Strata manager vs owners corporation: who is actually covered?

They are two different legal persons, with two different answers. The owners corporation is almost always a small business turning over A$3 million or less, so the small-business exemption usually keeps the scheme itself outside the Privacy Act. The managing agent the scheme hires is more often covered, because it is an APP entity if either its turnover tops A$3 million or it is a related body corporate of a larger covered group.

By Jon Oates, Founder of Privaproof · Last updated 23 July 2026

General information, document templates and tools you tailor, not legal advice. Privaproof is not a law practice.

Need to know

Privacy Act coverage is decided per entity, so the owners corporation and the managing agent it hires are two separate legal persons with two different answers.
A single owners corporation almost always turns over A$3 million or less, so the section 6D small-business exemption usually keeps the scheme itself outside the Australian Privacy Principles.
A managing agent is more often covered because it becomes an APP entity on either of two independent limbs: turnover above A$3 million, or being a related body corporate of a larger covered corporate group regardless of its own turnover.
Even for an exempt operator, state strata law (such as NSW SSMA s 178/180/182), the management agreement, and state surveillance-devices law still apply, and a covered manager still owes APP 6 and APP 11 over the same roll it is compelled to disclose.

Start by separating the two entities

Most confusion here comes from treating "strata" as one thing. It is two.

The owners corporation (called the body corporate in Queensland, the owners corporation in New South Wales and Victoria) is the legal entity made up of all the lot owners in a scheme. It owns the common property and runs the building's affairs.
The managing agent is the separate professional business the owners corporation contracts to run the scheme day to day. It is a company or firm with its own turnover, its own owners, and often many schemes on its books.

Coverage under the Privacy Act is decided per entity, on that entity's own turnover and structure. So the honest question is not "is strata covered?" but "which of these two is covered, and by what limb?" The answers usually differ.

The owners corporation: usually exempt

Under section 6D of the Privacy Act 1988 (Cth), a business with annual turnover of A$3 million or less is generally a "small business operator" and falls outside the Act and the Australian Privacy Principles (APPs).

A single owners corporation almost always sits under that threshold. Its "turnover" is essentially the levies it raises to run one building, which for the overwhelming majority of schemes is well below A$3 million. On that basis the scheme itself is usually exempt from the APPs.

We will say that plainly rather than sell a covered owners corporation coverage it does not have. The scheme still holds sensitive information, and it still has duties under state strata law and state surveillance law (see below), but the federal Privacy Act typically does not bind the owners corporation directly. Read: owners corporations and the $3 million small-business exemption.

There are edge cases. A very large scheme, or one that runs a substantial commercial operation, could conceivably cross A$3 million, and structure can pull an entity in through the limb below. But for the typical residential scheme, "the owners corporation is a small business and exempt" is the honest starting point.

The managing agent: covered on either of two limbs

The managing-agent business is where coverage more often lands, and it can land on either of two independent tests. You only need one to be inside the Act.

Limb 1: turnover over A$3 million. A managing agent is not one building's levies. It is a business earning management fees across many schemes, plus disbursements, insurance commissions, and often sales or maintenance arms. A mid-sized or growing strata management company can pass A$3 million on its own turnover and become an APP entity for its whole operation on that basis alone.

Limb 2: the related-body-corporate limb. This is the one that catches offices that assume they are safe. The small-business exemption does not apply to a business that is a related body corporate of an entity that is itself covered by the Privacy Act. So a modest-turnover strata office that is owned by, or sits inside, a larger national group is an APP entity regardless of its own turnover, because it is related to a covered parent.

This is not a fringe scenario in strata. PICA Group is Australia's largest strata manager, running 220,000-plus lots across roughly 15 brands (including BCS) in New South Wales, Victoria and Queensland. Firms sitting under a group of that size are pulled in through the related-body-corporate limb even where the corner office feels small. So "small strata manager equals exempt" is often false in practice. Read: does the Privacy Act apply to strata managers?.

Do not confuse the two "body corporate" ideas

There is a genuine trap in the language, so it is worth being explicit.

The owners corporation / body corporate of a strata scheme is a creature of state strata law. The related body corporate test in the Privacy Act comes from the Corporations Act and is about corporate group structure (holding companies, subsidiaries and their siblings). They are different legal concepts that happen to share a word.

