What must a real-estate website enquiry form tell people about privacy?
Every online enquiry, listing-enquiry and contact form collects personal information, so under APP 5 you must give a collection notice at or by the form. It needs to say who you are, why you are collecting, who you usually share the details with (your CRM and portals), and link to your privacy policy. The RE-specific trap is a slick lead form with no notice at all.
By Jon Oates, Founder of Privaproof · Last updated · Start the free 2-min audit →
General information, not legal advice. Your obligations depend on your circumstances.
Not sure it's you?
Does this apply to you?
Tap what's true for your agency. Nothing is saved.
Orientation only, not a compliance assessment. General information and tools, not legal advice.
Why does an online enquiry form need a notice?
A website contact form or listing-enquiry box typically collects a name, email and phone number, a free-text message, and often the person's finance or rental intent. That is personal information, and the moment you collect it APP 5 is engaged. The obligation is to make the person aware of certain matters at or before collection, or as soon as practicable after.
The problem online is that the form works instantly and invisibly. A prospect types their details, hits send, and the lead lands in your CRM before anyone has told them who is collecting it or where it goes. Unlike a phone call or an office visit, there is no natural moment for a person to explain the collection, so the notice has to live on the page itself. A short privacy line by the submit button, linking to your full privacy policy, is the standard way to meet this.
What must your enquiry-form notice cover?
APP 5 sets out the matters a person should be made aware of. Tailored to an online real-estate enquiry, that means:
| APP 5 matter | What it looks like on your form |
|---|---|
| Who you are and how to contact you | Your agency's legal name and contact details, or a clear link to them |
| That you are collecting, and the circumstances | An enquiry form that captures name, email, phone and message |
| The purposes of collection | To respond to the enquiry, arrange inspections, and (only if opted in) send marketing |
| Whether collection is required or authorised by law | Usually not for a web enquiry: it is voluntary, so say so if relevant |
| Main consequences of not providing it | You may be unable to respond or follow up |
| Your usual disclosures | Your CRM, listing portals, and any third parties who receive the lead |
| Where to find access, correction and complaints info | A link to your privacy policy, which carries this detail |
| Likely overseas disclosure | Name the countries if your CRM or email tool stores data offshore |
You do not need to reproduce all of this on the form itself. The clean approach is a brief notice at the point of collection covering the essentials, backed by a privacy policy link that carries the full detail. What you must avoid is a form with no privacy wording and no link at all.
What lead-form pitfalls trip agencies up?
Three failures show up again and again, and they are exactly the kind of thing an OAIC assessment of a website would inspect.
No notice by the form. The most common gap is a contact or enquiry form with no privacy line and no policy link anywhere near it. The lead is captured, but the person was never told anything. That is a straightforward APP 5 miss.
Marketing consent done wrong. Responding to an enquiry is one purpose. Adding that person to a newsletter or nurture campaign is another. Bundling the two, or pre-ticking a marketing box, means any consent is not freely given. Keep the marketing opt-in separate and unticked, and do not treat sending an enquiry as agreement to be marketed to.
Undisclosed lead flow. Enquiries rarely stay in one place. They flow into a CRM, sync to listing portals, and sometimes pass to third parties such as mortgage brokers or a franchise head office. Every one of those usual disclosures should be reflected in your privacy policy so the notice is honest about where the data actually goes. A notice that implies the details stay with your office, while the CRM quietly shares them, is incomplete.
Getting the wording right for a real-estate enquiry point (as distinct from a tenancy application or an appraisal) is fiddly, because the purposes and disclosures differ. The Privaproof Kit gives you a collection notice built for each RE collection point, plus the matching privacy policy, kept current as guidance changes, so your website form and your policy actually line up. The collection notices and the privacy policy are all reviewed by Matthew Hodgkinson, an Australian practising solicitor (Papillon Lawyers).
Common questions
Do we need a privacy notice on a simple contact form?
Yes. Even a basic contact form collects personal information, so APP 5 applies. A short notice by the form with a link to your privacy policy is enough for a simple form; the policy carries the detail.
Is ticking a box for marketing the same as the collection notice?
No. The collection notice tells people what you are collecting and why. A marketing opt-in is a separate consent for a separate purpose. Keep them distinct, and do not pre-tick or bundle the marketing option with the enquiry itself.
Our leads go straight into a CRM and to portals. Does that need mentioning?
Yes. Those are usual disclosures under APP 5. Your privacy policy should describe that enquiry details are shared with your CRM provider, listing portals and any other third parties, including whether any of them store data overseas.
This is general information, not legal advice. Privaproof provides privacy tools and general information; it is not a law practice and does not provide legal advice. Sources: OAIC APP 5 notification; OAIC Australian Privacy Principles.