If we sell the rent roll, can we hand over all the tenant and landlord data?

Q: Why does the deal structure change the privacy answer?

Because it decides whether there is a disclosure at all. A share sale leaves the information inside the same legal entity, which simply changes hands. There is no disclosure to a different entity and no trade in personal information. An asset sale , which transfers the rent roll itself rather than the shares in the company that holds it, moves the information to a different entity. That is a disclosure under APP 6, and because personal information is part of what is being sold, it engages s 6D(4)(c) on the seller's side and s 6D(4)(d) on the buyer's. If you are being advised on structure for tax or stamp-duty reasons, this is a privacy input into the same conversation. It is not a reason to structure a deal one way or the other, but it is a reason to know which one you are doing. (APP 6, s 6D(4)(c), s 6D(4)(d).)

Q: What does the buying business have to do on day one?

Notify, and check the exemption from the buyer's side too. s 6D(4)(d) takes an operator out of "small business operator" where it "provides a benefit, service or advantage to collect personal information about another individual from anyone else" , which is paying for data, not being paid to gather it. Buying a rent roll is such a payment, and s 6D(8) releases the limb only on the individuals' consent or a legislative authorisation. The incoming business is collecting personal information about tenants and landlords from someone other than the individual , which is the matter APP 5.2(b) singles out, so APP 5.1 requires reasonable steps to notify those individuals of the collection and the circumstances of it. A short, plain letter or email saying who now manages the property, who holds their information, and where the privacy policy is will usually do it. The buying business also picks up the reasonable steps duties in APP 10 on accuracy and APP 11.1 on security from the moment the data lands, and APP 8.1 applies to any disclosure of it to an overseas recipient, including some offshore hosting arrangements. (s 6D(4)(d), s 6D(8), APP 5.2(b).)

Not on the strength of the sale alone. There is no general business-sale exception in APP 6.2, so the transfer needs its own basis. The second risk decides whether you are covered at all: under s 6D(4)(c) a business that discloses personal information about another individual for a benefit, service or advantage is not a small business operator, and under s 6D(4)(d) neither is one that provides a benefit to collect it, which is the buyer's side of the same deal. Both limbs are released by consent, at s 6D(7) and s 6D(8). How the deal is structured changes the answer, so this belongs in the conversation before the contract, not after.

By Jon Oates, Founder of Privaproof · Last updated 9 September 2026 · Start the free 2-min audit →

General information, not legal advice. Your obligations depend on your circumstances.

Does this apply to your agency?

The Privacy Act binds “organisations”. An agency whose annual turnover for the previous financial year was more than A$3 million is one (ss 6C, 6D, 6DA). Turnover is the income the business itself earns in the course of carrying it on, so for an agency that is commission, management and letting fees and referral income. Rent you collect for a landlord and hold in trust is generally the landlord’s money passing through rather than your income, so a large rent roll does not by itself put you near the threshold. If it is close enough to decide the answer, check the figure with your accountant. Note also that once turnover has exceeded A$3 million in a financial year that has ended, the exemption does not return by later dropping below it (s 6D(4)(a)). A smaller agency is generally exempt, but is still covered if any of these apply: it provides AML/CTF designated services, i.e. brokering the sale, purchase or transfer of real estate (since 31 March 2026, for the personal information it handles in connection with those obligations, s 6E(1A)); it is related to a body corporate that is not a small business operator, such as a group or franchise entity (s 6D(9)); it operates a residential tenancy database (s 6E(2)); it is a contracted service provider under a Commonwealth contract (s 6D(4)(e)); it trades in personal information (s 6D(4)(c)–(d), subject to the consent and authorised-by-law carve-outs in s 6D(7)–(8)); or it has opted in (s 6EA). Merely listing a tenant on, or searching, someone else’s database does not automatically make you covered. Work out whether the Privacy Act applies to you. Privacy Act 1988 (Cth) ss 6C, 6D, 6DA, 6E.

Not sure it's you?

Does this apply to you?

Tap what's true for your agency. Nothing is saved.

We collect ID from buyers or sellers Our agency turns over under $3m We keep client records digitally We use a rent-roll or PM CRM

Tap what's true above to see where you stand.

Check the Kit against your setupA$539 / year incl GST · founding price, rising to A$649 on 1 Oct 2026

Orientation only, not a compliance assessment. General information and tools, not legal advice.

Why does the deal structure change the privacy answer?

Because it decides whether there is a disclosure at all.

A share sale leaves the information inside the same legal entity, which simply changes hands. There is no disclosure to a different entity and no trade in personal information.

An asset sale, which transfers the rent roll itself rather than the shares in the company that holds it, moves the information to a different entity. That is a disclosure under APP 6, and because personal information is part of what is being sold, it engages s 6D(4)(c) on the seller's side and s 6D(4)(d) on the buyer's.

If you are being advised on structure for tax or stamp-duty reasons, this is a privacy input into the same conversation. It is not a reason to structure a deal one way or the other, but it is a reason to know which one you are doing.

