Skip to content
Get the Buyers Agent Kit

Home › Buyers agents › Does the Privacy Act apply to buyers agents under $3 million?

Does the Privacy Act apply to buyers agents under $3 million?

Yes, in part. Once you broker, find or identify property for a buyer-client, you become an AUSTRAC reporting entity from 31 March 2026, and Privacy Act s 6E(1A) then applies the Act, as if you were an organisation, in relation to the activities you carry on for the purposes of, or in connection with, the AML/CTF Act, regardless of the A$3 million small-business exemption. The carve-in is scoped by activity, not by a category of data: it reaches the personal information you handle in the course of that anti-money-laundering work, and it does not make your whole practice an APP entity for everything else.

By Jon Oates, Founder of Privaproof · Last updated

General information, document templates and tools you tailor, not legal advice. Privaproof is not a law practice and does not assess your AML/CTF obligations, which are administered by AUSTRAC.

The small-business exemption is real, but broking punches a hole in it

Under section 6D of the Privacy Act 1988 (Cth), a business whose annual turnover for the previous financial year was A$3 million or less is generally a "small business operator", exempt from the Act and the Australian Privacy Principles (APPs). Turnover is not the only test, and the exits are a list rather than a pair. s 6D(4) takes you out of "small business operator" if you have had annual turnover of more than A$3 million for any financial year that has ended since you started the business (s 6D(4)(a), and that one does not reverse if turnover later falls), if you provide a health service and hold health information (s 6D(4)(b)), if you disclose personal information about someone for a benefit, service or advantage (s 6D(4)(c)), if you provide a benefit, service or advantage to collect personal information from someone else (s 6D(4)(d)), if you are a contracted service provider for a Commonwealth contract (s 6D(4)(e)), or if you are a credit reporting body (s 6D(4)(f)). s 6D(9) adds a body corporate related to a body corporate that is not a small business, and s 6EA lets an operator choose to be treated as an organisation. Paid referral arrangements with brokers, conveyancers or inspectors are worth reading against s 6D(4)(c) and (d), which have consent and legislative-authority carve-outs in s 6D(7) and (8). A buyers agency sitting under the turnover threshold commonly assumes that under $3m the Privacy Act does not apply to it.

For most of an ordinary small business, that is broadly right. The hole for a buyers agent is what you do to onboard a client. From 31 March 2026, brokering the purchase of real estate for a buyer is a "designated service" under the AML/CTF Act (Table 5 item 1, AML/CTF Act s 6(5A)), which makes you an AUSTRAC reporting entity. The moment you are a reporting entity, the exemption that shelters the rest of your practice stops reaching the activities you carry on for the purposes of, or in connection with, that Act, and the personal information you handle in the course of them. Read: are buyers agents caught by AML Tranche 2?

How the Privacy Act switches on: s 6E(1A)

The bridge is Privacy Act s 6E(1A). When a small business becomes a reporting entity under the AML/CTF Act, s 6E(1A) treats it as an organisation in relation to the activities it carries on for the purposes of, or in connection with, activities relating to that Act, so the personal information it handles in the course of them comes under the Privacy Act regardless of turnover. For a buyers agent those activities are customer due diligence, ongoing monitoring, record-keeping and reporting, so what comes into scope is the information you handle in doing them: the identity and verification documents, and the source-of-funds, financial-capacity and beneficial-ownership information you collect and keep to satisfy the AML rules.

So the honest answer is not "the whole Privacy Act now applies to you". It is "the Privacy Act now applies to what you do for AML, and to the personal information you handle in doing it, even under $3 million". Read: does becoming an AML reporting entity trigger the Privacy Act?

What s 6E(1A) does, and does not, pull in

This is where the scope matters, because it is easy to overstate.

So the accurate line is: the Privacy Act reaches what you do for AML and the personal information you handle in doing it, and you should treat that information accordingly, but it does not apply the Act to the rest of your business.

Why a buyers agency has no sheltered side of the business

A mixed sales-and-rentals agency is only partly caught, because a lease for a term of 30 years or less is excluded from the definition of "real estate" in AML/CTF Act s 6, so ordinary property management and residential leasing are not the designated service. A buyers agent has no such shelter. Finding or identifying a property to buy, and negotiating the purchase, is the core of the work, so the caught activity is the work itself rather than one line of business inside it, and the s 6E(1A) carve-in follows. That structural fit is why a boutique buyers agent is a clear case of this trigger. Read: the privacy kit no RE-agency tool covers

The obligation attaches at the front of the relationship. AUSTRAC states that "a person acting as a buyer's agent starts providing a designated service to a buyer or transferee when an agreement to find or identify a property is signed", before any property is actually found, so the AML activity, and the information you handle for it, is in scope from engagement.

