Question 1

Does a real estate agency need a privacy policy?

Accepted Answer

If your agency is covered by the Privacy Act (see small business exemption ), APP 1.3 requires a clearly expressed, up-to-date privacy policy on how you manage personal information, APP 1.4 sets its minimum contents, and APP 1.5 requires reasonable steps to make it available free of charge. It must describe the agency's actual handling, including appraisals, rentals, sales and marketing, and it is what the 2026 OAIC sweep assessed against APP 1.4. It is separate from the shorter collection notice on your forms ( both, together ). (APP 1.3, APP 1.4, APP 1.5.)

Question 2

Do agents need a collection notice on rental application forms?

Accepted Answer

Only if the agency is an APP entity (see small business exemption ). Where the Act applies, APP 5.1 requires such steps (if any) as are reasonable in the circumstances, at or before collection or, if that is not practicable, as soon as practicable afterwards, to notify the person of the APP 5.2 matters that are reasonable in the circumstances. Those matters are set out at APP 5.2(a) to (j) and under collection notice . In Commissioner initiated investigation into 7-Eleven Stores Pty Ltd (Privacy) [2021] AICmr 50 the Commissioner said at [121] that a privacy policy is not generally a way of giving notice under APP 5, and at [122] that notice should have been given at the point of collection, before capture. (APP 5.1, APP 5.2, APP 5.2(a).)

Question 3

Is my agency exempt from the Privacy Act under $3 million turnover?

Accepted Answer

It depends, and turnover is only the first test. An agency providing a sales-side designated service (brokering the sale or purchase of real estate) is a reporting entity under the AML/CTF Act, and s 6E(1A) then applies the Privacy Act whatever its turnover, but only to the AML/CTF activities described under small business exemption . There is no group aggregation rule: s 6D(9) does not add related companies' turnover together, but asks whether a body corporate the agency is related to is, on its own figures, not a small business operator, and if so the agency is taken not to be one either. Relatedness is decided under the Corporations Act 2001, so companies that merely share an owner are not related bodies corporate. Even under $3,000,000, the exceptions in s 6D(4) can apply on their own. Get advice if any trigger is close. (s 6E(1A), s 6D(9), s 6D(4).)

Question 4

What counts as sensitive information on a rental application?

Accepted Answer

The categories are listed under sensitive information ; the ones that surface on a rental form are health information, racial or ethnic origin, religious beliefs or affiliations, and criminal record. Disability isn't a separate category but is captured as health information, and information is sensitive only where it clearly indicates a listed matter, not where it hints at one. Citizenship and visa details are not sensitive information as such, but in IRE Pty Ltd (Privacy) [2026] AICmr 24 the Commissioner found at [94] that the platform could carry out its functions without collecting citizenship status and visa expiry. Under APP 3.3, an APP entity must not collect it unless the individual consents and the information is reasonably necessary for one or more of the entity's functions or activities, or an APP 3.4 exception applies. On a rental form, a doctor's letter supporting an assistance animal is health information, and an open-ended "any other information" box can draw in sensitive information the agency has no need for. (APP 3.3, APP 3.4.)

Question 5

Can a rental agent ask about my health, disability or religion?

Accepted Answer

Generally no: these are sensitive information , and disability counts as health information (s 6FA). Collecting them needs consent and reasonable necessity for an agency function, or an APP 3.4 exception such as a collection required or authorised by an Australian law (APP 3.3); a covered agency must also take reasonable steps to state its collection purposes (APP 5.1, 5.2(d)). A small business operator under s 6D sits outside the APPs unless a trigger applies. Anti-discrimination law is a separate regime and binds agents whatever their turnover: refusing an application for accommodation on the ground of disability, or requesting information relating to a disability in connection with such an act, is unlawful, subject to the exceptions in those sections (Disability Discrimination Act 1992 (Cth) ss 25(1)(a), 30). Whether religion is protected in renting depends on the applicable state or territory law. (s 6FA, APP 3.4, APP 3.3.)

Question 6

Can an agent ask for my driver's licence or Medicare number?

Accepted Answer

An agency covered by the Privacy Act can ask to see a government related identifier (a driver's licence, Medicare card, passport or Centrelink CRN) and use it where reasonably necessary to verify identity, but generally must not adopt the number as its own customer reference. Whether it may collect a copy is a separate question under APP 3.2: if the identifier could not lawfully be used or disclosed under APP 9.2, collecting it is not reasonably necessary. Copies that are no longer needed attract the APP 11.2 destruction or de-identification duty. (APP 3.2, APP 9.2, APP 11.2.)

