For real estate agencies
Privacy compliance for real estate agencies
Real estate privacy compliance for Australian agencies: rental applications, open homes and your CRM all collect personal information. Get your privacy policy, notices and consent records in order.
Why businesses trust Savira
- Australian owned
- Account data and consent records hosted in Australia
- Built for the Australian Privacy Principles
Why it matters for your agency
What makes real estate different
A regulator focus on the sector
The OAIC privacy policy sweep includes real estate.
Over-collection
Rental applications often ask for more ID than needed.
Your privacy policy is public
Anyone can read it and compare it with what you do.
Consent has to be provable
Enquiry and marketing consent needs a record.
Want the detail? Read: Privacy compliance for Australian real estate agencies
What Savira does for your agency
Your policy, consent and records in one place
- A privacy policy template for agencies
- Consent records for enquiry and appraisal forms
- A banner for your listing site
- Breach templates for tenant data
Sam's journey
Follow one person through your agency
- 1 · Enquire
Sam enquires about a rental.
Savira: A collection notice on the form.
- 2 · Apply
He sends ID documents.
Savira: Your policy explains why and how long.
- 3 · Market
He agrees to new listing alerts.
Savira: Consent logged.
- 4 · Ask
He asks you to delete his data.
Savira: A response template and a log.
- 5 · Prove
The OAIC reviews your policy.
Savira: A dated policy and records.
Your action plan
What to do, and when
- 0 to 3 months
Start here
- Run the free website scan
- Update your privacy policy
- Hold tracking until consent works
- 3 to 12 months
Then
- Write a breach response plan
- Train your team
- List who holds your customer data
- 12 to 18 months
Keep it current
- Review overseas providers
- Prepare for automated decision rulesLegal review
- Review your policy every year
Real estate privacy checklist
A three page PDF you can work through this week. Download it free.
What can we collect on an open home sign-in sheet?
A name and one contact detail, with a short notice saying why. Asking for licence details for general follow-up is hard to justify, and copying or keeping the document is harder again.
How long can agents keep tenant applications?
Only as long as you need them for the purpose you collected them, or as long as a law requires. After that, destroy or de-identify them under APP 11.2. Unsuccessful applications should not sit in inboxes for years.
What are the privacy policy requirements for real estate agencies?
The APP 1.4 list, written for your agency: what you collect from vendors, buyers, landlords and tenants, which systems hold it (CRM, portals, inspection apps), who you share it with and how people access it.
We are a small agency. Are we exempt?
It depends. Most businesses with turnover of $3 million or less are exempt, but if your agency provides AML/CTF designated services, the Privacy Act now applies.
Our website already has a cookie banner. Is that enough?
Often not. Check whether tracking scripts wait for consent and whether declining stops them. Open the site in a private window and watch what loads first.
Someone has asked what we hold about them. What do we have to do?
Under APP 12 you generally have to give them access, and under APP 13 correct it if it is wrong. Check the CRM, inspection app, marketing list and old application emails.