The privacy compliance kit for Australian real-estate agencies
A privacy compliance kit is the set of documents an agency needs to meet the Privacy Act: a privacy policy, the collection notices you give wherever you take someone's details, and a data-breach response plan, plus the governance documents that hold it together. A good one for real estate is three things at once: reviewed by a solicitor, kept current as the law changes, and built for how agencies actually work, not a generic template.
By Jon Oates, Founder of Privaproof · Last updated · Start the free 2-min audit →
General information, not legal advice. Your obligations depend on your circumstances.
Not sure it's you?
Does this apply to you?
Tap what's true for your agency. Nothing is saved.
Orientation only, not a compliance assessment. General information and tools, not legal advice.
What's actually in a real-estate privacy compliance kit?
Most people picture a privacy policy and stop there. For a real-estate agency that is a fraction of it. The parts that matter:
- A privacy policy (APP 1): your public statement of how the agency handles personal information.
- Collection notices (APP 5): the short notices you give people at each point you collect their details, at the open-home sign-in, reception, online enquiry forms and tenancy applications.
- A data-breach response plan (the NDB scheme): your runbook for when something goes wrong.
- The governance layer: a data inventory, retention and destruction, access and correction, complaints handling, a privacy-officer role, and staff training. APP 1.2 requires an entity to implement the "practices, procedures and systems" that make the policy true, and they are what turn a policy into a system.
That last group is the difference between a template and a kit. A whole-agency system covers the operational reality of an agency, not just the front-page policy.
What makes a good privacy kit for a real-estate agency?
1. Solicitor-reviewed. A privacy document you cannot stand behind is worse than none. All fourteen documents in the Privaproof Kit were reviewed by Matthew Hodgkinson, an Australian practising solicitor (Papillon Lawyers), so the wording is not something generated and hoped for. That is the signal a free generator or an anonymous template cannot give you.
2. Kept current. Australian privacy law does not stand still: the statutory tort commenced 10 June 2025, AML/CTF pulled agencies in from 31 March 2026, and the automated-decision transparency rule starts on 10 December 2026. A document bought once is right on the day and slowly wrong after. A kept-current kit updates as the law moves, and we record every change in a public update log.
3. Built for real estate. A generic or US template does not know what an open-home sign-in is, that a tenancy application collects more personal information in one form than anything else you touch, or that s 6E(1A) applies the Privacy Act to the AML/CTF activities a small agency now carries on. An industry-designed kit is written for those exact moments.
Is a free privacy policy template enough, or do I need a kit?
A free privacy policy template is a fine place to start a sentence and a poor place to end your compliance. In January 2026 the OAIC swept about 60 entities across six named sectors, rental and property among them, assessing privacy policies against APP 1.4. Open the one you are using: does it name who reviewed it, does it carry a date, and does it meet APP 1.4?
| Free / generic template | A real-estate privacy kit | |
|---|---|---|
| Written for real estate | Generic by design | Yes, RE-specific |
| Reviewed by a named solicitor | No reviewer named | Yes, all fourteen |
| Kept current as the law changes | No, static | Yes, with a dated update log |
| Whole-agency system | No, single document | Yes, policy plus governance |
| Privacy policy written to APP 1.4 | Check yours against APP 1.4 | Yes, drafted to APP 1.4 |
For the deeper comparison, see are free privacy policy templates enough for real estate? and the cheapest way to get privacy-compliant.
What are the options, side by side?
Free templates are not the only alternative, and the other two are easy to confuse with a privacy kit.
| Option | What you get | The catch |
|---|---|---|
| Free OAIC / generic template | A valid, no-cost starting point for the general APPs | Not real-estate-specific; static; won't update when the law moves |
| AML/CTF vendor kit | An AML/CTF program for property-sale work | Covers AUSTRAC obligations, not your Privacy Act / APP 1 policy |
| Bespoke lawyer drafting | Documents tailored to your exact set-up | Highest cost; still static unless you pay again to refresh |
| Living real-estate privacy Kit | Core privacy docs, sector-specific, kept current | You still tailor and apply them; not legal advice, not a guarantee |
The AML confusion is worth naming. Since 31 March 2026, AML/CTF Tranche 2 has drawn real-estate professionals who broker the buying, selling or transfer of property into the AUSTRAC regime, with the obligations commencing 1 July 2026. An AML/CTF program is a different obligation: it is not a privacy policy, and having one does not give you the APP 1 documents the Privacy Act expects.
Who needs a real-estate privacy kit?
Independent and small real-estate agencies and property managers who want their privacy compliance handled properly, without paying a lawyer to draft each document or wrestling a generic template into shape. Founding access is A$539/year (incl. GST), rising to A$649 on 1 October 2026, self-serve, no lock-in, cancel anytime. For the full picture of your obligations, start with privacy compliance for real-estate agencies.
Common questions
What is a privacy compliance kit for a real-estate agency?
It is the complete set of documents that lets an agency meet the Privacy Act: a privacy policy, the collection notices for each point you take personal information, a data-breach response plan, and the supporting governance documents (data map, retention, access and correction, complaints, privacy officer, training). A kit is the whole system, not just a policy.
Do I need a kit, or is a free template enough?
A free template is a starting point, not compliance. It gives you a policy and nothing else, so it does not cover the operational parts (collection notices at each point, breach response, governance) that APP 1.2 asks you to implement as practices, procedures and systems. A real-estate-specific, solicitor-reviewed, kept-current kit closes that gap.
Is the Privaproof Kit specific to real estate?
Yes. It is written for Australian real-estate agencies: the collection points, the tenancy-application forms, and the AML-to-Privacy overlap that s 6E(1A) creates for an agency brokering property. It is not a horizontal template with "real estate" pasted on.
How much is it?
Founding access is A$539/year (incl. GST), rising to A$649 on 1 October 2026. Self-serve, no lock-in, and it is kept current as the law changes, so you are not buying a document that ages.
This is general information, not legal advice. Privaproof provides privacy tools and general information; it is not a law practice and does not provide legal advice. Sources: OAIC: Australian Privacy Principles; OAIC: guidance for organisations.