Question 7

How long can an agent keep an unsuccessful applicant's data?

Accepted Answer

There's no single number in the Privacy Act. APP 11.2 requires such steps as are reasonable in the circumstances to destroy or de-identify personal information once it is no longer needed for any purpose for which it may be used or disclosed under the APPs, and no Australian law, or court or tribunal order, requires it to be retained. The trigger is the purpose ending, not a date: for an unsuccessful applicant's file, that is once the property is let and any dispute window has closed. The laws that reach a leasing file set destruction deadlines rather than minimum retention: in Queensland, an unsuccessful applicant's information must be destroyed within 3 months (Residential Tenancies and Rooming Accommodation Act 2008 (Qld) s 457E(1)(c)). AML/CTF customer due diligence records sit on the sales side, because leases of 30 years or less are not a designated service. Destruction means the information can no longer be retrieved, and reasonable steps reach every copy held, including archives and back-ups; where electronic information cannot be irretrievably destroyed, the OAIC accepts putting it beyond use instead, on the conditions at paras 11.51-11.52. Moving a file to an archive fold

Question 8

Do agents have to do AML checks from 2026?

Accepted Answer

Only on the sales side. Brokering the sale, purchase or transfer of real estate became a designated service under AML/CTF Tranche 2 on 31 March 2026, when Tables 5 and 6 commenced, and the agency became an AUSTRAC reporting entity that day. Leases of 30 years or less sit outside the Act's definition of real estate, so ordinary leasing and property management are not designated services. The obligations started on 1 July 2026, and a business already providing a designated service had to be enrolled with AUSTRAC by 29 July 2026, the date fixed by Sch 3 Pt 4 item 12 of the amending Act. What the checks involve is set out under customer due diligence ; the verification data is personal information, and s 6E(1A) applies the Privacy Act to those AML-related activities rather than the whole business even under the turnover threshold, so collect only what the AML/CTF rules require ( data minimisation ). (s 6E(1A).)

Question 9

Do I have to give my name and number at an open home?

Accepted Answer

Nothing in the Privacy Act requires a visitor to complete a sign-in sheet, and where the agency is covered by the Act, APP 3.2 limits collection to what is reasonably necessary for its functions or activities. If contact details are collected, APP 5.1 requires reasonable steps to make the person aware of the collection notice matters at or before collection, and reusing them for marketing is governed by APP 7. Where practicable and lawful, people may be able to deal with an agent anonymously or by pseudonym (APP 2). (APP 3.2, APP 5.1, APP 7.)

Question 10

Can I email past appraisal contacts about new listings?

Accepted Answer

For an emailed campaign the Spam Act does the work. APP 7.1 bars using personal information for direct marketing . APP 7.2 allows it for non-sensitive details collected from the person, where they would reasonably expect the use, are given a simple opt-out and have not opted out; otherwise APP 7.3 requires their consent (or that obtaining consent is impracticable) plus an opt-out statement in every message. For email and SMS the regimes do not stack: APP 6.7 hands direct marketing to APP 7, APP 7.8 disapplies APP 7 to the extent the Spam Act 2003 applies, so the message needs consent (s 16), accurate sender details (s 17) and a working unsubscribe (s 18). APP 7 still governs the data, including the APP 7.6 right to be told the source. An appraisal enquiry or an open-home sign-in is not by itself consent. (Spam Act 2003 (Cth), APP 7.1, APP 7.2, APP 7.3.)

Question 11

Can I reuse tenant data for a different purpose?

Accepted Answer

If you're an APP entity , APP 6 permits use or disclosure for the purpose of collection (the primary purpose, such as assessing a rental application), including disclosure to a third party for that purpose (passing the application to the landlord). A different purpose needs an APP 6 exception: the person consents (APP 6.1(a)), or the person would reasonably expect it and the new purpose is related to the primary purpose, and directly related if the information is sensitive (APP 6.2(a)). APP 6.2 also covers use or disclosure required or authorised by an Australian law or a court or tribunal order, and a small number of other permitted situations. Direct marketing to your tenant list is not an APP 6 question: APP 6.7 takes direct marketing by an organisation out of APP 6 and into APP 7 . (APP 6, APP 6.1(a), APP 6.2(a).)

Question 12

How do tenant blacklists like TICA work?