The related-body-corporate limb that catches a managing agent is the corporate-group one. It is about who owns the management company, not about the strata scheme it manages. A small independent manager that runs many schemes but is not part of a larger corporate group is not pulled in by this limb, and if its own turnover is under A$3 million it may genuinely be exempt. We will say so where it is true.

What binds both of you regardless of the Privacy Act

Whichever way the Privacy Act question lands, three things apply to a scheme and its manager either way, and they carry the salience even for an exempt operator:

State strata law. In New South Wales the Strata Schemes Management Act 2015 requires the owners corporation to keep the strata roll (s 178, names and addresses) and other records, retain them (s 180, around seven years), and make them available for inspection on request and payment of the prescribed fee (s 182). Victoria's Owners Corporations Act 2006 and Queensland's Body Corporate and Community Management Act 1997 impose equivalent register and interested-person access duties, though the exact current section numbers vary with amendments .
The management agreement. Your contract with the owners corporation sets confidentiality and data-handling duties that bite whether or not a statute does.
State surveillance-devices law. Cameras and recording on common property are governed by your state's Surveillance Devices Act and by-law rules, which apply independently of the Privacy Act and bind you even inside the small-business exemption. Read: CCTV and surveillance on strata common property.

And here is the wedge the exemption does not resolve. State strata law compels the manager to keep the roll and hand it over on a proper request, so privacy is not a lawful excuse to refuse a lawful inspection. Yet a manager who is covered by the Privacy Act still owes APP 6 (use or disclose that same roll only for authorised purposes) and APP 11 (keep it secure, destroy it when no longer needed) over the very same data. Both are true at once. Read: is the Privacy Act a shield against strata record access?.

A quick way to place yourself

Work through it entity by entity:

1. Are you asking about the owners corporation or the managing agent? Answer separately for each. 2. The owners corporation: turnover A$3 million or less? Then it is usually exempt from the APPs, though state strata and surveillance law still apply. 3. The managing agent, turnover: does the management business turn over more than A$3 million across all its schemes and arms? If yes, it is an APP entity. 4. The managing agent, structure: is it owned by or part of a larger corporate group that is itself covered? If yes, it is an APP entity through the related-body-corporate limb, regardless of its own turnover. 5. If neither limb catches the managing agent and it is under A$3 million and independent, it may genuinely be exempt from the APPs, but it is still bound by state strata law, its management agreement, and state surveillance law, and it still holds a whole community's sensitive data.

For most schemes the pattern is: owners corporation exempt, managing agent more often the covered one, by turnover or by group ownership. That is the honest headline. Read the cornerstone: privacy compliance for Australian strata and owners-corporation managers.

Common questions

Is the owners corporation an APP entity?

Usually not. A single owners corporation almost always turns over A$3 million or less, so the small-business exemption in s 6D generally keeps the scheme itself outside the Australian Privacy Principles. It still holds sensitive information and still has duties under state strata law and state surveillance law, but the federal Privacy Act typically does not bind the owners corporation directly.

If the owners corporation is exempt, is our managing agent exempt too?

Not necessarily, and often not. Coverage is decided per entity. The managing agent is a separate business with its own turnover across many schemes, and it can be an APP entity by exceeding A$3 million or by being a related body corporate of a larger covered group, even where the individual scheme it manages is exempt.

We are a small independent strata office under $3 million. Are we caught?

Possibly not. If your management business turns over A$3 million or less and you are genuinely independent (not owned by or part of a larger covered corporate group), you may fall within the small-business exemption for the APPs. We will not tell you that you are caught when you are not. State strata law, your management agreement and state surveillance-devices law still apply either way, and you still hold a large, sensitive data pool.

No, they are different concepts that share a word. The owners corporation / body corporate of a strata scheme comes from state strata law. The "related body corporate" test in the Privacy Act comes from the Corporations Act and is about corporate group ownership (parent and subsidiary companies). The limb that pulls in a managing agent is the corporate-group one, about who owns the management company, not about the strata scheme it runs.

This is general information and document templates you tailor to your own business, not legal advice. Privaproof is not a law practice and does not provide legal advice. Privaproof's strata documents are self-authored and are not independently reviewed by a solicitor. Whether the Privacy Act 1988 (Cth) applies to an owners corporation or a managing agent depends on that entity's turnover and structure; state strata legislation and state surveillance-devices law apply separately and vary by jurisdiction. The law changes over time, so check you are working from a current version and confirm your own state's requirements. For advice on your specific circumstances, consult a qualified Australian legal practitioner.