Does becoming an AML reporting entity trigger the Privacy Act for buyers agents?

Yes, for one specific slice of your data. When brokering property purchases makes you an AUSTRAC reporting entity from 1 July 2026, Privacy Act s 6E(1A) switches the Australian Privacy Principles on for the client-identity data you collect for your AML checks, regardless of your turnover. It reaches that customer-due-diligence data only, not your whole buyer CRM or your marketing list.

By Jon Oates, Founder of Privaproof · Last updated 22 July 2026

General information , document templates and tools you tailor, not legal advice. Privaproof is not a law practice and does not assess your AML/CTF obligations, which are administered by AUSTRAC.

The trigger is two steps, and the second one is the one people miss

Most boutique buyers agents turn over under A$3 million and have sat under the small-business exemption in section 6D of the Privacy Act 1988 (Cth), which meant the Australian Privacy Principles (APPs) did not apply. Two things now happen in sequence.

Step one: you become a reporting entity. Brokering the purchase of real estate for a buyer-client is a designated service under the AML/CTF Act (Table 5 item 1, AML/CTF Act s 6(5A)), so from 1 July 2026 you are an AUSTRAC reporting entity. Enrolment is due around 29 July 2026 for firms already operating on 1 July 2026, or within 28 days of first providing a designated service. Read: are buyers agents caught by AML Tranche 2?

Step two: s 6E(1A) follows automatically. This is the step the AML material tends not to mention. Once you are a reporting entity, Privacy Act s 6E(1A) treats you as an organisation for your AML/CTF activities. The personal information you collect and handle to meet those obligations comes under the Privacy Act, regardless of your turnover. You do not have to opt in, register separately, or cross the A$3 million line. Becoming a reporting entity is the switch.

What s 6E(1A) actually switches on

s 6E(1A) reaches the personal information you handle for the AML/CTF activity. In practice, that is the customer-due-diligence data set:

Identity and verification documents (VOI) for the buyer.
Source-of-funds and source-of-wealth evidence, where a client is higher-risk under your customer due diligence. This is data you may hold, not something in every file.
Beneficial-ownership, PEP and sanctions-screening results.
The financial-capacity records you gather and assess as part of onboarding a client to that service.

For this data, all the ordinary APP duties apply: collect only what you need (APP 3), tell the client why you are collecting it (APP 5), keep it secure (APP 11), and do not repurpose it for marketing (APP 6). Read: VOI and source-of-funds privacy rules

What it leaves alone

This is where honest scope matters, because it is easy to overstate. s 6E(1A) does not put your whole business under the Privacy Act.

Your general buyer CRM stays outside the s 6E(1A) route.
Your newsletter list, property alerts and web enquiries are not pulled in by becoming a reporting entity.
The rest of your practice stays under the s 6D small-business exemption unless a separate trigger applies (for example, you cross A$3 million).

So the accurate answer is not "the whole Privacy Act now applies to you." It is "the Privacy Act now applies to the AML/KYC identity data you collect, and you need to handle that data to the APP standard." A general removal of the A$3 million exemption has been proposed as a future reform, but it is not yet law, so treat blanket "exemption removed" claims with caution.

Why the turnover threshold stops mattering for this data

The small-business exemption is about size. s 6E(1A) is about activity. Once your activity includes a designated service, the exemption that shelters the rest of your firm no longer reaches the data tied to that service. A sole-operator buyers agent turning over A$200,000 and a large agency are in the same position for their customer-due-diligence data: both are inside the APPs for it. Size changes nothing here. Read: does the Privacy Act apply to buyers agents under $3 million?

The enforcement point is real but should be stated plainly. A mishandling of this data can be an interference with the privacy of an individual, which an affected person can complain about to the OAIC. Privacy Act penalties are ceilings, not certainties, and most matters resolve with no fine, but the exposure applies to a sub-A$3 million practice now. These are separate from AML/CTF penalties, which sit with AUSTRAC and which Privaproof does not assess.

This is the half your AML pack skips

Your AML tool or doc-pack does the identity checks and the AUSTRAC-facing program. It does not give you the privacy documents the same 1 July 2026 trigger now expects: the APP 1 privacy policy, the APP 5 collection notice at engagement, the data-breach response plan, and the retention schedule that reconciles the AML record-keeping floor with the APP 11.2 "destroy when no longer needed" principle. That gap is the privacy half, and it is created by the same change that made you a reporting entity. Read: AML kit vs privacy kit, what your AML pack leaves out

What if you are advice-only?

If your service genuinely never finds or identifies a specific property and never negotiates for a fee, only advises, you may fall outside the brokering definition, in which case step one never fires and s 6E(1A) never reaches you. But a buyers agency retained to acquire a property is doing the caught activity on any reading. This is fact-specific, so confirm your own position rather than assuming either way. Read: advice-only or research-only buyers agent, are you caught?

Common questions

Do I have to register with the OAIC once I am a reporting entity?

No. There is no separate privacy registration. s 6E(1A) applies by operation of law the moment your AML/CTF reporting-entity status begins. Your job is to handle the customer-due-diligence data to the APP standard, not to sign up anywhere for it.

Does s 6E(1A) put my whole business under the Privacy Act?

No. It reaches the personal information you handle for your AML/CTF activities, which is the customer-due-diligence identity, source-of-funds and beneficial-ownership data. Your general buyer CRM, newsletter list and property alerts stay outside that route unless a separate trigger applies.

I turn over well under $3 million. Does the exemption still protect me?

Not for the AML/KYC data. The s 6D small-business exemption is about turnover; s 6E(1A) is about activity. Once you provide a designated service, the exemption no longer reaches the identity data tied to it, whatever your turnover.

Is this the same as being "fully APP-compliant"?

For the data s 6E(1A) covers, you are expected to meet the APPs. It does not make your whole practice a full APP entity across every record you hold. The targeted obligation is real, but it is scoped to the customer-due-diligence data, not your entire database.

When does this start?

The reporting-entity obligation starts from 1 July 2026, with enrolment due around 29 July 2026 for firms already operating on that date. s 6E(1A) follows from the same point, so the privacy obligation on your AML/KYC data is live from when you become a reporting entity. Confirm your firm's exact enrolment date with AUSTRAC.

This is general information and document templates you tailor to your own business, not legal advice. Privaproof is not a law practice and does not provide legal advice. This page does not assess your obligations under the AML/CTF Act itself, which are administered by AUSTRAC. Privaproof's buyers-agent documents are self-authored and are not independently reviewed by a solicitor. The Privacy Act 1988 (Cth) and related guidance change over time, so check you are working from a current version. For advice on your specific circumstances, consult a qualified Australian legal practitioner.