What Must Your Reception Collection Notice Tell People?
Your office reception is a collection point under the Privacy Act. When a vendor, buyer or walk-in gives their details at the desk or over the phone, APP 5 says you must make them aware of who you are, why you are collecting, who you usually disclose to, and that your privacy policy covers access, correction and complaints. A short displayed or spoken notice, plus your policy on request, usually covers it.
By Jon Oates, Founder of Privaproof · Last updated · Start the free 2-min audit →
General information, not legal advice. Your obligations depend on your circumstances.
Not sure it's you?
Does this apply to you?
Tap what's true for your agency. Nothing is saved.
Orientation only, not a compliance assessment. General information and tools, not legal advice.
Why does the front desk count as a collection point?
Every time someone walks in for an appraisal, phones to ask about a listing, or leaves their name and number at the counter, your agency is collecting personal information. It is easy to think of privacy notices as a website or form job, but APP 5 does not care whether that happens on a form, a screen or a sticky note. The obligation to notify applies at or before the moment of collection, or as soon as practicable afterwards.
For a real estate office that means the reception desk needs a plan, not just the website. A walk-in enquiry, a buyer asking to be added to a mailing list, a vendor requesting a market appraisal: each is a collection event, and each person is entitled to know what is happening with their information.
The practical answer is not a long document at the counter. It is a short, plain notice (displayed or spoken) that points to your full privacy policy, which is available on request or on your site.
What must the reception notice make people aware of?
APP 5 lists the matters a collection notice should cover. At a busy front desk you will not read all of these aloud every time, which is why the layered approach (short notice plus full policy) works. But the underlying obligations are the same as anywhere else in the agency.
| APP 5 matter | What it looks like at reception |
|---|---|
| Who you are and contact details | Your agency name and how to reach your privacy contact |
| That you are collecting, and the circumstances | Taking enquiry, appraisal or buyer details at the desk or by phone |
| The purposes of collection | Responding to the enquiry, arranging an appraisal, property matching |
| Whether required or authorised by law | Usually not required by law for a general enquiry: say so plainly |
| Main consequences if not provided | You may not be able to follow up or arrange an appraisal |
| Your usual disclosures | Landlords, vendors, portals, or service providers, as relevant |
| Access, correction and complaints | That your privacy policy explains how, and where to find it |
| Likely overseas disclosure | Name any offshore tools or providers if that applies |
You do not need to recite the table. You need a counter notice and a briefed team that can hand over or point to the privacy policy when asked.
What pitfalls catch agencies out?
No notice at the counter. The website has a policy, but the desk has nothing. Someone gives their details verbally and is told nothing about collection. This is the most common gap, and it is exactly the kind of thing an OAIC sweep or a complaint can surface.
Collecting more than you need. A general enquiry rarely justifies a photocopied licence or a full ID. Over-collecting at the desk creates data you then have to secure and eventually destroy, and it sits awkwardly against the principle of collecting only what is reasonably necessary. Keep the front counter light: name, contact, and what they are enquiring about.
Staff who do not know what to say. A collection notice is only as good as the person delivering it. If reception cannot explain, in one or two calm sentences, why details are being taken and where the privacy policy lives, the notice fails in practice. A short script and a printed policy on hand fix most of this.
Keep the reception notice in scope: it covers front-desk enquiries. Applications, tenancy databases and marketing consent are separate collection points with their own notice needs.
The Kit gives your agency a reception collection notice written for real estate, a matching desk script, and the underlying privacy policy, kept current as the rules change, so the whole front counter is handled as one system rather than a page you cobble together. The privacy policy, the collection notices and the desk script are all reviewed by Matthew Hodgkinson, an Australian practising solicitor (Papillon Lawyers).
Common questions
Do we really need a privacy notice at reception if we have one on our website?
Yes, if you collect at the desk or by phone. APP 5 attaches to the point of collection, not to your website. A person giving details at the counter has not seen your online policy, so a short displayed or spoken notice that points to the full policy is what closes the gap.
Does the notice have to be written, or can staff just say it?
A verbal notice can satisfy APP 5 if it makes the person aware of the required matters, so a briefed team saying a short line and offering the privacy policy is acceptable. A displayed card at the desk plus a policy on request is more reliable, because it does not depend on memory on a busy day.
What information should we actually collect at the front desk?
Only what is reasonably necessary for the enquiry: usually a name, contact detail and what they want. Leave ID, licence copies and detailed personal data to the collection points that genuinely need them, such as tenancy applications. Over-collecting at reception creates risk and storage obligations you do not need.
This is general information, not legal advice. Privaproof provides privacy tools and general information; it is not a law practice and does not provide legal advice. Sources: OAIC APP 5 notification; OAIC Australian Privacy Principles.