Levy arrears, debt recovery and privacy in strata
Usually yes. A strata manager or owners corporation can generally disclose an owner's details to a debt collector or lawyer engaged to recover unpaid levies, because that follows from the statutory levy-recovery power and the owners roll the scheme is already required to keep. The statutes set preconditions before recovery action starts and they differ by state: in NSW, at least 30 days notice of the action (Strata Schemes Management Act 2015 (NSW) s 86(4) and (5)); in Victoria, a fee notice and then a final notice (Owners Corporations Act 2006 (Vic) ss 31 and 32). Publicly naming defaulters, on a noticeboard or at a meeting, is a different and higher-risk step.
By Jon Oates, Founder of Privaproof · Last updated
General information, document templates and tools you tailor, not legal advice. Privaproof is not a law practice.
The levy-recovery power comes with a disclosure power
An owners corporation may recover unpaid contributions as a debt in a court of competent jurisdiction, together with the reasonable expenses of recovery (Strata Schemes Management Act 2015 (NSW) s 86(2A); Owners Corporations Act 2006 (Vic) s 30(1); Body Corporate and Community Management (Standard Module) Regulation 2020 (Qld) s 166(1), made under the Body Corporate and Community Management Act 1997 (Qld) s 151(2)(d)). Interest is not automatic everywhere: in NSW an unpaid contribution bears simple interest at 10% a year unless the regulations set another rate or the owners corporation resolves otherwise (NSW ss 85(1) and (3)), while in Victoria interest may be charged only if a general meeting authorises it (Vic s 29(1)). NSW law also lets an owners corporation take legal action to recover unpaid contributions, interest and related expenses without the general-meeting approval other legal services need (NSW s 103(3)(b)). To act on that power the scheme has to identify the debtor and pass their details to whoever is chasing the debt. The power comes with preconditions, though. In NSW an owners corporation must not start recovery action without giving at least 30 days notice of the action, and the notice must set out the amount and the recovery action proposed (s 86(4) and (5)), and must not pursue an amount being dealt with under a payment plan the owner is complying with (s 86(6)). In Victoria a fee notice must be given first, and a final notice may follow only if the money is still unpaid 28 days later (ss 31 and 32). In Queensland the body corporate must start proceedings within 2 months once a contribution has been outstanding for 2 years (Standard Module s 166(2)).
The owner's name and address already sit on the roll or register the scheme is required by state law to keep, and which owners and certain other people may ask to inspect (NSW: Strata Schemes Management Act 2015 ss 177, 178(1) and 182(3)(a), on request by an owner, mortgagee or covenant chargee or their authorised person; Vic: Owners Corporations Act 2006 ss 144(a), 148(b), 146 and 150, on request by a lot owner, mortgagee, purchaser or their representative; Qld: Body Corporate and Community Management Act 1997 s 205 and Standard Module s 224). It is not a general public register, but it is not secret data the manager has gone looking for either. It is the statutory record the scheme is required to hold. Disclosing it to a debt collector engaged to recover a lawful debt is a normal exercise of the recovery power, not a privacy breach.
Why this is usually allowed under the Privacy Act, if you are even covered
Start with the honest coverage question, because for many schemes the Privacy Act does not apply at all.
- The owners corporation itself. Whether the Privacy Act reaches an owners corporation turns on a question that is genuinely unsettled. The small-business exemption in s 6D(3) applies to an entity that 'carries on one or more small businesses', and an owners corporation may carry on no business at all. In Victoria the Owners Corporations Act 2006 s 13(1) says an owners corporation must not carry on a business. An owners corporation with a turnover of A$3 million or less that does carry on a business will usually be a small business operator and outside the Australian Privacy Principles. One that carries on no business does not fit the s 6D(3) definition, and a body corporate that is not a small business operator is an 'organisation' under s 6C(1). This is worth advice on your own scheme rather than an assumption either way. Read: owners corporations and the $3 million small-business exemption Section 6D is unchanged in the current compilation of the Privacy Act 1988 (Cth) (Compilation No. 104, compilation date 4 June 2026), and no amendment removing the small-business exemption has been enacted.
