What must a tenancy application collection notice tell applicants?
When someone lodges a rental application you collect more personal information than at any other point in your agency: identity, income, rental history, references and sometimes database checks. APP 5.1 requires reasonable steps to make applicants aware of the APP 5.2 matters, at or before collection or, if that is not practicable, as soon as practicable after: who you are, why you are collecting it, your usual disclosures (including any tenancy-database check), and whether their information is likely to go overseas.
By Jon Oates, Founder of Privaproof · Last updated · Start the free 2-min audit →
General information, not legal advice. Your obligations depend on your circumstances.
Not sure it's you?
Does this apply to you?
Tap what's true for your agency. Nothing is saved.
Orientation only, not a compliance assessment. General information and tools, not legal advice.
Why is the tenancy application your highest-stakes notice?
The rental application asks for a lot, often all at once: full name, date of birth, current and previous addresses, employment and income evidence, bank statements, ID documents, next-of-kin and referee details. It is also the one real-estate collection point the Privacy Commissioner has ruled on directly. In Commissioner Initiated Investigation into IRE Pty Ltd (Privacy) [2026] AICmr 24, decided 1 April 2026, Commissioner Carly Kind found that the 2Apply rental-application platform collected information that was not reasonably necessary, contravening APP 3.2 at [96], and collected it by unfair means, contravening APP 3.5. The OAIC APP 3 guidelines record that the determination is under review in the Administrative Review Tribunal, so the rulings are not settled.
Two things make it harder than a generic enquiry form. First, applicants are effectively required to disclose to be considered, so the "main consequences (if any)" matter in APP 5.2(e) is real and must be stated honestly. Second, you often run the information through third parties: a tenancy database (blacklist) check, an online application platform, or an automated screening or scoring tool. Where you usually disclose applicant information to any of them, APP 5.2(f) puts them, or their types, in your notice.
What must the notice cover for a tenancy application?
APP 5.2 sets out the matters, and APP 5.1 requires reasonable steps to notify or otherwise make the individual aware of those that are reasonable in the circumstances. For a tenancy application, tailor each one to what actually happens:
| APP 5 matter | For a tenancy application, say |
|---|---|
| Who you are and how to contact you | Agency name, ABN and privacy contact |
| That you are collecting, and the circumstances | You are collecting to assess this rental application |
| The purposes | Assessing suitability, verifying identity and income, checking rental history, managing the tenancy if approved |
| Required or authorised by law | APP 5.2(c) wants the name of the Australian law, or the court/tribunal order details, not just the fact that one exists; otherwise it is a condition of assessment, not a legal requirement |
| Main consequences of not providing it | You may be unable to assess or progress the application |
| Your usual disclosures | Landlord, tenancy-database operator, referees, referencing or screening providers |
| That your privacy policy covers access, correction and complaints | Point to the policy and how to reach the OAIC |
| Likely overseas disclosure | APP 5.2(i) if you are likely to disclose to overseas recipients; APP 5.2(j) adds the countries, where it is practicable to specify them |
Keep the notice tight. It exists to make people genuinely aware, not to bury them.
What pitfalls actually cause trouble?
Collecting more than you reasonably need. APP 3.2 limits an organisation to information reasonably necessary for its functions or activities. In IRE the Commissioner found at [94] that the platform could function without collecting ten categories: gender; details of dependants, specifically names and ages; student status; bankruptcy status; retirement status; details of previous living history; current or intended ownership of a principal place of residence or investment property; current applications for other properties; bond and rent assistance application status; and citizenship status and visa expiry. She declared IRE must cease collecting them within 60 days. At [95] she found identification documents, proof of income, employment details, emergency contact and vehicle details could be collected in lesser amounts. How many of those are still on your rental application?
Not disclosing the tenancy-database check. If a tenancy database operator (a so-called blacklist) is someone you usually disclose applicant information to, APP 5.2(f) puts that operator, or the type of operator, in your notice. State residential tenancy legislation adds its own listing and notice rules on top of privacy law, so the notice is only part of your obligation here.
Silent automated screening. A tool that scores, ranks or filters applicants is a disclosure under APP 5.2(f) where the provider is a separate entity you usually disclose to, and it may involve automated decision-making even where it is not. In IRE it was the design of the form, not only the fields on it, that breached APP 3.5. See automated decision-making and privacy for real estate for what changes when software influences the outcome.
Overseas disclosure through the platform. Does your application or referencing tool store or process data offshore? Where you are likely to disclose to overseas recipients, APP 5.2(i) puts that in your notice and APP 5.2(j) adds the countries where it is practicable to specify them. The vendor's hosting or sub-processor terms will tell you.
Forgetting the unsuccessful applicants. You still hold the data of everyone who missed out. APP 11.2 requires reasonable steps to destroy or de-identify information once you no longer need it for any purpose for which it may be used or disclosed, where it is not required by law and is not in a Commonwealth record. The IRE declarations put exactly this in scope: the independent reviewer must examine 2Apply's retention practices for applications that are not successful.
Where does the notice sit in your wider obligations?
The collection notice is not your privacy policy, and it is not the whole compliance picture. It is the short, specific message at the application point; the policy is the standing document behind it. For the fuller context, see collection notices for real estate under APP 5, whether agents need a policy as well as a notice at do agents need a privacy policy and collection notice, and the overview of Privacy Act compliance for agencies.
Getting a tenancy-application notice right is fiddly because it touches database checks, screening tools, ID handling and overseas transfer all at once. The Privaproof Kit gives you a real-estate-specific application notice that names the right disclosures for how your agency actually works, kept current as the rules move, as part of a whole-agency system rather than a generic template. It sits on a privacy policy and collection notice reviewed by Matthew Hodgkinson, an Australian practising solicitor (Papillon Lawyers).
Common questions
Is a tenancy application notice the same as our privacy policy?
No. The notice is the short, specific message you give at the point someone applies, covering that collection. Your privacy policy is the standing document that explains, across the agency, how you handle personal information, and how people can access, correct or complain about it. You generally need both.
Do we have to tell applicants we might check a tenancy database?
Yes. If a database operator is one of the entities you usually disclose applicant information to, APP 5.2(f) covers it, and APP 5.1 wants that awareness at or before collection or, if that is not practicable, as soon as practicable after. Listing someone on a database also carries its own rules under state residential tenancy legislation, beyond the collection notice.
What about the data of applicants we do not accept?
Your notice sets expectations at collection, but you still hold that information afterwards. APP 11.2 requires reasonable steps to destroy or de-identify it once you no longer need it for any purpose for which it may be used or disclosed, where it is not required by law and is not in a Commonwealth record. Does your agency have a written retention rule for unsuccessful rental applications?
This is general information, not legal advice. Privaproof provides privacy tools and general information; it is not a law practice and does not provide legal advice. Sources: Australian Privacy Principles 3, 5 and 11, Privacy Act 1988 (Cth); Commissioner Initiated Investigation into IRE Pty Ltd (Privacy) [2026] AICmr 24, 1 April 2026, on the OAIC website; OAIC APP 5 notification; OAIC Australian Privacy Principles.