Advice-only or research-only? It depends

If your service genuinely never finds or identifies a specific property and never negotiates, and takes no brokering commission, you may fall outside the brokering definition, and the s 6E(1A) route may not reach you. But a buyers agency retained to acquire a property is doing the caught activity on any reading. AUSTRAC's stated indicator of brokering is that your services "include negotiating on behalf of the person you represent or seeking to find a person for the person you represent to transact with, in return for a payment of a commission", so whether an advice-only service is caught turns on what you actually do. Confirm your own position rather than assuming either way. Read: advice-only or research-only buyers agent, are you caught?

The data-breach scheme follows the same data

The Notifiable Data Breaches (NDB) scheme runs on the same logic. Under s 26WE(2), an eligible data breach is one where there is unauthorised access to or disclosure of the information and "a reasonable person would conclude that the access or disclosure would be likely to result in serious harm" to an affected individual, so it is a judgment made about the particular breach rather than a standing property of a data set. A buyers agent concentrates identity documents, bank and savings statements, borrowing capacity and, for higher-risk clients, source-of-funds evidence on a small number of high-value buyers, which is the kind of information that assessment has to weigh. That is why the privacy half of your obligations is not just a policy document: it is a response plan for what s 6E(1A) has brought inside. Read: your data-breach response plan

So, does it apply to you?

If you broker, find, identify or negotiate property purchases for a fee, then yes, since 31 March 2026 you have been an AUSTRAC reporting entity, and Privacy Act s 6E(1A) applies the Act to the activities you carry on for the purposes of, or in connection with, the AML/CTF Act, under $3 million and regardless of the small-business exemption. The AML/CTF obligations themselves commenced on 1 July 2026, but reporting-entity status, which is what s 6E(1A) turns on, dates from 31 March 2026. The carve-in is targeted, not total: it reaches those activities and the personal information you handle in the course of them, and it does not make your entire practice an APP entity for every other purpose. But for the identity, financial-capacity and source-of-funds work at the centre of onboarding a buyer, it is real. Read the cornerstone: privacy compliance for Australian buyers agents

Common questions

Is my buyers agency exempt from the Privacy Act because we turn over less than $3 million?

Not for your AML work. The s 6D small-business exemption may cover much of your practice, but turnover is not the only exit: s 6D(4)(a) to (f) and s 6D(9) each take a business out of "small business operator", and s 6D(4)(a) does not reverse if turnover later falls. Separately, once you became an AUSTRAC reporting entity from 31 March 2026, Privacy Act s 6E(1A) applied the APPs to the activities you carry on for, or in connection with, the AML/CTF Act, and to the personal information you handle in the course of them, regardless of turnover.

Does this put my whole buyer database under the Privacy Act?

No. s 6E(1A) applies the Act in relation to the activities you carry on for the purposes of, or in connection with, the AML/CTF Act, so it reaches that work and the personal information you handle in doing it: identity documents, source-of-funds and financial-capacity evidence, beneficial-ownership information, and the records you have to keep. It does not apply the Act to activities unconnected with AML, such as your newsletter or your property alerts, unless a separate trigger applies. Where a record in your general buyer database is also relied on for an AML activity, it is being handled for that activity.

When does the identity data come into scope?

From engagement. You start providing the designated service when the client signs the agreement to find or identify a property, before any property is found, so the identity data you collect to onboard them is in scope from that point.

I only advise and research, I never negotiate. Am I caught?

It depends on the facts. A service that genuinely never finds or identifies a specific property, never negotiates, and takes no brokering commission may fall outside the brokering definition. But a buyers agency retained to acquire a property is doing the caught activity on any reading. Confirm your own position rather than assuming either way.

Is the small-business exemption being removed for buyers agents in 2026?

A general removal of the A$3 million exemption has been proposed as a future reform, but it is not yet law. What is in force is s 6D as written, with the exits Parliament already put in it (s 6D(4)(a) to (f), s 6D(9) and the s 6EA choice to be treated as an organisation), alongside the s 6E(1A) AML-activity carve-in once you are a reporting entity. Treat blanket "exemption removed from 1 July 2026" claims with caution.

This is general information and document templates you tailor to your own business, not legal advice. Privaproof is not a law practice and does not provide legal advice. This page does not assess your obligations under the AML/CTF Act itself, which are administered by AUSTRAC. The Privacy Act 1988 (Cth) and related guidance change over time, so check you are working from a current version. For advice on your specific circumstances, consult a qualified Australian legal practitioner.