For real estate agencies
Privacy compliance for real estate agencies
Tenant and buyer data, enquiry forms and your privacy policy, in order before anyone asks.
10 minutes. No account needed for the score.
Why businesses trust Savira
- Australian owned
- Data hosted in Australia
- Built for the Australian Privacy Principles
- ABN 53 273 071 022
Why it matters for your agency
What makes real estate different
A regulator focus on the sector
The OAIC privacy policy sweep includes real estate.
Over-collection
Rental applications often ask for more ID than needed.
Your privacy policy is public
Anyone can read it and compare it with what you do.
Consent has to be provable
Enquiry and marketing consent needs a record.
Want the detail? Read: OAIC privacy policy sweep
What Savira does for your agency
Your policy, consent and records in one place
- A privacy policy template for agencies
- Consent records for enquiry and appraisal forms
- A banner for your listing site
- Breach templates for tenant data
Sam's journey
Follow one person through your agency
- 1 · Enquire
Sam enquires about a rental.
Savira: A collection notice on the form.
- 2 · Apply
He sends ID documents.
Savira: Your policy explains why and how long.
- 3 · Market
He agrees to new listing alerts.
Savira: Consent logged.
- 4 · Ask
He asks you to delete his data.
Savira: A response template and a log.
- 5 · Prove
The OAIC reviews your policy.
Savira: A dated policy and records.
Your action plan
What to do, and when
Start here
- Run the free website scan
- Update your privacy policy
- Hold tracking until consent works
Then
- Write a breach response plan
- Train your team
- List who holds your customer data
Keep it current
- Review overseas providers
- Prepare for automated decision rulesLegal review
- Review your policy every year
Real estate privacy checklist
A one page PDF you can work through this week. We email it to you.
FAQ
What real estate businesses ask us
Can we still ask for driver licence details at open homes?
Only where you can justify it for a lawful purpose, and you have to tell people why. Collecting licence details for general safety or follow-up is difficult to justify, and copying or retaining the document is harder again. Collect a name and contact detail, explain what it is for, and stop there.
We are a small agency. Are we exempt?
Probably not any more. Since 1 July 2026, agencies providing designated services under the AML/CTF Act are reporting entities, and reporting entities lose the small business exemption regardless of turnover.
Our website already has a cookie banner. Is that enough?
Often not. The question is whether tracking scripts wait for consent before they run, and whether declining actually stops them. Many banners are decorative, meaning collection has already happened by the time anyone clicks. Open your site in a private window and watch what loads before you touch the banner.
Does our privacy policy need to mention the CRM and the listings portal?
Yes. A policy has to reflect what you actually collect and who you disclose it to, and for most agencies that includes the CRM, the portal, the inspection app and any email tool. Most agency policies describe a business that only collects on paper.
Someone has asked what we hold about them. What do we have to do?
Under APP 12 you generally have to give them access, and under APP 13 correct it if it is wrong. The practical difficulty is usually not the obligation, it is finding everything: the CRM, the inspection app, the marketing list, old application emails. If you cannot answer quickly, that is a sign the data is spread further than you think.
Get the foundations in place this week
Free forever on Starter. No credit card. Built for the Australian Privacy Principles.