When does a real-estate agency actually need consent?
Mostly, you don't. For ordinary personal information you reasonably need (names, contact details, rental-application basics), the Privacy Act asks you to notify people (a collection notice under APP 5), not to obtain signed consent. Genuine consent is required in narrower cases: collecting sensitive information (health, biometric, criminal record), using information for an unrelated secondary purpose, and some direct marketing.
By Jon Oates, Founder of Privaproof · Last updated · Start the free 2-min audit →
General information, not legal advice. Your obligations depend on your circumstances.
Not sure it's you?
Does this apply to you?
Tap what's true for your agency. Nothing is saved.
Orientation only, not a compliance assessment. General information and tools, not legal advice.
Is a collection notice the same as consent?
The most common privacy mistake in agencies is treating "consent" and "collection notice" as the same thing. They aren't. A collection notice (Australian Privacy Principle 5) is something you give people at the point you collect their details, telling them who you are, what you're collecting, why, and who you share it with. Consent is something you get from people, a positive agreement to something. For most of what an agency collects, the law requires the notice, not the consent. Getting this backwards leads agencies to chase signatures they don't need while skipping the notice they do. (See Privacy policy vs collection notice.)
When is consent NOT required?
For most everyday collection, you don't need consent; you need a lawful reason to collect and a clear notice. Under APP 3, an organisation may collect personal information that is reasonably necessary for one or more of its functions or activities. Taking a tenant's name, contact details, employment and rental history on an application; recording a vendor's details when you take a listing; logging attendees at an open home, this is personal information you reasonably need to do your job, so APP 3 lets you collect it without asking permission. What you must do is give an APP 5 collection notice at that point. Consent doesn't enter into it for ordinary, expected collection.
When is consent genuinely required?
Consent becomes a real requirement in a small number of defined situations. The three that matter for an agency are:
- Collecting sensitive information (APP 3.3): you generally must not collect sensitive information unless the person consents and it's reasonably necessary for your functions (subject to limited exceptions, such as where collection is required or authorised by law).
- Using or disclosing information for an unrelated secondary purpose (APP 6): you can use information for the purpose you collected it for; stepping outside that, to an unrelated purpose the person wouldn't reasonably expect, generally needs consent.
- Some direct marketing (APP 7): marketing has its own rules; consent is required in defined cases (below), and separate consent rules apply to marketing emails and texts under the Spam Act 2003.
Outside situations like these, "get everyone to sign a consent form" is not what the Act asks for, and a blanket signed consent doesn't cure a missing collection notice.
What counts as sensitive information in real estate?
Sensitive information is a defined category under the Privacy Act (s 6), and it's a higher bar than ordinary personal information, collecting it generally needs consent. It includes information about a person's health, racial or ethnic origin, religious beliefs, political opinions, sexual orientation, criminal record, and biometric information (and biometric templates). In an agency, this shows up more often than people expect:
- A tenant discloses a health condition or disability, an assistance animal, a request for modifications, a medical reason for a transfer.
- You run or receive a criminal-history / background check on an applicant.
- You use facial recognition or biometric access at a building or open home.
Ordinary identity documents (a driver licence or passport collected for verification) are personal information but are not automatically "sensitive information" in the statutory sense, though a facial-recognition template built from them would be. When sensitive information genuinely is in play, get the person's consent, collect only what you reasonably need, and say why. (For ID collected under AML customer due diligence, a "required or authorised by law" pathway can apply instead, see Do you need consent to collect ID for AML checks? for the mechanism, which applies from 1 July 2026 to agencies providing designated real-estate services.)
When does reusing data for a secondary purpose need consent?
APP 6 is where agencies most often need consent without realising it. You collect information for a primary purpose, say, processing a rental application. You can use it for that. Using it for a secondary purpose is only allowed if the person would reasonably expect it and the secondary purpose is related to the primary one (directly related, for sensitive information), or if they consent. Passing a rejected applicant's details to a related agency for a different property may be within expectations; selling your tenant database to a third party, or repurposing application data for something unrelated, generally is not, and would need consent. The safe habit: collect for a stated purpose, and don't quietly repurpose the data for something the person wouldn't see coming.
Do you need consent to market to your database?
Marketing to your database sits under its own rules, and "just add them to the newsletter" is where agencies get caught. Under APP 7, an organisation generally may use personal information it collected directly from the person for direct marketing where they'd reasonably expect it and you give a simple opt-out. But you must not use sensitive information for direct marketing without consent. There's no reasonable-expectation shortcut there. Separately, the Spam Act 2003 (enforced by ACMA, not the OAIC) governs marketing emails and SMS: it requires consent (express or, in limited cases, inferred), sender identification, and a working unsubscribe in every message. So marketing to buyers and vendors by email or text is effectively a consent-and-unsubscribe regime, sitting on top of APP 7. (Marketing phone calls and faxes fall under the Do Not Call Register regime.)
What makes consent valid under the Privacy Act?
Where consent is required, a signature on a form isn't automatically enough. Regulator guidance treats valid consent as having four elements: the person is adequately informed before consenting, the consent is voluntary, it is current and specific, and the person has the capacity to understand and communicate it. Two practical consequences for agencies: bundled consent (a single "I agree" that sweeps in unrelated things) is weak, and a tick buried in a long form the person didn't really read is weak. If a use genuinely needs consent, ask for it clearly, for that specific thing, at the right time.
Common myths
"I need a signed consent form for everything I collect."
No. For ordinary personal information you reasonably need (application details, contact information, open-home sign-ins) APP 3 lets you collect it and APP 5 requires you to give a collection notice, not to obtain consent. Reserve consent for sensitive information, unrelated secondary uses, and marketing.
"If they signed something, I've got consent for anything."
Not necessarily. Consent has to be informed, voluntary, current and specific. A blanket signature or a bundled "I agree" doesn't stretch to cover uses the person was never told about, and it doesn't replace the collection notice you were required to give.
"A collection notice and a consent form are the same document."
They do different jobs. A collection notice tells people what you're doing (APP 5); a consent form records their agreement to something that genuinely needs it. Many agencies need the notice for almost every collection point and a consent step only for the narrow cases above.
"Health or criminal-record details are fine to collect if the tenant volunteered them."
Be careful. Those are sensitive information, and APP 3.3 generally requires consent plus a reasonable need to collect them, collect only what you actually need, and don't retain sensitive details you don't. If a tenant volunteers a health reason, that doesn't hand you an open licence to record and keep it for other purposes.
"Adding buyers and vendors to our marketing list is automatic once they've dealt with us."
Not for email and SMS. The Spam Act 2003 requires consent and a working unsubscribe for marketing electronic messages, and APP 7 requires a simple opt-out, plus consent before you ever use sensitive information for marketing.
This is general information, not legal advice. Privaproof provides privacy tools and general information; it is not a law practice and does not provide legal advice. Laws and regulator guidance change. Where consent genuinely applies to your situation, or you're unsure, get advice for your specific circumstances. Not sure which of your collection points need a notice and which need consent? Start with the free 2-minute self-audit. Sources: OAIC (APP guidelines, Chapter B: key concepts (consent); OAIC) Chapter 3: APP 3 collection of solicited personal information; OAIC (Chapter 5: APP 5 notification of the collection; OAIC) Chapter 6: APP 6 use or disclosure; OAIC (Chapter 7: APP 7 direct marketing; Privacy Act 1988 (Cth) s 6) "sensitive information"; Spam Act 2003 (Cth); ACMA, spam and telemarketing rules.