What Must Your Reception Collection Notice Tell People?
Your office reception is a collection point under the Privacy Act. When someone gives their details at the desk or over the phone, APP 5.1 requires an APP entity to take such steps as are reasonable in the circumstances to make them aware of the APP 5.2 matters: who you are, why you are collecting, who you usually disclose to, and that your privacy policy covers access, correction and complaints. A short displayed or spoken notice, plus your policy on request, usually covers it.
By Jon Oates, Founder of Privaproof · Last updated · Start the free 2-min audit →
General information, not legal advice. Your obligations depend on your circumstances.
Not sure it's you?
Does this apply to you?
Tap what's true for your agency. Nothing is saved.
Orientation only, not a compliance assessment. General information and tools, not legal advice.
Why does the front desk count as a collection point?
Every time someone walks in for an appraisal, phones to ask about a listing, or leaves their name and number at the counter, your agency is collecting personal information. It is easy to think of privacy notices as a website or form job, but APP 5 does not care whether that happens on a form, a screen or a sticky note. The APP 5.1 timing is at or before the time of collection or, if that is not practicable, as soon as practicable after.
For a real estate office that means the reception desk needs a plan, not just the website. A walk-in enquiry, a mailing-list request, a vendor wanting an appraisal: each is a collection event. APP 5 binds APP entities, so an agency whose turnover was A$3 million or less may sit outside it unless an exception applies, such as s 6D(4) or the AML/CTF activities in s 6E. You may genuinely be exempt, and Am I Covered? will say so.
The practical answer is not a long document at the counter. It is a short, plain notice (displayed or spoken) that points to your full privacy policy, which is available on request or on your site.
What must the reception notice make people aware of?
APP 5.2 lists ten matters, and APP 5.1 requires reasonable steps to notify such of them as are reasonable in the circumstances. At a busy front desk you will not read all ten aloud, which is why the layered approach (short notice plus full policy) works. The matters do not change from one collection point to the next.
| APP 5 matter | What it looks like at reception |
|---|---|
| Who you are and contact details | Your agency name and how to reach your privacy contact |
| That you collected it, and the circumstances, if the person may not be aware or you got it from someone else (APP 5.2(b)) | Buyer or vendor details arriving from a portal, a referrer or a database rather than from the person at the desk |
| The purposes of collection | Responding to the enquiry, arranging an appraisal, property matching |
| If the collection is required or authorised by an Australian law or a court/tribunal order (APP 5.2(c)) | Name the law. This one bites on AML/CTF customer due diligence, not on a general enquiry |
| Main consequences if not provided | You may not be able to follow up or arrange an appraisal |
| Your usual disclosures | Landlords, vendors, portals, or service providers, as relevant |
| Access, correction and complaints | That your privacy policy explains how, and where to find it |
| Whether overseas disclosure is likely, and the countries (APP 5.2(i)-(j)) | If your CRM or ID-check tool holds data offshore, name the countries where practicable, not just the vendor |
You do not need to recite the table. You need a counter notice and a briefed team that can hand over or point to the privacy policy when asked.
What pitfalls catch agencies out?
No notice at the counter. The website has a policy, but the desk has nothing. Someone gives their details verbally and is told nothing about collection. Walk out to your own counter: is there anything a person could read, and can whoever stands behind it say the line? An OAIC sweep or a complaint surfaces exactly this.
Collecting more than you need. A general enquiry rarely justifies a photocopied licence or a full ID. Over-collecting creates data you then have to secure and destroy, and it runs at APP 3.2: an organisation must not collect personal information unless it is reasonably necessary for one or more of its functions or activities. Keep the front counter light: name, contact, and what they are enquiring about.
Staff who do not know what to say. A collection notice is only as good as the person delivering it. If reception cannot explain, in one or two calm sentences, why details are being taken and where the privacy policy lives, the notice fails in practice. A short script and a printed policy on hand fix most of this.
Keep the reception notice in scope: it covers front-desk enquiries. Applications, tenancy databases and marketing consent are separate collection points with their own notice needs.
The Kit gives your agency a real-estate collection notice with a buyers and enquirers variant for the front desk and phone, a short spoken version your team can use at the counter, and the underlying APP 1.4 privacy policy, kept current as the rules change, so the counter is handled as one system rather than a page you cobble together. All fourteen documents in the Kit were reviewed by Matthew Hodgkinson, an Australian practising solicitor (Papillon Lawyers).
Common questions
Do we really need a privacy notice at reception if we have one on our website?
For desk and phone collections, usually yes. APP 5.1 attaches to the point of collection. The OAIC lets an entity "alert the individual to specific sections of its APP Privacy Policy", but warns a policy "may describe only the general information handling practices of the entity" (APP guidelines 5.6). Your policy is doing an APP 1.4 job, seven matters of its own. A short displayed or spoken notice pointing to it closes the gap.
Does the notice have to be written, or can staff just say it?
A verbal notice can satisfy APP 5 if it makes the person aware of the required matters, so a briefed team saying a short line and offering the privacy policy is acceptable. A displayed card at the desk plus a policy on request is more reliable, because it does not depend on memory on a busy day.
What information should we actually collect at the front desk?
Only what is reasonably necessary for the enquiry: usually a name, contact detail and what they want. Leave ID, licence copies and detailed personal data to the collection points that genuinely need them, such as tenancy applications. Over-collecting at reception creates risk and storage obligations you do not need.
This is general information, not legal advice. Privaproof provides privacy tools and general information; it is not a law practice and does not provide legal advice. Sources: OAIC APP 5 notification; OAIC Australian Privacy Principles.