Accepted Answer

Tenancy databases, TICA and NTD among them, record former tenants on narrow grounds: the tenancy must have ended, only a person named as a tenant on the agreement can be listed, and only where a breach left them owing more than the bond or a tribunal ordered the agreement terminated. Falling behind during a tenancy is not on its own a ground. The listing rules sit in each state and territory's residential-tenancy Act, and the Privacy Act sits alongside them: a database operator is treated as an organisation for its database acts and practices. Before listing, the person must be given a copy of the proposed listing (or other reasonable steps to disclose it) and time to object: at least 14 days in NSW (s 213(1)) and SA (s 99G(1)), 28 days in the NT (s 129(1)(b)). A listing must relate to the breach and be accurate, complete and unambiguous (NSW s 212(d); SA s 99F(1)(d)(ii)), and a lister who learns it is inaccurate, incomplete, ambiguous or out of date has 7 days to tell the operator (NSW s 214; SA s 99H), a duty Victoria puts on the rental provider, not the agent (s 439G(1)). A written request for a copy must be answered within 14 days (NSW s 216; Qld s 459C), free in NSW (s 216(3))

Question 13

Can a tenant see the data I hold on them?

Accepted Answer

Yes, if your agency is an APP entity . APP 12.1 requires access, on request, to the personal information the agency holds about a person; APP 12.3 lets an organisation withhold on ten narrow grounds, and only to the extent a ground actually applies. APP 13.1 requires such steps (if any) as are reasonable in the circumstances to correct information that is inaccurate, out of date, incomplete, irrelevant or misleading, having regard to a purpose for which it is held, whether or not the person asks. In the Privacy Act "agency" means a Commonwealth agency, so the hard 30-day deadline in APP 12.4(a)(i) does not bind a private real-estate business: it is an "organisation", and responds within a reasonable period (APP 12.4(a)(ii), and APP 13.5(a)(ii) for corrections). That is not a longer deadline: the OAIC's guidance is that a reasonable period should not exceed 30 calendar days. Responding means giving access or notifying a refusal, so an acknowledgement does not stop the clock. Related: personal information . (APP 12.1, APP 12.3, APP 13.1.)

Question 14

What actually counts as personal information?

Accepted Answer

Any information or opinion about an identified individual, or someone reasonably identifiable (names, contact details, tenancy history, payslips, references, photos and signatures), whether true or not, and whether it is recorded in a material form or not. A CRM record that identifies a tenant, buyer or vendor is personal information. Where the Privacy Act covers an agency, the APPs govern how it is collected, stored, used and disposed of. Coverage turns on the small business exemption and on the triggers that override it, the AML/CTF one included. The higher-protection subset is sensitive information .

Question 15

What happens if my agency has a data breach?

Accepted Answer

The Notifiable Data Breaches scheme reaches APP entities : the agency if the small business exemption does not apply, and an AML-covered agency for personal information handled in connection with its designated services. On loss, or unauthorised access or disclosure, s 26WH requires an assessment of whether there are reasonable grounds to believe there has been an "eligible data breach": one a reasonable person would conclude is likely to result in serious harm. "Serious harm" is not defined in the Act; the OAIC's guidance is that it may include serious physical, psychological, emotional, financial or reputational harm. The s 26WG factors are applied to the circumstances, among them the kind of information (c), its sensitivity (d) and who could obtain it (g); no category is automatically serious. Then ss 26WK and 26WL require a statement to the OAIC and notification of the individuals at risk, both as soon as practicable. Remedial action taken so that serious harm is no longer likely means the breach is taken never to have been eligible (s 26WF). Related: data breach response plan . (s 26WH, s 26WG, ss 26WK.)

Question 16

How long do I have to report a data breach?

Accepted Answer

Once an agency covered by the Privacy Act is aware of reasonable grounds to suspect an eligible data breach, s 26WH(2) requires a reasonable and expeditious assessment, with all reasonable steps to complete it within 30 days. The clock starts at that awareness, not at the incident. If it gives reasonable grounds to believe there has been an eligible data breach, the agency gives the OAIC a statement as soon as practicable (s 26WK) and notifies the individuals at risk (s 26WL). The 30 days is an outer limit on the assessment, not a deadline to report. In Datateks Pty Ltd (Privacy) [2023] AICmr 97 at [98] the Commissioner held that preparing the statement "should have taken no more than a day or two". (s 26WH(2), s 26WK, s 26WL.)

