What personal information can a real estate agent legally ask for on a rental application?

Q: Can we ask about children, gender, age or relationship status?

Generally no, not as standard fields. Gender and the names and ages of dependants were both on the [94] cease-collection list, and at [83] the Commissioner noted each also increases the risk of discrimination in the tenancy application process. Where occupancy genuinely matters to a property's suitability, ask the question that is actually necessary ("how many people will live at the property?") rather than the demographic question that is not. Privacy law and anti-discrimination law point the same way here: information you should not be deciding on is usually information you should not be collecting. Separate Commonwealth, state and territory anti-discrimination laws may also apply to how tenancy decisions are made, which is outside the Privacy Act and outside the scope of this answer.

Q: Can we ask a rental applicant for bank statements?

Asking for evidence that an applicant can afford the rent is ordinarily defensible. Asking for full transaction-level bank statements is much harder to defend, because they reveal far more personal information than the affordability question requires. Proportionality is implicit in the reasonably-necessary test and requires a data minimisation approach (APP guidelines paragraph 3.26), so ask for the least revealing document that answers the question: recent payslips, an employment letter, or an accountant's letter for a self-employed applicant. If an applicant volunteers statements, you have collected transaction data you did not need and now have to secure and eventually destroy under APP 11. Where you do accept statements, accept redacted ones and say so on the form, which is a visible signal to applicants that you collect the minimum. Bank statements can also reveal sensitive information as defined in s 6 (for example health-service or membership payments). APP 3.3 bites on collection , not on holding: sensitive information needs consent as well as reasonable necessity, so accepting the unredacted statement is the collection. To be clear about the status of this answer: no deter

Q: Can we ask about visa or residency status?

Treat it as high risk. Citizenship status and visa expiry was item (j) on the [94] cease-collection list. At [83] the Commissioner rejected the lease-term justification for it: the information establishes neither ability to pay rent nor likelihood of caring for the property. Agencies usually justify this by lease term ("we need to know they will be here for twelve months"), but the necessary question is about the applicant's intended tenancy length, not their immigration status. Verifying who someone is and recording their immigration status are different collections with different justifications, and the second rarely follows from the first in a tenancy context.

Q: What does the Act actually require?

APP 3.2 sets the reasonably-necessary limit. APP 3.5 requires collection by lawful and fair means. APP 3.3 adds that sensitive information (health, biometric, criminal record and similar categories defined in s 6) generally needs consent as well as reasonable necessity. APP 3.6 is the direct-collection rule: collect from the individual unless it is unreasonable or impracticable to do so. Separately, if your agency provides AML/CTF designated services on the property sales side, that regime requires some identity collection on its own legal basis. It does not authorise anything extra on the tenancy side, so keep the two collections, and the two explanations you give people, apart. (APP 3.2, APP 3.5, APP 3.3.)

Only what is reasonably necessary to assess the application. APP 3.2 of the Privacy Act limits collection to information reasonably necessary for one or more of your functions or activities, so identity, contact details, referee names and contact details, and evidence of capacity to pay the rent are ordinarily defensible. Questions that merely help you build a profile of the applicant are not, and in IRE [2026] AICmr 24 a platform was ordered to stop collecting ten of them.

By Jon Oates, Founder of Privaproof · Last updated 9 September 2026 · Start the free 2-min audit →

General information, not legal advice. Your obligations depend on your circumstances.

Does this apply to your agency?

The Privacy Act binds “organisations”. An agency whose annual turnover for the previous financial year was more than A$3 million is one (ss 6C, 6D, 6DA). Turnover is the income the business itself earns in the course of carrying it on, so for an agency that is commission, management and letting fees and referral income. Rent you collect for a landlord and hold in trust is generally the landlord’s money passing through rather than your income, so a large rent roll does not by itself put you near the threshold. If it is close enough to decide the answer, check the figure with your accountant. Note also that once turnover has exceeded A$3 million in a financial year that has ended, the exemption does not return by later dropping below it (s 6D(4)(a)). A smaller agency is generally exempt, but is still covered if any of these apply: it provides AML/CTF designated services, i.e. brokering the sale, purchase or transfer of real estate (since 31 March 2026, for the personal information it handles in connection with those obligations, s 6E(1A)); it is related to a body corporate that is not a small business operator, such as a group or franchise entity (s 6D(9)); it operates a residential tenancy database (s 6E(2)); it is a contracted service provider under a Commonwealth contract (s 6D(4)(e)); it trades in personal information (s 6D(4)(c)–(d), subject to the consent and authorised-by-law carve-outs in s 6D(7)–(8)); or it has opted in (s 6EA). Merely listing a tenant on, or searching, someone else’s database does not automatically make you covered. Work out whether the Privacy Act applies to you. Privacy Act 1988 (Cth) ss 6C, 6D, 6DA, 6E.

Not sure it's you?

Does this apply to you?

Tap what's true for your agency. Nothing is saved.

We collect ID from buyers or sellers Our agency turns over under $3m We keep client records digitally We use a rent-roll or PM CRM

Tap what's true above to see where you stand.

Check the Kit against your setupA$539 / year incl GST · founding price, rising to A$649 on 1 Oct 2026

Orientation only, not a compliance assessment. General information and tools, not legal advice.

What does this mean for a real-estate agency?

The practical test is not "would this be useful?" but "could I run this assessment without it?"

