If we sell the rent roll, can we hand over all the tenant and landlord data?

Q: Why does the deal structure change the privacy answer?

Because it decides whether there is a disclosure at all. A share sale leaves the information inside the same legal entity, which simply changes hands. There is no disclosure to a different entity and no trade in personal information. An asset sale , which is how many rent-roll deals are structured, transfers the information to a different entity. That is both a disclosure under APP 6 and, because it is part of the consideration, capable of being a trade in personal information under s 6D. If you are being advised on structure for tax or stamp-duty reasons, this is a privacy input into the same conversation. It is not a reason to structure a deal one way or the other, but it is a reason to know which one you are doing.

Not on the strength of the sale alone. There is no general business-sale exception in APP 6, so the transfer needs its own basis. The bigger risk is the one nobody raises: selling a database of personal information as part of a business sale is the paradigm case of trading in personal information under s 6D, which can remove a smaller business's small-business exemption. How the deal is structured changes the answer, so this belongs in the conversation before the contract, not after.

By Jon Oates, Founder of Privaproof · Last updated 26 July 2026 · Start the free 2-min audit →

General information, not legal advice. Your obligations depend on your circumstances.

Does this apply to your agency?

The Privacy Act binds “organisations”. An agency whose annual turnover for the previous financial year was more than A$3 million is one (ss 6C, 6D, 6DA). Turnover is the income the business itself earns in the course of carrying it on, so for an agency that is commission, management and letting fees and referral income. Rent you collect for a landlord and hold in trust is generally the landlord’s money passing through rather than your income, so a large rent roll does not by itself put you near the threshold. If it is close enough to decide the answer, check the figure with your accountant. Note also that once turnover has exceeded A$3 million in a financial year that has ended, the exemption does not return by later dropping below it (s 6D(4)(a)). A smaller agency is generally exempt, but is still covered if any of these apply: it provides AML/CTF designated services, i.e. brokering the sale, purchase or transfer of real estate (from 1 July 2026, for the personal information it handles in connection with those obligations, s 6E(1A)); it is related to a body corporate that is not a small business operator, such as a group or franchise entity (s 6D(9)); it operates a residential tenancy database (s 6E(2)); it is a contracted service provider under a Commonwealth contract (s 6D(4)(e)); it trades in personal information (s 6D(4)(c)–(d), subject to the consent and authorised-by-law carve-outs in s 6D(7)–(8)); or it has opted in (s 6EA). Merely listing a tenant on, or searching, someone else’s database does not automatically make you covered. Work out whether the Privacy Act applies to you. Privacy Act 1988 (Cth) ss 6C, 6D, 6DA, 6E.

Not sure it's you?

Does this apply to you?

Tap what's true for your agency. Nothing is saved.

We collect ID from buyers or sellers Our agency turns over under $3m We keep client records digitally We use a rent-roll or PM CRM

Tap what's true above to see where you stand.

Check the Kit against your setupA$539 / year incl GST · founding price

Orientation only, not a compliance assessment. General information and tools, not legal advice.

Why does the deal structure change the privacy answer?

Because it decides whether there is a disclosure at all.

A share sale leaves the information inside the same legal entity, which simply changes hands. There is no disclosure to a different entity and no trade in personal information.

An asset sale, which is how many rent-roll deals are structured, transfers the information to a different entity. That is both a disclosure under APP 6 and, because it is part of the consideration, capable of being a trade in personal information under s 6D.

If you are being advised on structure for tax or stamp-duty reasons, this is a privacy input into the same conversation. It is not a reason to structure a deal one way or the other, but it is a reason to know which one you are doing.

Sources: Privacy Act 1988 (Cth), ss 6D and 13B, and APP 6 (Schedule 1) · OAIC APP Guidelines chapters 6 and B · OAIC APP guidelines

Could selling the rent roll cost us the small-business exemption?

It is a real risk, and the carve-out that saves you is the one most often left out.

Section 6D treats an operator that discloses personal information for a benefit, service or advantage as trading in personal information, which removes the small-business exemption. The OAIC's position is that a business selling assets, including personal information held in its customer database, is trading in personal information. A rent-roll sale is the clearest example there is.

But s 6D(7) and (8) carve out disclosures made with the individual's consent, and those required or authorised by legislation. So consent is not only the clean basis under APP 6, it is also what keeps the transaction outside the trading analysis. That is worth knowing before someone tells you a rent-roll sale automatically drags a small agency into the whole Act, because it does not.

Where consent is impractical across a whole rent roll, continuity of the management service is the strongest argument that tenants and landlords would reasonably expect their information to move with the management, which supports transferring what the incoming business needs to keep managing the tenancy, rather than the entire file. APP 6.6 and s 13B deal separately with related bodies corporate.

Sources: Privacy Act 1988 (Cth), ss 6D, 6D(7), 6D(8) and 13B, and APP 6, APP 6.6 (Schedule 1) · OAIC APP Guidelines chapter 6 · OAIC APP guidelines

What does the buying business have to do on day one?

Notify. This is an obligation, not a courtesy, and it is the step most commonly skipped.

The incoming business is collecting personal information about tenants and landlords from a third party, so APP 5.1 requires it to take reasonable steps to notify those individuals of the collection and the circumstances of it. A short, plain letter or email saying who now manages the property, who holds their information, and where the privacy policy is will usually do it.

The buying business also inherits the accuracy duty under APP 10 and the security duty under APP 11.1 from the moment the data lands, and if it hosts offshore, APP 8 applies to that too.

Sources: Privacy Act 1988 (Cth), APP 5.1, APP 8, APP 10 and APP 11.1 (Schedule 1) · OAIC APP Guidelines chapters 5, 8, 10 and 11 · OAIC APP guidelines

Should we purge old files before settlement?

No, not as a blanket exercise, and this is worth correcting because "clean it out before you sell" is common advice that can cause real harm.

APP 11.2 requires reasonable steps to destroy or de-identify information you no longer need unless you are required by or under an Australian law, or a court or tribunal order, to retain it. Several things cut the other way:

AML/CTF record-keeping obligations on the property sales side.
State agent-licensing record-keeping obligations, which differ by jurisdiction.
Any live or reasonably foreseeable tribunal, discrimination, insurance or debt matter, where destroying records can mean destroying evidence.

The right sequence is to review against your retention obligations, identify what is genuinely free of them, and destroy only that. Old unsuccessful-applicant files with identity documents are usually the clearest candidates, and they are also the ones there is no case for shipping to a buyer.

Sources: Privacy Act 1988 (Cth), APP 11.2 (Schedule 1); Anti-Money Laundering and Counter-Terrorism Financing Act 2006 (Cth) Part 10, records retained for 7 years (`verify/2026-07-30-amlctf-act-provisions.md`, from the simplified outline at s 104: "The reporting entity must retain the record for 7 years"); state agent-licensing legislation (varies) · OAIC APP guidelines · See also how long to keep personal information

What about due diligence before the sale is agreed?

Due diligence is its own exposure and it happens before any deal exists. Giving a prospective purchaser a full data extract discloses personal information about your tenants and landlords to a business that may never buy anything.

Use aggregate or de-identified figures at that stage wherever you can: number of managements, average rent, arrears percentages, lease expiry profile. That is what a buyer actually needs to value the roll. Identified data, if it is needed at all, belongs at a late stage under a confidentiality agreement with a destruction obligation.

Sources: Privacy Act 1988 (Cth), APP 6 and APP 11.1 (Schedule 1) · OAIC APP Guidelines chapters 6 and 11 · OAIC APP guidelines

→ Buying or selling a roll? The free 2-minute audit covers what has to be notified and what has to be kept.