Question 17

Can I be personally fined for a privacy breach at my agency?

Accepted Answer

A civil penalty order under s 13G is made against the entity whose act or practice was the interference, which for an incorporated agency is the company. An individual can still be reached two ways. A sole trader who is an APP entity is the entity itself: under s 6C(1)(a) an individual is an "organisation", and so an APP entity, unless they are a small business operator. And under s 92 of the Regulatory Powers (Standard Provisions) Act 2014 (Cth), applied to the Privacy Act's civil penalty provisions by s 80U, a person who aids, abets, counsels or procures a contravention, or is knowingly concerned in one, is taken to have contravened it themselves. Section 13G applies to a serious interference with privacy. The maximum is A$2.5 million for a person other than a body corporate (s 13G(2)), and for a body corporate the greatest of A$50 million, three times the benefit attributable to the conduct, or, where the court cannot determine that benefit, 30% of adjusted turnover during the breach turnover period (s 13G(3)); figures as at Compilation No. 104, 4 June 2026. The Privacy and Other Legislation Amendment Act 2024 (Cth) removed the earlier "or repeated" limb, so repetition is now on

Question 18

Can a tenant sue a real estate agent for invasion of privacy?

Accepted Answer

Only in narrow circumstances. The statutory tort for serious invasions of privacy (Privacy Act Schedule 2, inserted by the Privacy and Other Legislation Amendment Act 2024) commenced on 10 June 2025. It gives a direct court claim, separate from the OAIC complaints process, but only where all five conditions in clause 7(1) are met: the defendant intruded on the person's seclusion or misused information relating to them (the only two forms the invasion can take); a person in that position would have had a reasonable expectation of privacy; the invasion was intentional or reckless; it was serious; and the public interest in the person's privacy outweighed any countervailing public interest. Carelessness is not enough, so an application form misdirected by mistake would not ground a claim. Confirm the precise scope and any defences with a lawyer. Related: penalties .

Question 19

What happens if my CRM stores tenant data overseas?

Accepted Answer

If your agency is an APP entity , APP 8.1 requires steps reasonable in the circumstances, before disclosing personal information to an overseas recipient (a person outside Australia who is not the entity or the individual), to ensure that recipient does not breach the APPs other than APP 1. Hosting on an overseas server is not automatically a disclosure: use or disclosure turns on effective control, and the OAIC treats outsourcing to an overseas provider as a disclosure in most circumstances. Where it is a disclosure, s 16C can treat the recipient's act as your agency's own, but only if all three of its conditions are met: APP 8.1 applies and no APP 8.2 exception is relied on, the APPs do not already apply to the recipient, and the act would breach an APP other than APP 1. Check a vendor's data residency before data is loaded. Your privacy policy must say whether you are likely to disclose personal information overseas (APP 1.4(f)) and, if so, the likely countries, where it is practicable to specify them (APP 1.4(g)). Related: third-party processors . (APP 8.1, APP 1, s 16C.)

Question 20

Am I liable if my property management software gets hacked?

Accepted Answer

The duty cannot be outsourced. APP 11.1 applies to an APP entity that holds personal information, and "holds" means possession or control of the record (s 6(1)): an entity that outsources storage but keeps the right to deal with the information still holds it (OAIC APP Guidelines para 11.6). The reasonable-steps duty therefore stays with the agency, and covers third party providers, cloud computing included, and data breaches (para 11.9); see breach response plan . If the provider is breached, the agency's own assessment duty under s 26WH still runs; and where the same incident is an eligible data breach of both entities, once one has notified under ss 26WK and 26WL those sections no longer apply to the other (s 26WM), so settle in the contract who notifies. The only judicial consideration of APP 11.1(b) held the obligation to be "not capable of being discharged simply by delegating it to another entity and doing nothing more" ( Australian Information Commissioner v Australian Clinical Labs Ltd (No 2) [2025] FCA 1224 at paragraph 52(b)). Related: cross-border disclosure (APP 8) . (APP 11.1, s 6(1), s 26WH.)

Question 21

Are rental apps like 2Apply privacy compliant?

