Privacy policy for real estate agencies (2026)

Last checked 25 September 2026 against the Privacy Act 1988 compilation C2026C00227, the Privacy and Other Legislation Amendment Act 2024 (C2024A00128), the AML/CTF Act 2006 compilation C2026C00274 and the OAIC guidance for reporting entities updated 28 August 2026

APP 1.4 the law, read in the authorised textOAIC guidance the regulator's published guidance, which is not law

Does the Privacy Act apply to your agency?

A business with annual turnover of $3,000,000 or less is generally a small business operator and outside the Privacy Act, unless one of the cases in s 6D(4) applies.¹ s 6D(1) s 6D(4) An agency above that threshold is generally covered for all its handling of personal information, including rentals and open homes.

A small agency that provides a Table 5 designated service is covered for that part of its work. If a small business operator is a reporting entity under the AML/CTF Act, the Privacy Act applies to its activities for the purposes of, or in connection with, the AML/CTF Act, Regulations or Rules as if it were an organisation.² s 6E(1A) AML/CTF obligations applied from 1 July 2026 to the real estate services in AML/CTF Act s 6 Table 5: brokering the sale, purchase or transfer of real estate for a buyer, seller, transferee or transferor (item 1), and selling real estate in a business where no independent agent brokers the sale (item 2).³ AML/CTF Act s 6

If the Privacy Act applies to you only because of s 6E(1A), the OAIC says your policy need only describe your AML/CTF handling.⁴ OAIC The rest of your work, such as rentals, is covered only if your agency is covered for another reason.

What the policy must contain

APP 1.3 requires a clearly expressed and up-to-date privacy policy about how you manage personal information, and APP 1.4 lists what it must contain. APP 1.5 requires you to make it available free of charge and in an appropriate form, usually on your website.⁵ APP 1.3 APP 1.4

Sources for the table: Privacy Act Schedule 1, APP 1.4,⁵ and the OAIC's guidance for reporting entities.⁴ OAIC

Before any overseas disclosure, APP 8.1 requires reasonable steps to ensure the recipient does not breach the APPs.⁵ APP 8.1

Where customer due diligence data fits

Before providing a designated service, you must establish on reasonable grounds the customer's identity; the identity of anyone on whose behalf the customer receives the service, and of anyone acting for the customer; for a customer that is not an individual, its beneficial owners; whether any of them is a politically exposed person or designated for targeted financial sanctions; and the nature and purpose of the business relationship or occasional transaction.³ AML/CTF Act s 28 For a brokered sale, the customer is both the seller and the buyer (Table 5 item 1).³

So a selling agent collects know-your-customer information from a buyer who is not its client. Tell the buyer, at or before collection, who you are and why you need it (APP 5).⁵ APP 5.1

Three further points from the OAIC's guidance:⁴ OAIC

• Only the vendor and the successful buyer. In the OAIC's auction example, the agent does customer due diligence on the vendor and the successful buyer, not on everyone who inspects or bids. Collecting it from every prospect is unlikely to meet the reasonably necessary test in APP 3.2.
• Sensitive information. Screening for politically exposed persons can collect sensitive information, such as whether a person belongs to a political association. APP 3.4(a) allows that without consent where the AML/CTF Act or Rules require or authorise it.
• No ID copies needed. The AML/CTF Act does not require scanned copies or photocopies of identity documents. Keep the details and the verification outcome, and destroy or de-identify copies once no longer needed. APP 11.2

Customer due diligence records are kept for 7 years from the end of the business relationship or the completion of the occasional transaction.³ AML/CTF Act s 111

The collection notice

The policy is general. APP 5.1 separately requires reasonable steps, at or before collection, to notify the APP 5.2 matters, including who you are, the purposes, the main consequences of not providing the information, your usual disclosures and any overseas recipients.⁵ APP 5.1 Where the law requires the collection, one of those matters is that fact and the name of the law (APP 5.2(c)): here, the AML/CTF Act or Rules.

The OAIC says you need not give notice content that would tip off a customer.⁴ OAIC Disclosing that a suspicious matter report has been or must be made, where that could prejudice an investigation, is an offence.³ AML/CTF Act s 123

The OAIC is looking at property

The OAIC's first privacy compliance sweep, announced on 9 December 2025 for early 2026, set out to review the privacy policies of about 60 businesses in 6 sectors against APP 1.4. One sector was rental and property: "collection of individuals' personal information during property inspections".⁸ OAIC The OAIC's regulatory action priorities for 2025–26 name the rental and property sector and "excessive collection and retention of personal information".⁹ OAIC If your agency is covered for all its work, your policy must describe what you collect at inspections too.

From 10 December 2026: automated decisions

APP 1.7 to 1.9 commence on 10 December 2026, the day after the 24-month period that began with Royal Assent on 10 December 2024.⁶ POLA Act s 2 If a computer program makes, or does a thing substantially and directly related to making, a decision that could reasonably be expected to significantly affect a person's rights or interests, using personal information about them, the policy must describe the kinds of personal information used and the kinds of decisions.⁶ POLA Act Sch 1 item 88 Check verification and screening tools used for vendors and buyers and, if your rental work is covered, tenant-screening tools. See automated decision-making disclosure.

Breaches and penalties

If you are aware of reasonable grounds to suspect an eligible data breach, you must carry out a reasonable and expeditious assessment and take all reasonable steps to complete it within 30 days of becoming aware.⁷ s 26WH(2) See the data breach response plan.

A missing policy, or one without the APP 1.4 contents, is a matter under s 13K: a civil penalty of up to 200 penalty units ($72,800) for a person other than a body corporate and 1,000 penalty units ($364,000) for a body corporate, at $364 a unit for conduct on or after 1 July 2026, or an infringement notice.⁷ s 13K See Privacy Act penalties 2026.

Start here

Read AML tranche 2 and the Privacy Act for the full KYC picture. For your AML/CTF program, see AML/CTF for real estate. More in the Privacy Act section. Every source we use: sources.

AMLCompliant is published by Wani Meridian Pty Ltd, an independent private business. We are not affiliated with, or endorsed by, the Office of the Australian Information Commissioner, AUSTRAC, the Attorney-General's Department or any other government body. This guide is general information, not legal advice.

Independent. Not affiliated with, or endorsed by, AUSTRAC or the Australian Government.