Does the Privacy Act apply to strata managers?
Not automatically. In almost every case a strata managing agent is bound by the Australian Privacy Principles only where its annual turnover is more than A$3 million, or it is a related body corporate of a larger group that is already covered. Section 6D has a few rarer limbs as well, and the one worth a look in strata is disclosing owner details for a benefit such as insurance commission, which is fact-specific and often carved out by consent. The owners corporation itself is almost always a small business and usually exempt. But state strata law and state surveillance law bind you either way, and the data you hold is just as sensitive regardless.
By Jon Oates, Founder of Privaproof · Last updated
General information, document templates and tools you tailor, not legal advice. Privaproof is not a law practice.
The honest starting point: the small-business exemption
Under section 6D of the Privacy Act 1988 (Cth), a business with annual turnover of A$3 million or less is generally a "small business operator" and sits outside the Act and the Australian Privacy Principles (APPs). Many independent strata management businesses turn over less than that, so the honest answer for a lot of managers is: you may genuinely be exempt from the APPs across your business, and we will say so rather than sell you coverage you do not have.
That exemption is still in force as at July 2026. You may have read that it is being scrapped. A general removal of the small-business exemption has been proposed as a future reform, but there is no Bill and no legislated date, so it is a horizon item to watch, not a deadline. Do not act on posts that tell you the exemption is already gone.
The two main ways a strata manager IS covered
The exemption is the default. Two things account for almost every covered managing agent:
- Turnover over A$3 million. If your management business turns over more than A$3 million a year, it is an APP entity and the full APPs apply, full stop.
- The related-body-corporate limb. Even a small office is covered if it is a related body corporate of a larger company that is itself subject to the Privacy Act. This is why many branded and national strata managers are already caught, even when the person running a local office assumes they are exempt. Australia's largest strata manager, PICA Group, runs 15 brands across more than 220,000 lots ; firms sitting under a group like that are APP entities through the related-body-corporate limb regardless of their own turnover.
So "I'm a small strata office, therefore I'm exempt" is often true, and often false. It turns on your turnover and your ownership, not on the fact that you work in strata. Read: strata manager vs owners corporation, who is actually covered?
The rarer limbs, which we mention because "only turnover and ownership" is not the whole section
Section 6D lists other ways a small business operator loses the exemption. They bite far less often in strata than the two above, and we are not going to pretend otherwise, but a closed list of two would be wrong:
- Disclosing personal information about someone for a benefit (s 6D(4)(c)), or paying to collect it (s 6D(4)(d)). The strata fact pattern worth thinking about is insurance commission: a manager who passes owner and lot details to an insurer or broker and is paid a commission is doing something that engages the words of (c) on their face. It usually does not end there, because s 6D(7) carves out disclosures the individual consented to, and s 6D(8) does the same for the collection limb. Where the owners corporation has authorised the placement and owners have been told, the carve-out will often apply. It is fact-specific and it turns on your own agreements and disclosures, not on a rule of thumb.
- Holding a Commonwealth contract (s 6D(4)(e)). Commonwealth only, not State or Territory, so it is uncommon in strata but not impossible.
- Opting in to be treated as an APP entity (s 6EA). Some firms do this deliberately, usually to satisfy a client or an insurer.
None of these is a reason to assume you are covered. They are the reason not to assume you are exempt purely because you are under A$3 million and independently owned.
Note a common mix-up: the strata "body corporate" or owners corporation is not the same thing as a Corporations Act "related body corporate." They are different legal concepts. The related-body-corporate test bites when your firm sits inside a larger corporate group, not because a scheme is called a body corporate.
The owners corporation itself is a separate question
Do not confuse your business with the scheme you manage. The owners corporation (the body corporate, in Queensland) is almost always a small-business operator in its own right, turning over well under A$3 million, so it usually falls within the s 6D exemption too. The managing agent and the owners corporation are two separate entities, and each is assessed on its own turnover and structure. The manager holds the roll and other records on behalf of the owners corporation, and if either one is covered, that one owes its own APP duties. Read: owners corporations and the $3 million small-business exemption
We are deliberately not importing overseas "data controller / processor" language here. Australian law makes each covered entity directly responsible for its own compliance, rather than splitting duties between a controller and a processor.
There is no AML trigger for strata
If you manage real estate or conveyancing as well, you may have heard about anti-money-laundering "Tranche 2" reforms from 1 July 2026. Strata management is not caught by them. Strata management is not a designated service under the AML/CTF Act, strata managers are not AUSTRAC reporting entities, and there is no s 6E bridge and no 1 July 2026 deadline for strata work. Tranche 2 captures real estate agents, buyers' agents, developers, conveyancers, lawyers and accountants, not strata managers. Anyone telling you strata faces an AML deadline is selling you a problem you do not have.
