What must a real-estate website enquiry form tell people about privacy?
If the APPs bind your agency, every online enquiry, listing-enquiry and contact form collects personal information, and APP 5.1 requires reasonable steps to notify the person of the APP 5.2 matters, or otherwise ensure they are aware of them, at or before collection or, if that is not practicable, as soon as practicable after. It needs to say who you are, why you are collecting, who you usually disclose to (your CRM and portals), and link to your privacy policy. The RE-specific trap is a slick lead form with no notice at all.
By Jon Oates, Founder of Privaproof · Last updated · Start the free 2-min audit →
General information, not legal advice. Your obligations depend on your circumstances.
Not sure it's you?
Does this apply to you?
Tap what's true for your agency. Nothing is saved.
Orientation only, not a compliance assessment. General information and tools, not legal advice.
Why does an online enquiry form need a notice?
A website contact form or listing-enquiry box typically collects a name, email and phone number, a free-text message, and often the person's finance or rental intent. That is personal information, and if the APPs bind you, APP 5.1 is engaged the moment you collect it: reasonable steps to notify the person of the APP 5.2 matters, or otherwise ensure they are aware of them, "at or before the time or, if that is not practicable, as soon as practicable after" collection. You may genuinely not be covered: an agency whose turnover was A$3 million or less is generally a small business operator under s 6D, outside the APPs unless an exception applies. The Am I Covered? check settles that first.
The problem online is that the form works instantly and invisibly. A prospect types their details, hits send, and the lead lands in your CRM before anyone has told them who is collecting it or where it goes. Unlike a phone call or an office visit, there is no natural moment for a person to explain the collection, so the notice has to live on the page itself. A short privacy line by the submit button, linking to your full privacy policy, is the standard way to meet this.
What must your enquiry-form notice cover?
APP 5.2 lists ten matters, and APP 5.1 asks only for reasonable steps to notify "such matters referred to in subclause 5.2 as are reasonable in the circumstances". Tailored to an online real-estate enquiry, that means:
| APP 5 matter | What it looks like on your form |
|---|---|
| Who you are and how to contact you | Your agency's legal name and contact details, or a clear link to them |
| That you are collecting, and the circumstances, but only under APP 5.2(b) | Engaged where you collect from someone other than the person, or they may not be aware: a portal or referrer passing you a lead, not a form they fill in themselves |
| The purposes of collection | To respond to the enquiry, arrange inspections, and (only if opted in) send marketing |
| Whether collection is required or authorised by law (APP 5.2(c)) | Only engaged where a law or court order requires it, and then you name the law: a web enquiry usually is not, though AML customer due diligence can be |
| Main consequences of not providing it | You may be unable to respond or follow up |
| Your usual disclosures | Your CRM, listing portals, and any third parties who receive the lead |
| Where to find access, correction and complaints info | A link to your privacy policy, which carries this detail |
| Whether overseas disclosure is likely (APP 5.2(i)), and then the countries (APP 5.2(j)) | Name the countries your CRM or email provider is likely to disclose to, "if it is practicable to specify those countries" |
You do not need to reproduce all of this on the form itself. The clean approach is a brief notice at the point of collection covering the essentials, backed by a privacy policy link that carries the full detail. What you must avoid is a form with no privacy wording and no link at all.
What lead-form pitfalls trip agencies up?
Three failures are worth checking on your own site. The OAIC's 2026 privacy compliance sweep assessed the privacy policies of about 60 entities against APP 1.4, and rental and property was the first of the six sectors it named (OAIC, 9 December 2025). Your enquiry-form notice points at that policy, so a thin policy weakens the notice.
No notice by the form. A contact or enquiry form with no privacy line and no policy link anywhere near it: the lead is captured, but the person was never told anything. APP 5.1 asks what steps were reasonable in the circumstances, and on a page you control and can edit, that is a hard question to answer with nothing. Open your own enquiry form now: is there any privacy wording or policy link above the submit button?
Marketing consent done wrong. Responding to an enquiry is one purpose. Adding that person to a newsletter or nurture campaign is another. The OAIC's APP Guidelines say bundling consents "has the potential to undermine the voluntary nature of the consent", and that inferring consent from a failure to opt out "will only be appropriate in limited circumstances". Keep the marketing opt-in separate and unticked, and do not treat sending an enquiry as agreement to be marketed to.
Undisclosed lead flow. Enquiries rarely stay in one place. They flow into a CRM, sync to listing portals, and sometimes pass to third parties such as mortgage brokers or a franchise head office. APP 5.2(f) makes those usual disclosures a matter for the notification itself, not only for the policy, and APP 1.4(c) puts the purposes of your disclosures in the policy. Can you name, today, every third party your enquiry form feeds?
Getting the wording right for a real-estate enquiry point (as distinct from a tenancy application or an appraisal) is fiddly, because the purposes and disclosures differ. The Privaproof Kit gives you a collection notice with a separate variant for buyers and enquirers, for rental applicants and tenants, and for vendors and landlords, plus the matching privacy policy, kept current as the law and guidance change, so your website form and your policy actually line up. The collection notice and the privacy policy are reviewed by Matthew Hodgkinson, an Australian practising solicitor (Papillon Lawyers).
Common questions
Do we need a privacy notice on a simple contact form?
If the APPs bind you, yes. A basic contact form collects personal information, so APP 5.1 applies and asks for reasonable steps in the circumstances. On a simple form, a short notice by the field with a link to your privacy policy will usually be that step; the policy carries the detail.
Is ticking a box for marketing the same as the collection notice?
No. The collection notice tells people what you are collecting and why. A marketing opt-in is a separate consent for a separate purpose. Keep them distinct, and do not pre-tick or bundle the marketing option with the enquiry itself.
Our leads go straight into a CRM and to portals. Does that need mentioning?
Yes. APP 5.2(f) makes your usual disclosures a matter for the notification itself: your CRM provider, listing portals and any other third parties. APP 5.2(i) then asks whether disclosure to overseas recipients is likely, and 5.2(j) the countries, if it is practicable to specify them.
This is general information, not legal advice. Privaproof provides privacy tools and general information; it is not a law practice and does not provide legal advice. Sources: OAIC APP 5 notification; OAIC Australian Privacy Principles.