identified once you no longer need it.
A short, honest self-audit of your privacy readiness is a sensible next step; it's a low-cost way to find the gaps before a regulator, or a complaint, finds them for you.
Common questions
What is the OAIC's 2026 privacy sweep?
A coordinated review of how organisations handle personal information. It began in the first week of January 2026, covered approximately 60 entities across six sectors that collect personal information in person, listed rental and property first, and assessed privacy policies against Australian Privacy Principle 1.4. On 20 May 2026 the Australian Information Commissioner reported that it found instances of non-compliance in a significant proportion of those entities.
Does the sweep apply to real estate agencies?
Yes. Rental and property was the first of the six sectors the OAIC listed, and the Privacy Commissioner named real estate agents in her own quote. The sweep assessed whether your privacy policy meets APP 1.4: what you collect, how and why, how someone can access, correct or complain, and any overseas disclosure. APP 1.4 is one of the principles s 13K of the Privacy Act names as a civil penalty provision, so a missing or out-of-date policy is exactly what the sweep was designed to catch.
Has the OAIC actually enforced against property operators?
Yes. In IRE Pty Ltd [2026] AICmr 24 (the 2Apply / InspectRealEstate platform) the OAIC found personal information collected that was not reasonably necessary, and by unfair means; that determination is under review in the Administrative Review Tribunal. In Property Lovers Pty Ltd [2024] AICmr 249 it found unfair collection of vulnerable people's data and ordered the leads lists destroyed. Both respondents were platform or lead-generation operators, not estate agencies.
What should an agency do in response?
Collect only what is reasonably necessary (APP 3), have a current APP 1.4-compliant privacy policy, give a proper APP 5 collection notice, and strip excessive fields out of your rental-application forms.