Accepted Answer

Using RentTech does not transfer the agency's duties. Where the agency is an APP entity, APP 3.2 still limits what is collected through the platform, APP 11.1 covers how it is secured, APP 11.2 destroying or de-identifying it once it is no longer needed, and APP 5.1 a collection notice at or before collection, or as soon as practicable after. In Commissioner Initiated Investigation into IRE Pty Ltd (Privacy) [2026] AICmr 24 (1 April 2026) the operator of the 2Apply platform, not any agency, was found to have collected applicant information that was not reasonably necessary; at [94] the Commissioner listed ten categories it could have done without, including gender, details of dependants, bankruptcy and retirement status, previous living history and visa expiry. The OAIC's APP Guidelines note that this position is not settled, because the determination is under review in the Administrative Review Tribunal. From 10 December 2026, APP 1.7 to 1.9 require an APP entity's privacy policy to set out the kinds of personal information used in a computer program that makes, or does something substantially and directly related to making, a decision that could reasonably be expected to signific

Question 22

What is the OAIC 2026 privacy sweep?

Accepted Answer

From the first week of January 2026 the OAIC swept the privacy policies of approximately 60 entities across six sectors that may collect personal information in person. Rental and property is one, and the Privacy Commissioner's announcement named real estate agents. It assessed those policies against APP 1.4; in May 2026 the Australian Information Commissioner said it had found instances of non-compliance in a significant proportion of the 60. A policy that does not meet APP 1.3 or APP 1.4 is a contravention named in s 13K: the OAIC can give a compliance notice (s 80UC) or an infringement notice (s 80UB), and a court can order up to 200 penalty units (s 13K(4)). (APP 1.4, APP 1.3, s 13K.)

Privacy & data terms explained: for Australian real-estate agents

Layer 1: Core terms

Sensitive information

Small business exemption

Collection notice

AML/CTF Tranche 2

Data breach response plan

Layer 2: How it's actually asked

Does a real estate agency need a privacy policy?

Do agents need a collection notice on rental application forms?

Is my agency exempt from the Privacy Act under $3 million turnover?

What counts as sensitive information on a rental application?

Can a rental agent ask about my health, disability or religion?

The 100 points of ID question

Can an agent ask for my driver's licence or Medicare number?

Tenant application data: what agents collect

Over-collection (APP 3)

How long can an agent keep an unsuccessful applicant's data?

Do agents have to do AML checks from 2026?

Do I have to give my name and number at an open home?

Can I email past appraisal contacts about new listings?

Can I reuse tenant data for a different purpose?

How do tenant blacklists like TICA work?

Can a tenant see the data I hold on them?

What actually counts as personal information?

What happens if my agency has a data breach?

How long do I have to report a data breach?

Can I be personally fined for a privacy breach at my agency?

Can a tenant sue a real estate agent for invasion of privacy?

What happens if my CRM stores tenant data overseas?

Am I liable if my property management software gets hacked?

Are rental apps like 2Apply privacy compliant?

What is the OAIC 2026 privacy sweep?

Quick reference: the rest of the jargon

APP entity

Australian Privacy Principles (APPs)

OAIC

Privacy policy (APP 1)

Customer due diligence (CDD)

De-identification

Privacy & data terms explained: for Australian real-estate agents

Layer 1: Core terms

Sensitive information

Small business exemption

Collection notice

Consent

AML/CTF Tranche 2

Data breach response plan

Layer 2: How it's actually asked

Does a real estate agency need a privacy policy?

Do agents need a collection notice on rental application forms?

Is my agency exempt from the Privacy Act under $3 million turnover?

What counts as sensitive information on a rental application?

Can a rental agent ask about my health, disability or religion?

The 100 points of ID question

Can an agent ask for my driver's licence or Medicare number?

Tenant application data: what agents collect

Over-collection (APP 3)

How long can an agent keep an unsuccessful applicant's data?

Do agents have to do AML checks from 2026?

Do I have to give my name and number at an open home?

Can I email past appraisal contacts about new listings?

Can I reuse tenant data for a different purpose?

How do tenant blacklists like TICA work?

Can a tenant see the data I hold on them?

What actually counts as personal information?

What happens if my agency has a data breach?

How long do I have to report a data breach?

Can I be personally fined for a privacy breach at my agency?

Can a tenant sue a real estate agent for invasion of privacy?

What happens if my CRM stores tenant data overseas?

Am I liable if my property management software gets hacked?

Are rental apps like 2Apply privacy compliant?

What is the OAIC 2026 privacy sweep?

Quick reference: the rest of the jargon

APP entity

Australian Privacy Principles (APPs)

OAIC

Privacy policy (APP 1)

Customer due diligence (CDD)

De-identification