The privacy compliance kit for Australian real-estate agencies
A privacy compliance kit is the set of documents an agency needs to meet the Privacy Act: a privacy policy, the collection notices you give wherever you take someone's details, and a data-breach response plan, plus the governance documents that hold it together. A good one for real estate is three things at once: reviewed by a solicitor, kept current as the law changes, and built for how agencies actually work, not a generic template.
By Jon Oates, Founder of Privaproof · Last updated · Start the free 2-min audit →
General information, not legal advice. Your obligations depend on your circumstances.
Not sure it's you?
Does this apply to you?
Tap what's true for your agency. Nothing is saved.
Orientation only, not a compliance assessment. General information and tools, not legal advice.
What's actually in a real-estate privacy compliance kit?
Most people picture a privacy policy and stop there. For a real-estate agency that is a fraction of it. The parts that matter:
- A privacy policy (APP 1): your public statement of how the agency handles personal information.
- Collection notices (APP 5): the short notices you give people at each point you collect their details, at the open-home sign-in, reception, online enquiry forms and tenancy applications.
- A data-breach response plan (the NDB scheme): your runbook for when something goes wrong.
- The governance layer: a data inventory, retention and destruction, access and correction, complaints handling, a privacy-officer role, and staff training. These are the parts the OAIC's real-estate focus actually tests, and they are what turn a policy into a system.
That last group is the difference between a template and a kit. A whole-agency system covers the operational reality of an agency, not just the front-page policy.
What makes a good privacy kit for a real-estate agency?
1. Solicitor-reviewed. A privacy document you cannot stand behind is worse than none. All fourteen documents in the Privaproof Kit were reviewed by Matthew Hodgkinson, an Australian practising solicitor (Papillon Lawyers), so the wording is not something generated and hoped for. That is the signal a free generator or an anonymous template cannot give you.
2. Kept current. Australian privacy law does not stand still: the statutory tort arrived in June 2025, AML/CTF pulled agencies in from 1 July 2026, and the automated-decision transparency rule starts on 10 December 2026. A document bought once is right on the day and slowly wrong after. A kept-current kit updates as the law moves, and we record every change in a public update log.
3. Built for real estate. A generic or US template does not know what an open-home sign-in is, that a tenancy application collects more sensitive information than anything else you touch, or that AML now drags identity data under the Privacy Act. An industry-designed kit is written for those exact moments.
Is a free privacy policy template enough, or do I need a kit?
A free privacy policy template is a fine place to start a sentence and a poor place to end your compliance. Free and generic templates are horizontal (not real-estate), static (no updates), and unreviewed. The gap shows up exactly when it matters: an OAIC query, a data breach, or a client asking to see your policy.
| Free / generic template | A real-estate privacy kit | |
|---|---|---|
| Written for real estate | No, horizontal or US | Yes, RE-specific |
| Reviewed by a solicitor | No | Yes, all fourteen |
| Kept current as the law changes | No, static | Yes, with a dated update log |
| Whole-agency system | No, single document | Yes, policy plus governance |
| Covers the OAIC's actual focus areas | Rarely | Built for them |
For the deeper comparison, see are free privacy policy templates enough for real estate? and the cheapest way to get privacy-compliant.
What are the options, side by side?
Free templates are not the only alternative, and the other two are the ones agencies most often confuse with a privacy kit.
| Option | What you get | The catch |
|---|---|---|
| Free OAIC / generic template | A valid, no-cost starting point for the general APPs | Not real-estate-specific; static; won't update when the law moves |
| AML/CTF vendor kit | An AML/CTF program for property-sale work | Covers AUSTRAC obligations, not your Privacy Act / APP 1 policy |
| Bespoke lawyer drafting | Documents tailored to your exact set-up | Highest cost; still static unless you pay again to refresh |
| Living real-estate privacy Kit | Core privacy docs, sector-specific, kept current | You still tailor and apply them; not legal advice, not a guarantee |
The AML confusion is worth naming, because it is the common one. Since 1 July 2026, AML/CTF Tranche 2 has drawn real-estate professionals who broker the buying, selling or transfer of property into the AUSTRAC regime. An AML/CTF program is a different obligation: it is not a privacy policy, and having one does not give you the APP 1 documents the Privacy Act expects.
Who needs a real-estate privacy kit?
Independent and small real-estate agencies and property managers who want their privacy compliance handled properly, without paying a lawyer to draft each document or wrestling a generic template into shape. Founding access is A$539/year (incl. GST), self-serve, no lock-in, cancel anytime. For the full picture of your obligations, start with privacy compliance for real-estate agencies.
Common questions
What is a privacy compliance kit for a real-estate agency?
It is the complete set of documents that lets an agency meet the Privacy Act: a privacy policy, the collection notices for each point you take personal information, a data-breach response plan, and the supporting governance documents (data map, retention, access and correction, complaints, privacy officer, training). A kit is the whole system, not just a policy.
Do I need a kit, or is a free template enough?
A free template is a starting point, not compliance. It is generic, static and unreviewed, and it does not cover the operational parts (collection notices at each point, breach response, governance) that a real agency needs and that the OAIC looks at. A real-estate-specific, solicitor-reviewed, kept-current kit closes that gap.
Is the Privaproof Kit specific to real estate?
Yes. It is written for Australian real-estate agencies: the collection points, the tenancy-application sensitivity, and the AML-to-Privacy overlap that now catches agencies. It is not a horizontal template with "real estate" pasted on.
How much is it?
Founding access is A$539/year (incl. GST), self-serve, no lock-in, and it is kept current as the law changes, so you are not buying a document that ages.
This is general information, not legal advice. Privaproof provides privacy tools and general information; it is not a law practice and does not provide legal advice. Sources: OAIC: Australian Privacy Principles; OAIC: guidance for organisations.