Strata manager vs owners corporation: who is actually covered?
They are two different legal persons, with two different answers. An owners corporation's own income is usually the levies it raises to run one building, so where that income is A$3 million or less the scheme will commonly fall within the small-business exemption in s 6D of the Privacy Act 1988 (Cth) and sit outside the Australian Privacy Principles. The managing agent it hires is a separate business, assessed separately and on its own facts. The managing agent the scheme hires is more often covered, because it is outside the small-business exemption if its turnover has exceeded A$3 million in a completed financial year (s 6D(4)(a)), if it is a body corporate related to a body corporate that carries on a business that is not a small business (s 6D(9)), or if another limb of s 6D(4) applies..
By Jon Oates, Founder of Privaproof · Last updated
General information, document templates and tools you tailor, not legal advice. Privaproof is not a law practice.
Start by separating the two entities
Most confusion here comes from treating "strata" as one thing. It is two.
- The owners corporation (called the body corporate in Queensland, the owners corporation in New South Wales and Victoria) is the legal entity made up of all the lot owners in a scheme. It owns the common property and runs the building's affairs.
- The managing agent is the separate professional business the owners corporation contracts to run the scheme day to day. It is a company or firm with its own turnover, its own owners, and often many schemes on its books.
Coverage under the Privacy Act is decided per entity, on that entity's own turnover and structure. So the honest question is not "is strata covered?" but "which of these two is covered, and by what limb?" The answers usually differ.
The owners corporation: usually exempt
Under section 6D of the Privacy Act 1988 (Cth), a business is a small business if its annual turnover for the previous financial year was A$3,000,000 or less (s 6D(1)), and an entity is a "small business operator" if it carries on one or more small businesses and does not carry on a business that is not a small business (s 6D(3)). A small business operator is not an "organisation" under s 6C(1), so the Australian Privacy Principles (APPs) do not apply to it. The threshold works one way: once a business has had an annual turnover of more than A$3,000,000 for a completed financial year, s 6D(4)(a) puts it outside the exemption from then on.
A scheme's income is usually the levies it raises to run one building, and for a typical residential scheme that sits below A$3 million. Two qualifications are worth stating plainly. We have no published data on how many schemes sit either side of the threshold. And s 6D(3) asks whether the entity carries on a business at all, a question the Act does not define and that has not been settled for owners corporations. So treat the exemption as the likely starting point for a typical scheme, not as a finding about a particular one. On that basis the scheme itself is usually exempt from the APPs.
We will say that plainly rather than sell a covered owners corporation coverage it does not have. The scheme still holds personal information about owners and residents, and it still has duties under state strata law and state surveillance law (see below), and the federal Privacy Act will often not bind the owners corporation directly, though that turns on the scheme's own figures and structure rather than on it being a strata scheme. Read: owners corporations and the $3 million small-business exemption.
There are edge cases. A very large scheme, or one that runs a substantial commercial operation, could conceivably cross A$3 million, and structure can pull an entity in through the limb below. But for the typical residential scheme, "the owners corporation is a small business and exempt" is the honest starting point.
The managing agent: covered on either of two limbs
The managing-agent business is where coverage more often lands. Two routes account for most cases, and either one is enough on its own. They are not the only routes. Section 6D(4) also takes an entity outside the exemption where it provides a health service and holds health information, discloses personal information about someone for a benefit, service or advantage, provides a benefit to collect it, is a contracted service provider for a Commonwealth contract, or is a credit reporting body, and ss 6E and 6EA add further routes. Rule the exemption in only after checking all of them.
Limb 1: turnover over A$3 million. A managing agent is not one building's levies. It is a business earning management fees across many schemes, plus disbursements, insurance commissions, and often sales or maintenance arms. A mid-sized or growing strata management company can pass A$3 million on its own turnover and become an APP entity for its whole operation on that basis alone.
