What must a tenancy application collection notice tell applicants?
When someone lodges a rental application you collect more personal information than at any other point in your agency: identity, income, rental history, references and sometimes database checks. Your APP 5 collection notice must make applicants aware of who you are, why you are collecting it, your usual disclosures (including any tenancy-database check), and whether their information goes overseas, at or before the point they hand it over.
By Jon Oates, Founder of Privaproof · Last updated · Start the free 2-min audit →
General information, not legal advice. Your obligations depend on your circumstances.
Not sure it's you?
Does this apply to you?
Tap what's true for your agency. Nothing is saved.
Orientation only, not a compliance assessment. General information and tools, not legal advice.
Why is the tenancy application your highest-stakes notice?
The rental application asks for a lot, often all at once: full name, date of birth, current and previous addresses, employment and income evidence, bank statements, ID documents, next-of-kin and referee details. Most real-estate collection points ask for a little. Because the volume and sensitivity are so high, this is the notice the OAIC and applicants scrutinise most, and it is where privacy complaints in the sector tend to cluster.
Two things make it harder than a generic enquiry form. First, applicants are effectively required to disclose to be considered, so the "main consequences if you do not provide it" point under APP 5 is real and must be stated honestly. Second, you often run the information through third parties: a tenancy database (blacklist) check, an online application platform, or an automated screening or scoring tool. Each of those is a disclosure your notice has to disclose.
What must the notice cover for a tenancy application?
APP 5 sets out the matters a person must be made aware of. For a tenancy application, tailor each one to what actually happens:
| APP 5 matter | For a tenancy application, say |
|---|---|
| Who you are and how to contact you | Agency name, ABN and privacy contact |
| That you are collecting, and the circumstances | You are collecting to assess this rental application |
| The purposes | Assessing suitability, verifying identity and income, checking rental history, managing the tenancy if approved |
| Required or authorised by law | Note where ID or other data is needed to comply with a law; otherwise it is a condition of assessment, not a legal requirement |
| Main consequences of not providing it | You may be unable to assess or progress the application |
| Your usual disclosures | Landlord, tenancy-database operator, referees, referencing or screening providers |
| That your privacy policy covers access, correction and complaints | Point to the policy and how to reach the OAIC |
| Likely overseas disclosure | Name it, and the countries, if a tool or provider stores or processes data offshore |
Keep the notice tight. It exists to make people genuinely aware, not to bury them.
What pitfalls actually cause trouble?
Collecting more than you reasonably need. Full bank statements, an applicant's entire ID document set, or data about people who are not applying are common over-collection problems. APP 3 limits collection to what is reasonably necessary, and asking for excess is a frequent complaint trigger. Collect the minimum that lets you assess the application.
Not disclosing the tenancy-database check. If you may check a tenancy database (a so-called blacklist) or list an applicant on one, your notice needs to make applicants aware that this can happen and who operates the database. State registration and listing rules apply on top of privacy law, so the notice is only part of your obligation here.
Silent automated screening. If you use a tool that scores, ranks or filters applicants, that is a disclosure and may involve automated decision-making. Be transparent about it. See automated decision-making and privacy for real estate for what changes when software influences the outcome.
Overseas disclosure through the platform. Many application and referencing tools store or process data offshore. If that is the case, your notice must say so and, where practicable, name the countries.
Forgetting the unsuccessful applicants. You still hold the data of everyone who missed out. Your notice sets expectations, but you also need a retention and destruction approach under APP 11 so you are not sitting on financial and ID records you no longer need.
Where does the notice sit in your wider obligations?
The collection notice is not your privacy policy, and it is not the whole compliance picture. It is the short, specific message at the application point; the policy is the standing document behind it. For the fuller context, see collection notices for real estate under APP 5, whether agents need a policy as well as a notice at do agents need a privacy policy and collection notice, and the overview of Privacy Act compliance for agencies.
Getting a tenancy-application notice right is fiddly because it touches database checks, screening tools, ID handling and overseas transfer all at once. The Privaproof Kit gives you a real-estate-specific application notice that names the right disclosures for how your agency actually works, kept current as the rules move, as part of a whole-agency system rather than a generic template. It sits on a privacy policy and collection notice reviewed by Matthew Hodgkinson, an Australian practising solicitor (Papillon Lawyers), and is reviewed by him too.
Common questions
Is a tenancy application notice the same as our privacy policy?
No. The notice is the short, specific message you give at the point someone applies, covering that collection. Your privacy policy is the standing document that explains, across the agency, how you handle personal information, and how people can access, correct or complain about it. You generally need both.
Do we have to tell applicants we might check a tenancy database?
Yes. If checking a tenancy database is one of your usual disclosures, applicants should be made aware of it and of who operates the database, before or as they apply. Listing someone on a database also carries its own rules beyond the collection notice.
What about the data of applicants we do not accept?
Your notice sets expectations at collection, but you still hold that information afterwards. Under APP 11 you should keep it only as long as you reasonably need it, then destroy or de-identify it securely. Holding onto ID and financial records for rejected applicants indefinitely is a common risk.
This is general information, not legal advice. Privaproof provides privacy tools and general information; it is not a law practice and does not provide legal advice. Sources: OAIC APP 5 notification; OAIC Australian Privacy Principles.