- Your managing-agent business. Turnover is the main test, not the only one. A business is a small business if its annual turnover for the previous financial year was A$3 million or less, counting income from all sources including rent, leasing and hiring (ss 6D(1) and 6DA(1)). Several things take a business outside the exemption whatever its current turnover: having had a turnover above A$3 million in any completed financial year since it started, which a later fall does not undo (s 6D(4)(a)); providing a health service and holding health information (s 6D(4)(b)); disclosing personal information about someone for a benefit, service or advantage, or providing a benefit to be allowed to collect it, outside the consent and legislative-authority carve-outs (ss 6D(4)(c) and (d), with ss 6D(7) and (8)); being a contracted service provider for a Commonwealth contract (s 6D(4)(e)); being a credit reporting body (s 6D(4)(f)); being related to a body corporate that is not a small business operator (s 6D(9)); the specific activities carved in by s 6E; and opting in under s 6EA. Read: does the Privacy Act apply to strata managers?
If you are a covered manager, the disclosure still holds up. If you are a covered manager, APP 6 only bites on a use or disclosure for a secondary purpose: using or disclosing information for the purpose you collected it for needs no exception at all. Recovering the levies that fund the scheme is a core reason owner details are held, so passing a defaulter's name to a debt collector engaged for that purpose sits within the primary purpose. If it were treated as a secondary purpose, APP 6.2(a)(ii) allows a related purpose the person would reasonably expect for information that is not sensitive, and APP 6.2(b) allows a use or disclosure required or authorised by or under an Australian law or a court or tribunal order. Whether that also amounts to an authorisation to disclose personal information for the purposes of APP 6.2(b) has not been tested, so the safer footing is that the disclosure sits within the primary purpose the details were collected for.
If your previous financial year turnover from all sources was A$3 million or less, and none of the s 6D(4), s 6D(9) or s 6E triggers applies, you may be outside the APPs across your business. That turns on your own turnover history and structure, so check it against s 6D rather than assuming it. Either way, the answer to "can we send this to the debt collector" is generally yes, once the statutory notice steps in your state have been taken.
The debt collector has duties of their own
Handing the file over does not end your responsibility, and it does not put the debtor beyond protection. A debt collector or debt-recovery lawyer acting on the scheme's behalf has conduct obligations of their own. Undue harassment and coercion in connection with the collection of a debt are prohibited by s 50 of the Australian Consumer Law and s 12DJ of the ASIC Act. The ACCC and ASIC publish a joint 'Debt collection guideline: for collectors and creditors' (April 2021, issued by ASIC as Regulatory Guide 96) explaining those provisions; the guideline states that it 'does not have legal force', and it is written with particular reference to collecting debts from individual debtors. A solicitor recovering the debt is separately bound by the legal profession conduct rules in their state or territory. Disclose only what the recovery agent actually needs (identity, the amount owed, the relevant lot and contact details), not the owner's wider file, and use a collector who handles the data properly. Minimising what you send is both good practice and, for a covered manager, part of the APP 6 and APP 11 discipline below.
Where it gets risky: naming defaulters publicly
This is the line that catches strata managers out. Recovering a debt through a collector or a tribunal is one thing. Publicly identifying who is behind on levies is another, and it carries real exposure.
- Noticeboards and group emails. There is a difference between the arrears business the statute puts in front of owners and a public list of names. In NSW the notice of every annual general meeting must include a motion on how to deal with overdue contributions (Strata Schemes Management Act 2015 Sch 1 cl 9(h)), and meeting agendas may be displayed on the common-property notice board (Sch 1 cl 11(1)(b)). Pinning a standalone list of names and amounts on the noticeboard, or emailing "these owners have not paid" to the whole scheme, is not a step the recovery provisions call for. For a covered manager it is a disclosure that is harder to justify under APP 6, and it is a combustible way to run a high-conflict building. Naming an owner as a defaulter can also raise defamation risk if the claim is inaccurate. Defamation is state and territory law and is outside the scope of this page, so take advice before publishing anything that identifies an individual. Queensland's strata legislation recognises the risk directly: a body corporate is not required to allow inspection of a part of a record it reasonably believes contains defamatory material (Body Corporate and Community Management Act 1997 (Qld) s 205(3); Standard Module s 232(3)). . Regardless of the Privacy Act, it is a poor and combustible way to run a high-conflict building.
- Meetings and minutes. Arrears are legitimately reported to owners as part of the scheme's finances, and financial statements and levy ledgers presented at a general meeting will show amounts outstanding. But there is a difference between reporting the financial position and singling an individual out for public criticism. Report the numbers the meeting needs to see, and keep the tone administrative, not punitive .