Limb 2: the related-bodies-corporate limb (s 6D(9)). This is the one that catches offices that assume they are safe. Section 6D(9) says a body corporate is not a small business operator if it is related to a body corporate that carries on a business that is not a small business. Both entities must be bodies corporate, and whether they are related is worked out as it would be under the Corporations Act 2001 (Privacy Act s 6(8)). Where the limb applies, the smaller company is outside the exemption regardless of its own turnover. So a modest-turnover strata office that is owned by, or sits inside, a larger national group is an APP entity regardless of its own turnover, because it is related to a covered parent.
This is not a fringe scenario in strata. Some strata management brands are owned by larger corporate groups. Where the local office is a body corporate and its parent or a sibling company is a body corporate carrying on a business that is not a small business, s 6D(9) applies whatever the local office's own turnover is. Firms sitting under a group of that size are pulled in through the related-body-corporate limb even where the corner office feels small. So being a small office does not by itself settle the question; the group structure has to be checked as well as the turnover. Read: does the Privacy Act apply to strata managers?.
Do not confuse the two "body corporate" ideas
There is a genuine trap in the language, so it is worth being explicit.
The owners corporation / body corporate of a strata scheme is a creature of state strata law. The related body corporate test in the Privacy Act comes from the Corporations Act and is about corporate group structure (holding companies, subsidiaries and their siblings). They are different legal concepts that happen to share a word.
The related-body-corporate limb that catches a managing agent is the corporate-group one. It is about who owns the management company, not about the strata scheme it manages. A small independent manager that runs many schemes but is not part of a larger corporate group is not pulled in by this limb, and if its own turnover is under A$3 million it may genuinely be exempt. We will say so where it is true.
What binds both of you regardless of the Privacy Act
Whichever way the Privacy Act question lands, three things apply to a scheme and its manager either way, and they carry the salience even for an exempt operator:
- State strata law. In New South Wales the Strata Schemes Management Act 2015 requires the owners corporation to prepare and maintain the strata roll (s 177), sets what the roll must record (s 178: each owner's name, an address for service, and an Australian postal address and email address if held), requires records to be retained for 7 years unless the regulations prescribe another period (s 180), and gives an owner, mortgagee or covenant chargee of a lot, or a person they authorise, the right to request an inspection by written notice accompanied by the prescribed fee (s 182). Victoria's Owners Corporations Act 2006 requires the owners corporation to keep records including the full name and address of each lot owner (s 144), to keep most records for at least seven years (s 145(3)), and to make them available for inspection free of charge on request by a lot owner, mortgagee, purchaser or their representative (s 146(1)); the separate owners corporation register sits at ss 147 to 150, and s 172 lets a person apply to VCAT for an order restricting access to their information in exceptional circumstances. In Queensland, s 205 of the Body Corporate and Community Management Act 1997 requires the body corporate, within seven days of a written request accompanied by the prescribed fee, to let an "interested person" (defined in s 205(13)) inspect or copy its records, while what the roll itself must contain sits in the regulation module applying to the scheme rather than in the Act. Outside these three states, check your own Act.
- The management agreement. Management agreements commonly set confidentiality and data-handling duties, and those duties bite whether or not a statute does. Check what your own agreement says.
- State surveillance and listening-devices law. Cameras and recording on common property are governed by state law that applies independently of the Privacy Act, including inside the small-business exemption, and the statutes are not the same in every state. New South Wales and Victoria have Surveillance Devices Acts (2007 and 1999) covering both optical and listening devices. Queensland has no general optical-surveillance offence: the Invasion of Privacy Act 1971 (Qld) regulates listening devices only (s 43). Audio is the tightest restriction in each of those states, so check your own state's Act before switching anything on. Read: CCTV and surveillance on strata common property.
And here is the wedge the exemption does not resolve. State strata law compels the owners corporation to keep the roll and hand it over on a proper request (NSW ss 177, 182(3)), and the manager carries that duty under a s 52 delegation, so privacy is not a lawful excuse to refuse a lawful inspection. Yet a manager who is covered by the Privacy Act still owes APP 6 (having collected the roll to run the scheme, do not use or disclose it for another purpose unless an exception applies; APP 6.2(b) is the exception covering a use or disclosure required or authorised by or under an Australian law, which is why a lawful inspection is not an APP 6 problem) and APP 11 (take reasonable steps to protect the information, and destroy or de-identify it once it is no longer needed, noting that APP 11.2(d) does not require destruction while an Australian law requires the record to be retained, as the state retention periods above do) over the very same data. Both are true at once. Read: is the Privacy Act a shield against strata record access?.