In Commissioner Initiated Investigation into IRE Pty Ltd (Privacy) [2026] AICmr 24 (1 April 2026) the Privacy Commissioner found at [96] that the 2Apply / InspectRealEstate application platform contravened APP 3.2 by collecting information that was not reasonably necessary, including gender, the names and ages of dependants, and student, bankruptcy and retirement status. A separate finding at [123] under APP 3.5 concerned the way the form asked for it, the first time the Commissioner has assessed online choice architecture under the Privacy Act. The orders matter as much as the finding: stop collecting ten named categories within 60 days, engage an independent privacy reviewer at the operator's own expense, and report to the OAIC at 12 months on that reviewer's recommendations. The determination is under review in the Administrative Review Tribunal, a caveat the OAIC's own APP 3 guidelines now carry in their footnotes, so read it as the current position rather than a settled one.

The ten, at [94]:

"gender"; "details of dependants, specifically names and ages"; "student status"; "bankruptcy status"; "retirement status"; "details of previous living history"; "current or intended ownership of their principal place of residence or investment property"; "current applications for other properties"; "bond and rent assistance application status"; and "citizenship status and visa expiry" · [2026] AICmr 24 at [94]

⚠️ That is the full list of what the platform was ordered to stop collecting, and it is worth checking your own form against it rather than against a summary. Note what is not on it: at [84] the Commissioner expressly declined to decide on smoker status and bond history and claims, the operator having already agreed to drop them. A field is not safe merely because it is common, and it is not unsafe merely because it sounds personal. The test is whether you could run the assessment without it.

And on the identity and income documents, at [95] the Commissioner found the platform could have performed its functions while collecting a lesser amount of both.

Audit your application field by field and delete anything you cannot tie to a decision you actually make.

What does "reasonably necessary" actually mean?

It is an objective test, not your own view. At APP guidelines paragraph 3.25 the OAIC puts it as whether "a reasonable person who is properly informed would agree that the collection is necessary", and the entity must be able to justify it. Collection that is "merely helpful, desirable or convenient" does not meet the test, which disposes of "standard in the industry" and "the form came that way".

The Commissioner applied it field by field in IRE, at [94] and [95], separating what could not be collected at all from what could only be collected in a lesser amount, so a form is not assessed as one package. A workable internal rule is that every field should map to a named decision (can they pay, will they care for the property, are they who they say they are) and to a named person who uses it.

Can we ask about children, gender, age or relationship status?

Generally no, not as standard fields. Gender and the names and ages of dependants were both on the [94] cease-collection list, and at [83] the Commissioner noted each also increases the risk of discrimination in the tenancy application process.

Where occupancy genuinely matters to a property's suitability, ask the question that is actually necessary ("how many people will live at the property?") rather than the demographic question that is not. Privacy law and anti-discrimination law point the same way here: information you should not be deciding on is usually information you should not be collecting. Separate Commonwealth, state and territory anti-discrimination laws may also apply to how tenancy decisions are made, which is outside the Privacy Act and outside the scope of this answer.

Can we ask a rental applicant for bank statements?

Asking for evidence that an applicant can afford the rent is ordinarily defensible. Asking for full transaction-level bank statements is much harder to defend, because they reveal far more personal information than the affordability question requires.

Proportionality is implicit in the reasonably-necessary test and requires a data minimisation approach (APP guidelines paragraph 3.26), so ask for the least revealing document that answers the question: recent payslips, an employment letter, or an accountant's letter for a self-employed applicant. If an applicant volunteers statements, you have collected transaction data you did not need and now have to secure and eventually destroy under APP 11. Where you do accept statements, accept redacted ones and say so on the form, which is a visible signal to applicants that you collect the minimum.

Bank statements can also reveal sensitive information as defined in s 6 (for example health-service or membership payments). APP 3.3 bites on collection, not on holding: sensitive information needs consent as well as reasonable necessity, so accepting the unredacted statement is the collection. To be clear about the status of this answer: no determination deals with bank statements by name, but IRE is closer than it first appears. At [95] the Commissioner found the platform could perform its functions while collecting a lesser amount of, among other things, identification documents and proof of income documents. So the direction of travel on affordability evidence is established even though the specific document is not.

Can we ask about visa or residency status?

Treat it as high risk. Citizenship status and visa expiry was item (j) on the [94] cease-collection list. At [83] the Commissioner rejected the lease-term justification for it: the information establishes neither ability to pay rent nor likelihood of caring for the property.

Agencies usually justify this by lease term ("we need to know they will be here for twelve months"), but the necessary question is about the applicant's intended tenancy length, not their immigration status. Verifying who someone is and recording their immigration status are different collections with different justifications, and the second rarely follows from the first in a tenancy context.

What if our renttech platform collects the fields, not us?

The determination was made against the platform operator, not against any agency, but that is no comfort: the agency collects the information, so the agency has to meet APP 3 for every field on its form, whoever built it. The platform having its own obligations does not displace yours.

The 60-day deadline in that order has passed, so ask your provider in writing which of the [94] fields they have removed or made optional, and switch off in your own configuration anything you cannot justify. Where the platform allows custom fields, treat every custom field your office has added as your own collection, with no vendor to point at.

What does the Act actually require?

APP 3.2 sets the reasonably-necessary limit. APP 3.5 requires collection by lawful and fair means. APP 3.3 adds that sensitive information (health, biometric, criminal record and similar categories defined in s 6) generally needs consent as well as reasonable necessity. APP 3.6 is the direct-collection rule: collect from the individual unless it is unreasonable or impracticable to do so.

Separately, if your agency provides AML/CTF designated services on the property sales side, that regime requires some identity collection on its own legal basis. It does not authorise anything extra on the tenancy side, so keep the two collections, and the two explanations you give people, apart.

Sources: Privacy Act 1988 (Cth) Sch 1, APP 3 (esp. 3.2, 3.3, 3.5, 3.6) and s 6 · legislation.gov.au · OAIC APP 3 guidelines, whose footnotes record the IRE determination as under review in the Administrative Review Tribunal · Commissioner Initiated Investigation into IRE Pty Ltd (Privacy) [2026] AICmr 24, OAIC determination.