Does the Privacy Act apply to strata managers?
Not automatically. A strata managing agent is bound by the Australian Privacy Principles mainly where its annual turnover for the previous financial year was more than A$3 million, or it is a body corporate related to a company whose business is over that line. Section 6D has rarer limbs as well, and the one worth a look in strata is disclosing owner details for a benefit such as insurance commission, which is fact-specific and often carved out by consent. The owners corporation is a separate entity and is assessed separately. State strata law and state surveillance law bind you either way, and the data you hold is just as sensitive regardless.
By Jon Oates, Founder of Privaproof · Last updated
General information, document templates and tools you tailor, not legal advice. Privaproof is not a law practice.
The honest starting point: the small-business exemption
Under section 6D of the Privacy Act 1988 (Cth), Under section 6D of the Privacy Act 1988 (Cth) a business is a small business if its annual turnover for the previous financial year was A$3 million or less (s 6D(1)), and the entity carrying it on is a small business operator if it carries on no business above that line (s 6D(3)). A small business operator is not an "organisation" under s 6C, so the Australian Privacy Principles do not apply to it. Two other parts of the same Act still reach it: the Tax File Number Rule, which binds any file number recipient (s 18 and the Privacy (Tax File Number) Rule 2015), and the statutory tort in Schedule 2, which has no turnover threshold and requires the invasion to have been intentional or reckless (Sch 2 cl 7(1)(c)). Many independent strata management businesses turn over less than that, so the honest answer for a lot of managers is: you may genuinely be exempt from the APPs across your business, and we will say so rather than sell you coverage you do not have.
That exemption is still in force as at July 2026. You may have read that it is being scrapped. A general removal of the small-business exemption has been proposed as a future reform, but there is no Bill and no legislated date, so it is a horizon item to watch, not a deadline. Do not act on posts that tell you the exemption is already gone.
The two main ways a strata manager IS covered
The exemption is the default. Two things account for almost every covered managing agent:
- Turnover over A$3 million. A business whose annual turnover for the previous financial year was more than A$3 million is not a small business (s 6D(1)), and s 6D(4)(a) makes that one-way: once any completed financial year since the business started has passed A$3 million, the exemption is not regained by a later quiet year. The Australian Privacy Principles then apply, subject to the exemptions that apply to any organisation, including the employee-records exemption in s 7B(3).
- The related-body-corporate limb. Section 6D(9) takes a body corporate outside the exemption if it is related to another body corporate that carries on a business that is not a small business, so an incorporated strata office inside a larger group can be an APP entity whatever its own turnover. The test is the size of the related company's business, and the limb reaches bodies corporate only, not a sole trader or a partnership. This is why many branded and national strata managers are already caught, even when the person running a local office assumes they are exempt.
So "I'm a small strata office, therefore I'm exempt" is often true, and often false. It turns on your turnover and your ownership, not on the fact that you work in strata. Read: strata manager vs owners corporation, who is actually covered?
The rarer limbs, which we mention because "only turnover and ownership" is not the whole section
Section 6D lists other ways a small business operator loses the exemption. They bite far less often in strata than the two above, and we are not going to pretend otherwise, but a closed list of two would be wrong:
- Disclosing personal information about someone for a benefit (s 6D(4)(c)), or paying to collect it (s 6D(4)(d)). The strata fact pattern worth thinking about is insurance commission: a manager who passes owner and lot details to an insurer or broker and is paid a commission is doing something that engages the words of (c) on their face. It usually does not end there, because s 6D(7) carves out disclosures the individual consented to, and s 6D(8) does the same for the collection limb. Where the owners corporation has authorised the placement and owners have been told, the carve-out will often apply. It is fact-specific and it turns on your own agreements and disclosures, not on a rule of thumb.
- Being a contracted service provider for a Commonwealth contract (s 6D(4)(e)), whether or not you are a party to the contract. Commonwealth only, not State or Territory, so it is uncommon in strata but not impossible, and s 7B(2) keeps the rest of the business exempt for acts that are not for the purposes of the contract.
- Opting in to be treated as an organisation (s 6EA). The choice is made in writing to the Information Commissioner and is entered on a public register (s 6EA(2), (3) and (6)).
None of these is a reason to assume you are covered. They are the reason not to assume you are exempt purely because you are under A$3 million and independently owned.
