Privacy rules for the owners roll, cameras and committee records

We will not tell you that you are "caught" by a new law, because for strata that is often not true. Strata management is not itself a designated service. The AML/CTF Act's real-estate table (s 6(5A), Table 5) covers brokering, selling or transferring real estate, and the professional-services table (s 6(5B), Table 6) covers assisting in a transaction to transfer real estate or a body corporate, so the 2026 AML/CTF timetable was not written for strata work. If your business also sells real estate, that side of it is a separate question. Here is the honest position:

• The owners corporation itself The owners corporation is a separate entity from your business, and whether the Australian Privacy Principles reach it turns on section 6D of the Privacy Act 1988 (Cth). A small business operator, broadly an entity that carries on only businesses with annual turnover of A$3 million or less, is outside the definition of "organisation" in s 6C and so outside the APPs. Two things are worth knowing before assuming the answer: the Act does not define "business" at all, and an owners corporation's turnover is a question of fact for the scheme.
• Your managing-agent business Your managing-agent business is outside the small-business exemption if any limb of s 6D(4) of the Privacy Act applies to it. The two that matter most in strata are s 6D(4)(a), where the business has had an annual turnover of more than A$3 million in a financial year that has ended since it started (a one-way test: once a year goes over, the exemption does not come back), and s 6D(9), where the company is related to a body corporate that carries on a business that is not a small business. The other limbs in s 6D(4)(b) to (f) are rarer, but they exist.
• If you are a smaller independent manager under A$3 million and not part of a larger group, If you are a smaller independent manager under A$3 million and not part of a larger group, the Australian Privacy Principles may not apply to your business at all. That depends on every limb of s 6D(4), not turnover alone, and on whether any financial year since the business started has gone over A$3 million. Treat it as a question to check, not an answer to assume. We will say so rather than sell you coverage you do not have. Read: does the Privacy Act apply to strata managers?

But three things reach you regardless of turnover: the state strata legislation that governs the scheme (its record and access duties sit on the owners corporation, and reach you through your delegation: in New South Wales a delegated strata managing agent commits the offence instead of the owners corporation, SSMA 2015 s 57), your management agreement with the owners corporation, and your state surveillance and listening-devices law, which binds any person directly. And a data breach harms residents whether or not a statute compelled you to prevent it. That is why this matters even if the Privacy Act does not reach you.

You hold, in one small office, a concentrated and unusually sensitive pool of a whole building's personal information: the owners and strata roll (names, lots, contact details), tenant and occupier details that often arrive without the person ever contacting you, levy arrears and debt-recovery files, by-law-breach and dispute records in a high-conflict context, committee and proxy records naming individuals, contractor details, and CCTV footage and access logs. In October 2022 the Gold Coast strata manager SSKB told customers that a third party had gained unauthorised access to its IT environment, downloaded information and posted a ransom demand (reported by iTnews, 28 October 2022). A breach here exposes people who never chose to deal with you. Read: a data-breach response plan for strata managers

1. The owners roll: state law makes you disclose it, and the Privacy Act may make you protect it. State strata law compels the owners corporation to keep the roll and make it available for inspection, and you carry that duty where it has been delegated to you, so privacy is not a lawful excuse to refuse a proper request. Yet a manager who is covered by the Privacy Act still owes APP 6 (which restricts using or disclosing the roll for a purpose other than the one it was collected for, unless an exception such as APP 6.2(b) applies) and APP 11 (reasonable steps to protect it) over that same roll. Both are true at once, and and reconciling the two is the part that takes real work. Read: can a strata manager give out an owner's details? · Read: who can access the strata roll?

2. CCTV and surveillance on common property. Cameras, video intercoms, boom-gate plate readers and audio recording on common property are governed by your state's surveillance-devices and listening-devices laws, which apply independently of the Privacy Act and bind you even if you are inside the small-business exemption. What they govern differs by state. In Victoria it is an offence to install or use an optical surveillance device to record a private activity you are not a party to without the consent of each party (SDA 1999 s 7(1)), and "private activity" excludes an activity carried on outside a building (s 3(1)), so a camera trained inside a lot is the live risk rather than one over an open car park. In New South Wales the optical offence turns on entry onto premises or interference with a vehicle or object without consent (SDA 2007 s 8), not on where a lawfully mounted camera points. Queensland regulates listening devices only (Invasion of Privacy Act 1971 s 43). Audio is the strict one in all three states. None of these Acts requires CCTV signage: in New South Wales the signage duty comes from the Workplace Surveillance Act 2005 s 11 and applies to surveillance of employees at work. Read: CCTV and surveillance privacy laws for strata

• A privacy policy written for a strata management business, not a generic website template.
• Collection notices for the real collection points, including the handover of an existing scheme (where you inherit data about people who never dealt with you) and tenants collected via the owner.
• A CCTV and surveillance policy with a resident notice and signage guidance, scoped to your state.
• A strata-roll disclosure and access procedure that reconciles the statutory duty to disclose with the duty to protect.
• A data-breach response plan and a retention and destruction schedule (including how long to keep an ex-owner's or former tenant's records).

A real-estate or conveyancer kit is the wrong shape (no AML, no rentals, a different data pool).