- The honest test. Ask whether the disclosure is a step in recovering the debt or a step in shaming the debtor. The first is generally defensible. The second is where complaints, tribunal orders and reputational damage come from.
Note that owners and certain other entitled people can ask to inspect the scheme's records, which may reveal who is in arrears, and state strata law compels that access. It is not unlimited. In Victoria a person whose personal information is kept in the records or on the register may apply to VCAT for an order restricting access to it, and VCAT may make that order if it considers exceptional circumstances exist (Owners Corporations Act 2006 s 172). In Queensland a body corporate need not allow access to a part of a record that is privileged in a started or threatened proceeding, or that it reasonably believes contains defamatory material (Standard Module s 232(2) and (3)). No equivalent restriction appears in the NSW Act. Either way, statutory inspection on request is a different thing from the scheme actively broadcasting the list. Read: is the Privacy Act a shield against strata record access? That is inspection on request under the statute, which is a different thing from the scheme actively broadcasting the list.
Treat arrears data as sensitive in practice
Even where you are entitled to disclose it, levy-arrears and debt-recovery files are among the more sensitive things a strata office holds. They reveal financial hardship and they sit in a high-conflict setting. For a covered manager, For a covered manager, APP 11 requires reasonable steps to keep that data secure, and APP 11.2 requires destruction or de-identification once it is no longer needed, unless an Australian law or a court or tribunal order requires it to be kept. State strata law usually supplies that retention floor, and it falls on the owners corporation rather than on the agent: in NSW the owners corporation must retain the listed records, including its financial statements, accounting records and correspondence, for 7 years, subject to a different period being prescribed by regulation (Strata Schemes Management Act 2015 ss 180(1) and (2)). Victoria is at least 7 years for the equivalent records (Owners Corporations Act 2006 s 145(3)), and Queensland allows statements of account to be disposed of 6 years after creation (Standard Module s 231(3)). A managing agent's own licensing legislation may set a separate period, so check that too. Keep arrears records for the statutory period to support the recovery and any dispute, then dispose of a former owner's debt file rather than hoard it. Read: how long must a strata manager keep owner records?
Whether or not the Privacy Act binds you, treating arrears data with restraint, sending only what a recovery agent needs, and not turning a debt into a public spectacle, is the position least likely to generate a complaint, a tribunal matter or a headline.
Common questions
Can the owners corporation give my details to a debt collector without my consent?
Generally yes. Recovering unpaid levies is a statutory power of the owners corporation, and your name and address are already on the roll the scheme is required to keep. Disclosing them to a debt collector or lawyer engaged to recover the debt flows from that power, so your separate consent is not usually required.
Is it a privacy breach to chase levy arrears through a lawyer?
No. Engaging a solicitor or debt-recovery agent to recover a lawful debt is a normal exercise of the levy-recovery power. A covered manager should disclose only what the agent needs and keep the data secure under APP 11, but the disclosure itself is authorised.
Can strata put my name on the noticeboard for not paying levies?
That is the risky step. Publicly listing defaulters is not part of the recovery mechanism, is hard for a covered manager to justify under APP 6, and can expose the scheme to defamation or privacy claims. Reporting the scheme's overall financial position to owners is fine; singling an individual out for public shaming is not.
Does the Privacy Act even apply to our small self-managed scheme?
It depends, and the answer is not obvious. The small-business exemption in s 6D applies to an entity that carries on one or more small businesses, and an owners corporation may carry on no business at all, which is worth advice rather than an assumption. A manager whose previous financial year turnover from all sources was A$3 million or less, and to whom none of the other s 6D(4), s 6D(9) or s 6E triggers applies, may be outside the APPs. State strata law and the levy-recovery power apply either way, so the recovery answer does not change, but the APP obligations only bite if you are a covered entity.
This is general information and document templates you tailor to your own business, not legal advice. Privaproof is not a law practice and does not provide legal advice. Whether the Privacy Act 1988 (Cth) applies to your business depends on your turnover and structure; state strata legislation, levy-recovery powers and debt-collection rules apply separately and vary by jurisdiction, and section numbers change with amendments, so confirm your own state's current requirements. For advice on a specific arrears matter, consult a qualified Australian legal practitioner. Back to the strata privacy hub.