Sources: Privacy Act 1988 (Cth), ss 6D(4)(c), 6D(4)(d) and 13B, and APP 6.1 and 6.2 (Schedule 1), Compilation No. 104 · OAIC, Trading in personal information · OAIC APP guidelines

Could selling the rent roll cost us the small-business exemption?

It is a real risk, and the carve-out that answers it sits in the same section.

Section 6D(4)(c) provides that an operator that "discloses personal information about another individual to anyone else for a benefit, service or advantage" is not a small business operator, so the small-business exemption does not apply to it. The OAIC puts the sale case directly: "A business which sells assets, including personal information held in their customer database, is 'trading in personal information'." A rent roll sold as an asset is that transaction.

But each limb has its own carve-out, and they are different subsections. s 6D(7) releases the disclosure limb s 6D(4)(c) where the disclosure is "with the consent of the other individual" or as required or authorised by or under legislation. s 6D(8) does the same for the collection limb s 6D(4)(d), the buyer's side. The OAIC puts the test plainly: "If a business is buying or selling personal information and doesn't want to be subject to the Privacy Act, they will need the consent of every individual concerned before the sale is complete." Consent, not the sale itself, decides the exemption.

Where consent is impractical across a whole rent roll, continuity of the management service is the argument that tenants and landlords would reasonably expect their information to move with the management, which supports transferring what the incoming business needs to keep managing the tenancy rather than the entire file. Note the limit: that is an APP 6.2(a) argument about the disclosure, not a s 6D carve-out, and s 6D(7) and (8) list consent and legislative authority only. APP 6.6 and s 13B(1) deal separately with related bodies corporate, and s 13B(1) does not extend to sensitive information.

Sources: Privacy Act 1988 (Cth), s 6D(4)(c) with carve-out s 6D(7), s 6D(4)(d) with carve-out s 6D(8), s 13B(1), and APP 6.2(a) and 6.6 (Schedule 1); lettering per Compilation No. 104 · OAIC, Selling a business · OAIC APP guidelines

What does the buying business have to do on day one?

Notify, and check the exemption from the buyer's side too. s 6D(4)(d) takes an operator out of "small business operator" where it "provides a benefit, service or advantage to collect personal information about another individual from anyone else", which is paying for data, not being paid to gather it. Buying a rent roll is such a payment, and s 6D(8) releases the limb only on the individuals' consent or a legislative authorisation.

The incoming business is collecting personal information about tenants and landlords from someone other than the individual, which is the matter APP 5.2(b) singles out, so APP 5.1 requires reasonable steps to notify those individuals of the collection and the circumstances of it. A short, plain letter or email saying who now manages the property, who holds their information, and where the privacy policy is will usually do it.

The buying business also picks up the reasonable steps duties in APP 10 on accuracy and APP 11.1 on security from the moment the data lands, and APP 8.1 applies to any disclosure of it to an overseas recipient, including some offshore hosting arrangements.

Sources: Privacy Act 1988 (Cth), APP 5.1, APP 8, APP 10 and APP 11.1 (Schedule 1) · OAIC APP Guidelines chapters 5, 8, 10 and 11 · OAIC APP guidelines

Should we purge old files before settlement?

No, not as a blanket exercise. "Clean it out before you sell" is intuitive and it can cause real harm, because the destruction duty is conditional and several of those conditions cut the other way.

APP 11.2 requires reasonable steps to destroy or de-identify information you no longer need unless you are required by or under an Australian law, or a court or tribunal order, to retain it. Several things cut the other way:

AML/CTF record-keeping obligations on the property sales side.
State agent-licensing record-keeping obligations, which differ by jurisdiction.
Any live or reasonably foreseeable tribunal, discrimination, insurance or debt matter, where destroying records can mean destroying evidence.

The right sequence is to review against your retention obligations, identify what is genuinely free of them, and destroy only that. Old unsuccessful-applicant files with identity documents are usually the clearest candidates, and they are also the ones there is no case for shipping to a buyer.

Sources: Privacy Act 1988 (Cth), APP 11.2 (Schedule 1); Anti-Money Laundering and Counter-Terrorism Financing Act 2006 (Cth) Part 10, records retained for 7 years (from the simplified outline at s 104: "The reporting entity must retain the record for 7 years"); state agent-licensing legislation (varies) · OAIC APP guidelines · See also how long to keep personal information

What about due diligence before the sale is agreed?

Due diligence is its own exposure and it happens before any deal exists. Giving a prospective purchaser a full data extract discloses personal information about your tenants and landlords to a business that may never buy anything.

Use aggregate or de-identified figures at that stage wherever you can: number of managements, average rent, arrears percentages, lease expiry profile. The OAIC says the same: "When providing information about its customer base, a vendor should avoid providing a prospective purchaser with the names and other identifiers of its customers." Identified data, if it is needed at all, belongs at a late stage under a confidentiality agreement with a destruction obligation, which is also what the OAIC advises a prospective purchaser to do with anything it collected once due diligence ends.

Sources: Privacy Act 1988 (Cth), APP 6.1, APP 6.2 and APP 11.1 (Schedule 1) · OAIC, Selling a business · OAIC APP guidelines

→ Buying or selling a roll? The free 2-minute audit covers what has to be notified and what has to be kept.