What binds you even if you are exempt
This is the part that matters, because the Privacy Act is only one of three layers, and it is the one most likely not to reach a small manager. These bind you regardless of your turnover:
- State strata legislation. Your state's strata law requires you to keep the owners roll and scheme records and to make them available for inspection by owners and other entitled people. In New South Wales, for example, the Strata Schemes Management Act 2015 sets the roll's content (s 178), a record-retention floor of around seven years (s 180) and an inspection-access right on request and payment of the prescribed fee (s 182). Victoria (Owners Corporations Act 2006) and Queensland (Body Corporate and Community Management Act 1997) have their own register and access duties, with different section numbers . If you are outside NSW, Vic or Qld, check your own state.
- Your management agreement. Your contract with the owners corporation almost always imposes its own confidentiality and data-handling obligations, enforceable whether or not the Privacy Act applies.
- State surveillance-devices law. CCTV, video intercoms and audio recording on common property are governed by your state's Surveillance Devices Act, which applies independently of the Privacy Act and binds you even if you sit inside the small-business exemption. Read: CCTV and surveillance privacy laws for strata
- Tribunal and reputational exposure. A resident who feels their data was mishandled can take it to the strata tribunal, to your peak body, or to the press, none of which wait for a turnover threshold to be crossed.
The tension a covered manager has to hold
Here is the point every generic template gets wrong. State strata law compels you to disclose the roll and records to entitled people, so "privacy" is generally not a lawful reason to refuse a proper inspection request. An NCAT appeal has been described as confirming there is "no privacy in strata records" . Yet if your business is covered by the Privacy Act, you still owe APP 6 (use or disclose personal information only for authorised purposes) and APP 11 (keep it secure, and destroy or de-identify it when no longer needed) over that very same roll.
Both are true at once. You must hand the roll to the people entitled to it, and you must not leak it to anyone else or leave it unsecured. Getting that line right is the hardest question in strata privacy, and it is why a strata-specific approach beats a generic website policy. Read: can a strata manager give out an owner's details? · Read: who can access the strata roll, and what does it contain?
Why this is worth handling even if you are exempt
A strata office concentrates a whole residential community's most sensitive information in one place: the owners roll, tenants and occupiers, levy arrears and debt-recovery files, by-law-breach and dispute records, committee and proxy details, and CCTV footage. Strata offices are already ransomware targets . A breach here exposes people who never chose to deal with you, and it will not be much comfort to them that a turnover threshold meant you had no federal duty to prevent it. Handling this data well is a professional standard, not just a compliance box. Read: a data-breach response plan for strata managers
So, does it apply to you?
If your management business turns over more than A$3 million, or you are part of a larger covered group, then yes, the full Australian Privacy Principles apply. If you are a genuinely independent manager under A$3 million and not part of a group, then for the Privacy Act itself, probably not, and we will not pretend otherwise. Either way, state strata law, your management agreement and state surveillance law still bind you, and the data is just as sensitive. Work out which side of the A$3 million and related-body-corporate line you are on first, then build from there. Read the cornerstone: privacy compliance for strata and owners-corporation managers
Common questions
I run a small strata office under $3 million. Am I exempt from the Privacy Act?
Possibly, yes. The s 6D small-business exemption is still in force, so a manager under A$3 million turnover that is not part of a larger covered group generally sits outside the Australian Privacy Principles. But check the related-body-corporate limb first, and remember state strata law and state surveillance law still bind you regardless.
Is the $3 million small-business exemption being removed?
Not yet. A general removal has been proposed as a future reform, but there is no Bill and no legislated date as at July 2026. Treat "the exemption is gone" claims as premature, and watch for actual legislation rather than acting on commentary.
Is the owners corporation covered by the Privacy Act?
Usually not. The owners corporation is almost always a small-business operator turning over well under A$3 million, so it typically falls within the exemption. It is a separate entity from the managing agent, and each is assessed on its own turnover and structure.
Does the AML / Tranche 2 change from 1 July 2026 apply to strata managers?
No. Strata management is not a designated service under the AML/CTF Act, so strata managers are not AUSTRAC reporting entities and no 1 July 2026 deadline applies to them. Tranche 2 captures real estate agents, conveyancers, lawyers and accountants, not strata management.
If I am exempt, can I refuse to hand over the owners roll on privacy grounds?
Generally no. State strata law compels you to keep the roll and make it available to entitled people, so privacy is not usually a lawful ground to refuse a proper request. If your business is covered by the Privacy Act, you must still secure that roll and not disclose it to unauthorised third parties, so both duties apply at once.
This is general information and document templates you tailor to your own business, not legal advice. Privaproof is not a law practice and does not provide legal advice. Privaproof's strata documents are self-authored and are not independently reviewed by a solicitor. Whether the Privacy Act 1988 (Cth) applies to your business depends on your turnover and structure; state strata legislation and state surveillance-devices law apply separately and vary by jurisdiction, so confirm your own state's requirements. The law changes over time, so check you are working from a current version. For advice on your specific circumstances, consult a qualified Australian legal practitioner.