Do You Need a Privacy Notice for Open-Home Sign-In?
Yes. The moment an attendee writes their name, phone or email on your sign-in sheet or app, you are collecting personal information, and APP 5.1 requires you to take reasonable steps to make them aware of the APP 5.2 matters at or before that point, or as soon as practicable after. The real-estate-specific catch: if you plan to add those contacts to a marketing or buyer database, you have to say so up front, not later.
By Jon Oates, Founder of Privaproof · Last updated · Start the free 2-min audit →
General information, not legal advice. Your obligations depend on your circumstances.
Not sure it's you?
Does this apply to you?
Tap what's true for your agency. Nothing is saved.
Orientation only, not a compliance assessment. General information and tools, not legal advice.
Why is the sign-in sheet the one to get right?
The open-home sign-in is a collection point the privacy regulator has already singled out, not a hypothetical one. Every inspection produces a list of names, phone numbers and emails, often with a note about whether the person is a buyer or a renter. That is personal information, so the collection rules apply in full.
Two things make it higher-risk than it looks. First, an attendee who has never dealt with your agency has not seen your privacy policy, so the sign-in sheet is the only place they learn where their details go. Second, the regulator picked its 2026 sweep sectors by exactly this kind of in-person collection: the OAIC's sweep announced 9 December 2025 listed rental and property, described as "collection of individuals' personal information during property inspections", as one of six, and Privacy Commissioner Carly Kind named real estate agents. Its limit matters too: it assessed the privacy policies of about 60 entities across all six sectors against APP 1.4, not sign-in notices, and no per-sector split was published. Closing the gap between what an attendee expects and what your agency does with the list is what a collection notice is for.
What must your open-home collection notice cover?
Under APP 5.1 you must take such steps as are reasonable in the circumstances to notify each attendee of the APP 5.2 matters that are reasonable in the circumstances, at or before sign-in or as soon as practicable after. Tailor the ten matters to the open-home context:
| APP 5 point | On an open-home sheet or app this means |
|---|---|
| Who you are and how to contact you | Your agency name and a contact point (not just the agent's mobile) |
| That you are collecting, and the circumstances | Conditional under APP 5.2(b): it bites where you collect from someone other than the attendee, or where they may not be aware you collected |
| The purposes | Security and duty of care, vendor reporting, and (if true) contacting you about this and similar properties |
| Whether required or authorised by law | Sign-in is generally not legally required, so do not imply it is |
| Main consequences of not providing it | Be honest: usually the person can still inspect (frame it as optional where that is the case) |
| Your usual disclosures | For example, that attendance may be reported to the vendor |
| Access, correction and complaints | A pointer to your privacy policy, which explains how to access, correct and complain |
| Likely overseas disclosure | If your CRM or sign-in app stores data offshore, say so and, where practicable, where |
The notice does not need to be long. It needs to be visible before the person signs, written in language they will actually read, and honest about marketing.
What pitfalls cause complaints?
A bare list with no notice. A clipboard with columns and no explanation of who gets the data or why is the failure APP 5.1 is aimed at, since it asks what reasonable steps were taken at or before collection, and careful handling afterwards does not answer it. Read last weekend's sheet as an attendee would: does it name the agency, the purposes, and who sees the list?
Silent marketing. Adding attendees to a nurture list, SMS campaign or buyer-match database when the sheet said nothing about marketing is hard to square with APP 7.2(b), which permits direct marketing only where the individual would reasonably expect that use; without it you are on the consent route in APP 7.3(b). If contacting them about other listings is a purpose, name it before they sign.
A shared paper sheet everyone can read. A single page where each attendee sees the names, numbers and emails of everyone before them is a problem in its own right: APP 11.1(b) requires reasonable steps to protect personal information from unauthorised access or disclosure. Prefer a method that keeps each entry private, such as a tablet app that clears between entries or individual slips.
Address and buyer-interest fields. APP 3.2 stops an organisation collecting personal information unless it is reasonably necessary for one or more of its functions or activities, so every extra field (home address, price range, "buyer or renter") has to earn its place and be covered by your stated purposes. Which fields on your current sheet did you last actually use?
Common questions
Is an open-home sign-in even legal, and do I have to have one?
Sign-in is common for security and duty-of-care reasons, but it is generally not something the law compels attendees to complete. APP 2.1 goes further: individuals must have the option of not identifying themselves, or of using a pseudonym, when dealing with an APP entity in relation to a particular matter. That option drops away only under APP 2.2, where an Australian law or court order requires you to deal with identified individuals, or where it is impracticable to deal with someone unidentified. Your notice should not imply that inspecting the property depends on handing over full contact details, and the APP 5 obligation still applies to whatever you do collect.
Can I use the contacts to market other properties?
Only if you have made that purpose clear at collection and you meet APP 7, which allows direct marketing only where the individual would reasonably expect the use and you provide "a simple means by which the individual may easily request not to receive direct marketing communications" (APP 7.2(c)). The safe path is to state marketing as a purpose on the sign-in notice itself, so attendees know before they provide their details rather than discovering it when the first SMS arrives.
Does a QR code or sign-in app change anything?
No. Digital sign-in is still collection, so the same APP 5 facts must be presented, ideally on the first screen before the person enters anything. Two extra things to check: where the app provider stores the data (if offshore, your notice should flag likely overseas disclosure), and that entries are not visible to the next attendee.
A single, RE-specific sign-in notice, backed by a privacy policy that actually matches how your agency handles the data, is what turns this from a risk into a routine. The Privaproof Kit gives you that notice and the surrounding policy as one real-estate-specific system, kept current as the rules move, so every open home is covered without you drafting it from scratch. Both the sign-in notice and the privacy policy it sits on are reviewed by Matthew Hodgkinson, an Australian practising solicitor (Papillon Lawyers). See also collection notices for real estate under APP 5 and privacy compliance for real-estate agencies.
This is general information, not legal advice. Privaproof provides privacy tools and general information; it is not a law practice and does not provide legal advice. Sources: OAIC APP 5 notification; OAIC Australian Privacy Principles.