Note a common mix-up: the strata "body corporate" or owners corporation is not the same thing as a Corporations Act "related body corporate." They are different legal concepts. The related-body-corporate test bites when your firm sits inside a larger corporate group, not because a scheme is called a body corporate.
The owners corporation itself is a separate question
Do not confuse your business with the scheme you manage. The owners corporation (the body corporate, in Queensland) is a separate entity from the managing agent and is assessed on its own. Most schemes collect well under A$3 million, but s 6D(3) also requires the entity to be carrying on a business, and whether an owners corporation levying contributions to run its own scheme is carrying on a business has not been settled. Treat an owners corporation's position as a question to check rather than an assumption, and take advice where the scheme is large or trades in any way. The managing agent and the owners corporation are two separate entities, and each is assessed on its own turnover and structure. The manager holds the roll and other records on behalf of the owners corporation, and if either one is covered, that one owes its own APP duties. Read: owners corporations and the $3 million small-business exemption
We are deliberately not importing overseas "data controller / processor" language here. Australian law makes each covered entity directly responsible for its own compliance, rather than splitting duties between a controller and a processor.
There is no AML trigger for strata
If you manage real estate or conveyancing as well, you may have heard about anti-money-laundering "Tranche 2" reforms from 31 March 2026. Routine strata scheme management is not caught by them. None of the nine professional-services designated services in s 6(5B) of the AML/CTF Act describes strata scheme management, so it does not on its own make a strata manager an AUSTRAC reporting entity, and without that there is no s 6E(1A) bridge and no 1 July 2026 obligation date for strata work. Two edges matter if your firm does more than strata: item 1 catches assisting a person in a transaction to sell, buy or transfer real estate, and item 3 catches receiving, holding or managing a person's money as part of a transaction, with carve-outs in s 6(5C) whose own note gives property management services as the example. What decides it is the service provided, not the profession. Anyone telling you strata faces an AML deadline is selling you a problem you do not have.
What binds you even if you are exempt
This is the part that matters, because the Privacy Act is only one of three layers, and it is the one most likely not to reach a small manager. These bind you regardless of your turnover:
- State strata legislation. Your state's strata law requires the owners corporation to keep the roll and scheme records and to make them available for inspection to entitled people, and a strata managing agent carries those duties to the extent the owners corporation has delegated them, which is the usual arrangement (in New South Wales, Strata Schemes Management Act 2015 s 52). In New South Wales that Act sets the roll's content (s 178), requires specified records to be retained for 7 years unless the regulations prescribe a different period (s 180), and gives an owner, mortgagee or covenant chargee an inspection right on written request and payment of the prescribed fee (s 182). In New South Wales, for example, the Strata Schemes Management Act 2015 sets the roll's content (s 178), a record-retention floor of around seven years (s 180) and an inspection-access right on request and payment of the prescribed fee (s 182). Victoria (Owners Corporations Act 2006) and Queensland (Body Corporate and Community Management Act 1997) have their own register and access duties, with different section numbers . If you are outside NSW, Vic or Qld, check your own state.
- Your management agreement. Your contract with the owners corporation almost always imposes its own confidentiality and data-handling obligations, enforceable whether or not the Privacy Act applies.
- State surveillance and listening-devices law. CCTV, video intercoms and audio recording on common property are governed by state law that applies independently of the Privacy Act and binds an operator that sits inside the small-business exemption. There is no single national Act, and the state Acts differ in name and in what they cover: Queensland, for example, has no general optical-surveillance offence and regulates only listening devices, under the Invasion of Privacy Act 1971 (Qld). Check your own state's Act. Read: CCTV and surveillance privacy laws for strata
- Tribunal and reputational exposure. These routes do not wait for a turnover threshold. In New South Wales an owner or an occupier of a lot is an "interested person" who may apply to NCAT for an order to settle a complaint or dispute about the operation, administration or management of the scheme (Strata Schemes Management Act 2015 ss 226(1)(d) and 232(1)), usually only after mediation (s 227). Whether a particular data-handling complaint fits that jurisdiction depends on the facts, and the position differs in other states.