A quick way to place yourself
Work through it entity by entity:
- Are you asking about the owners corporation or the managing agent? Answer separately for each.
- The owners corporation: turnover A$3 million or less? Then it is usually exempt from the APPs, though state strata and surveillance law still apply.
- The managing agent, turnover: does the management business turn over more than A$3 million across all its schemes and arms? If yes, it is an APP entity.
- The managing agent, structure: is it owned by or part of a larger corporate group that is itself covered? If yes, it is an APP entity through the related-body-corporate limb, regardless of its own turnover.
- If neither limb catches the managing agent and it is under A$3 million and independent, it may genuinely be exempt from the APPs, but it is still bound by state strata law, its management agreement, and state surveillance law, and it still holds a whole community's sensitive data.
The pattern to work to is: assess the owners corporation and the managing agent separately, because a scheme is often within the small-business exemption while the managing agent is the entity more likely to be covered, by turnover or by group ownership. That is the honest headline. Read the cornerstone: privacy compliance for Australian strata and owners-corporation managers.
Common questions
Is the owners corporation an APP entity?
Often not, but it depends on the scheme. A scheme's income is usually the levies it raises for one building, and where that is A$3 million or less the small-business exemption in s 6D generally keeps the scheme outside the Australian Privacy Principles. There is no published data on how many schemes sit either side of the threshold, so treat that as the usual starting point rather than an answer about a particular scheme. Either way the scheme holds personal information about owners and residents and has duties under state strata law and state surveillance law. It still holds sensitive information and still has duties under state strata law and state surveillance law, but the federal Privacy Act typically does not bind the owners corporation directly.
Are registered owners corporation managers covered by the Privacy Act?
Often yes, and on a different basis from the owners corporation itself. A registered owners corporation manager, or strata managing agent, is a business rather than a single scheme, so it is tested on its own turnover and structure. Either limb is enough on its own: annual turnover over A$3 million in a financial year that has ended (s 6D(4)(a), which ratchets one way once crossed), or being a body corporate related to a body corporate carrying on a business that is not a small business (s 6D(9)). The owners corporation it manages can be exempt while the manager is covered.
If the owners corporation is exempt, is our managing agent exempt too?
Not necessarily, and often not. Coverage is decided per entity. The managing agent is a separate business with its own turnover across many schemes, and it can be an APP entity by exceeding A$3 million or by being a related body corporate of a larger covered group, even where the individual scheme it manages is exempt.
We are a small independent strata office under $3 million. Are we caught?
Possibly not. If your management business turns over A$3 million or less and you are genuinely independent (not owned by or part of a larger covered corporate group), you may fall within the small-business exemption for the APPs. We will not tell you that you are caught when you are not. State strata law, your management agreement and state surveillance-devices law still apply either way, and you still hold a large, sensitive data pool.
Does being a "body corporate" make us a "related body corporate" under the Privacy Act?
No, they are different concepts that share a word. The owners corporation / body corporate of a strata scheme comes from state strata law. The "related body corporate" test in the Privacy Act comes from the Corporations Act and is about corporate group ownership (parent and subsidiary companies). The limb that pulls in a managing agent is the corporate-group one, about who owns the management company, not about the strata scheme it runs.
This is general information and document templates you tailor to your own business, not legal advice. Privaproof is not a law practice and does not provide legal advice. Whether the Privacy Act 1988 (Cth) applies to an owners corporation or a managing agent depends on that entity's turnover and structure; state strata legislation and state surveillance-devices law apply separately and vary by jurisdiction. The law changes over time, so check you are working from a current version and confirm your own state's requirements. For advice on your specific circumstances, consult a qualified Australian legal practitioner.