The tension a covered manager has to hold
Here is the point every generic template gets wrong. State strata law compels you to disclose the roll and records to entitled people, so "privacy" is generally not a lawful reason to refuse a proper inspection request. In Walker v The Owners - Strata Plan No 1992 [2020] NSWCATAP 192 the NCAT Appeal Panel held that privacy did not defeat an owner's statutory right to inspect the levy register, finding "no issue of 'privacy' which in this case derogates from the statutory right of an owner to access financial information and accounting records where such a right is expressly provided under the SSM Act" (at [42]). Yet if your business is covered by the Privacy Act, you still owe APP 6 (use or disclose personal information only for authorised purposes) and APP 11 (keep it secure, and destroy or de-identify it when no longer needed) over that very same roll.
Both duties sit together, and the Act says how. APP 6.2(b) permits a use or disclosure that is required or authorised by or under an Australian law, and s 6(1) defines "Australian law" to include a State Act, so handing the roll to a person entitled to it under state strata law is within APP 6. APP 11.2 requires destruction or de-identification only where the entity is not required by an Australian law to retain the information (APP 11.2(d)), so a state retention duty such as NSW s 180 displaces it. What is left is the real duty: hand the records to the people entitled to them, and do not disclose them to anyone else or leave them unsecured (APP 11.1)., and it is why a strata-specific approach beats a generic website policy. Read: can a strata manager give out an owner's details? · Read: who can access the strata roll, and what does it contain?
Why this is worth handling even if you are exempt
A strata office concentrates a whole residential community's most sensitive information in one place: the owners roll, tenants and occupiers, levy arrears and debt-recovery files, by-law-breach and dispute records, committee and proxy details, and CCTV footage. Strata offices are in the target set. Cyber Daily reported on 20 April 2026 that the Kairos ransomware group had listed the Sydney strata manager Strata Republic on its leak site, claiming 441 GB of data (a claim by the group, not a confirmed figure). A breach here exposes people who never chose to deal with you, and it will not be much comfort to them that a turnover threshold meant you had no federal duty to prevent it. Handling this data well is a professional standard, not just a compliance box. Read: a data-breach response plan for strata managers
So, does it apply to you?
If your management business turns over more than A$3 million, or you are part of a larger covered group, then yes, the full Australian Privacy Principles apply. If you are a genuinely independent manager under A$3 million and not part of a group, then for the Privacy Act itself, probably not, and we will not pretend otherwise. Either way, state strata law, your management agreement and state surveillance law still bind you, and the data is just as sensitive. Work out which side of the A$3 million and related-body-corporate line you are on first, then build from there. Read the cornerstone: privacy compliance for strata and owners-corporation managers
Common questions
I run a small strata office under $3 million. Am I exempt from the Privacy Act?
Possibly, yes. The s 6D small-business exemption is still in force, so a manager under A$3 million turnover that is not part of a larger covered group generally sits outside the Australian Privacy Principles. But check the related-body-corporate limb first, and remember state strata law and state surveillance law still bind you regardless.
Is the $3 million small-business exemption being removed?
Not yet. A general removal has been proposed as a future reform, but there is no Bill and no legislated date as at July 2026. Treat "the exemption is gone" claims as premature, and watch for actual legislation rather than acting on commentary.
Is the owners corporation covered by the Privacy Act?
Usually not. The owners corporation is almost always a small-business operator turning over well under A$3 million, so it typically falls within the exemption. It is a separate entity from the managing agent, and each is assessed on its own turnover and structure.
Does AML Tranche 2 apply to strata managers?
Routine strata management is not a designated service under s 6(5B) of the AML/CTF Act, so it does not on its own make a strata manager an AUSTRAC reporting entity. Tables 5 and 6 commenced on 31 March 2026 and the AML/CTF obligations started on 1 July 2026, and neither creates a duty for strata scheme management. A firm that also does sales-side real estate work should assess those services on their own terms. Tranche 2 captures real estate agents, conveyancers, lawyers and accountants, not strata management.
If I am exempt, can I refuse to hand over the owners roll on privacy grounds?
Generally no. State strata law compels you to keep the roll and make it available to entitled people, so privacy is not usually a lawful ground to refuse a proper request. If your business is covered by the Privacy Act, you must still secure that roll and not disclose it to unauthorised third parties, so both duties apply at once.
This is general information and document templates you tailor to your own business, not legal advice. Privaproof is not a law practice and does not provide legal advice. Whether the Privacy Act 1988 (Cth) applies to your business depends on your turnover and structure; state strata legislation and state surveillance-devices law apply separately and vary by jurisdiction, so confirm your own state's requirements. The law changes over time, so check you are working from a current version. For advice on your specific circumstances, consult a qualified Australian legal practitioner.