Privacy obligations for real estate agents: why AML/CTF Tranche 2 brings most agencies under the Privacy Act, and what to fix at open homes first.

Does the Privacy Act apply to real estate agencies?

For many agencies, yes, and the question is already settled. Since 1 July 2026, agencies providing designated services under AML/CTF Tranche 2 are reporting entities, and reporting entities lose the small business exemption in the Privacy Act 1988 (Cth), even with turnover under $3 million. Many agencies that sat outside the Act are now inside it.

Real estate agencies collect more personal information than almost any other small business: at open homes, through tenancy applications, and through the listings site and CRM running in the background. The Office of the Australian Information Commissioner (OAIC) has rental and property businesses in its first privacy compliance sweep, and courts can order penalties of up to $50 million for a company’s serious interference with privacy.

When does the small business exemption not apply?

The Privacy Act includes a small business exemption that generally excludes businesses with annual turnover of $3 million or less. It's narrower than many people assume, and relying on it without checking is risky. It doesn't apply if your agency:

• is a reporting entity under the AML/CTF Act, which many agencies have been since 1 July 2026

• is related to a body corporate that isn't a small business

• has opted in to the Privacy Act, which is sometimes done as part of a franchise arrangement

• shares tenancy information with third parties such as tenancy databases, which can count as "trading in personal information".

Beyond the legal test, agencies that handle sensitive financial, employment and identity information as a matter of routine are squarely in the regulator's frame, whatever their size.

Not sure where you stand? If your agency handles tenancy applications, processes rental histories or collects identity documents at open homes, this applies to you. Get advice on whether the exemption applies to your specific circumstances.

What has changed under the Privacy Act?

1. Much stronger enforcement powers

The Privacy and Other Legislation Amendment Act 2024 expanded the OAIC's powers. It can now issue infringement notices for certain breaches, use stronger investigation and information-gathering powers, and run public inquiries into systemic privacy practices.

2. Significantly higher penalties

Courts can order penalties of up to $50 million, three times the benefit obtained, or 30% of adjusted turnover, for a company’s serious interference with privacy (Privacy Act s 13G). Lower-tier penalties and OAIC infringement notices now apply to less serious breaches.

3. Individuals can now sue

The statutory cause of action for serious invasions of privacy commenced on 10 June 2025. People can take legal action where an invasion of privacy was intentional or reckless, serious, and where they had a reasonable expectation of privacy. Litigation and class action risk is real and present.

4. New Privacy Act coverage for real estate agencies

Since 1 July 2026, agencies providing designated services under the AML/CTF Act are reporting entities, required to enrol with AUSTRAC and meet anti-money laundering obligations. Every reporting entity is covered by the Privacy Act regardless of turnover. The OAIC's guidance for reporting entities says you don't need to keep full copies of identity documents for record keeping, and that privacy obligations sit alongside other regulatory requirements, not in place of them.

Why are real estate agencies in the spotlight?

The OAIC's first privacy compliance sweep, starting in January 2026, reviews the privacy policies of businesses that collect personal information in person, and rental and property businesses are on the list. That makes your privacy policy the first thing a regulator looks at. It's the one part of your compliance anyone can check without asking, and most agency policies are years old and describe a business that no longer exists.

The wider risk profile is obvious. Agencies routinely collect:

• identity documents

• financial records and payslips

• employment information and rental histories

• sometimes health or hardship information.

Particular areas of concern include open home sign-in processes, collecting driver licence details or copies without clear necessity, not being upfront about how information will be used, and collecting more than is reasonably necessary. Much of this happens face to face, in pressured settings, where people have little time to understand what they're agreeing to.

Open home sign-ins: the clearest pressure point

Under the APPs, you can only collect personal information that is reasonably necessary, and you must tell people why you're collecting it. If an agency collects driver licence details or copies without a clear lawful purpose, or gives no collection notice at sign-in, both the over-collection and the lack of transparency can amount to an interference with privacy. A signed form doesn't prove consent was informed.

Consent has to be provable

Under APP 7 you need consent or a compliant opt-out for marketing. If asked to show it, most agencies can't, because the consent was verbal, implied, or arrived in a spreadsheet from a previous system.

Which Australian Privacy Principles matter most for real estate?

• APP 1, privacy policy: You need a clear, accurate and accessible privacy policy (here's what it must include) explaining what you collect, why, how it's used and disclosed, and how people can access or correct it.

• APP 3 and APP 5, collection and notification: Collect only what's reasonably necessary, and notify people at or before collection. Open homes and inspections are the obvious risk point, but appraisal request forms, rental alert sign-ups and anything else on your site that collects a name carry the same obligation.

• APP 6, use and disclosure: Information should generally only be used for the purpose it was collected for. Responding publicly to online reviews using client details can breach this principle.

• APP 7, direct marketing: You can't use personal information for marketing without consent or a compliant opt-out. The OAIC can issue infringement notices for certain direct marketing breaches.

• APP 8, cross-border disclosure: Your CRM, listings portal, email tool and inspection app are often overseas or built on overseas infrastructure. Sending personal information to them is a disclosure, and you remain accountable for what happens to it.

• APP 11, security: Take reasonable steps to protect information from misuse, interference, loss and unauthorised access.

What should your agency do now?

First, if your agency provides designated services and hasn't enrolled with AUSTRAC, do it now. Enrolment closed on 29 July 2026, and AUSTRAC has begun issuing notices to businesses that appear to be providing designated services without enrolling. Enrolment is free and done through AUSTRAC Online Services.

Then work through privacy in three stages. Fix the critical gaps first, build governance next, then position your agency for ongoing reform.

Immediate: 0 to 3 months

1. Draft or update your privacy policy so it reflects how your agency actually collects, uses and stores personal information, including through your website and CRM.

2. Check what your website collects and what tracking runs on it, including on listings pages, and make sure nothing fires before consent is given.

3. Review open home and inspection sign-in forms, remove anything not reasonably necessary, and add a clear collection notice.

4. Confirm every marketing list has documented consent and a working unsubscribe, consistent with the Spam Act 2003 (Cth).

5. Stop including tenant or applicant details in public responses to online reviews or on social media.

6. Tighten basic security, including multi-factor authentication and removing dormant CRM accounts.

Medium term: 3 to 12 months

1. Appoint a privacy lead.

2. Document a privacy management plan.

3. Map where personal information lives across your applications, portals and CRM.

4. Set retention periods for tenancy applications and identity documents.

5. Review vendor contracts.

6. Run annual privacy training using real estate scenarios.

Strategic: 12 to 18 months

1. Run privacy impact assessments for higher-risk initiatives, particularly AI-assisted tenant screening tools.

2. Add privacy risk to board reporting and risk registers.

3. Review your insurance cover.

4. Treat privacy capability as a genuine point of difference with landlords, vendors and tenants.

Real estate privacy checklist

Use this to keep the team accountable. Give each item an owner and track progress.

• Privacy policy: Update and publish it, covering your website and CRM, now. Next, schedule an annual review with a named owner.

• Website: Check what tracking runs and make sure nothing fires before consent now. Next, keep consent records auditable and reviewable.

• Open homes: Remove over-collection and add a collection notice now. Next, standardise compliant templates across all offices.

• Applications: Audit what is stored and where now. Next, set and enforce retention and deletion periods.

• Marketing: Confirm consent and opt-out on every list now. Next, review CRM governance.

• Security: Tighten access controls and remove dormant accounts now. Next, commission periodic risk assessments.

• Training: Run an initial all-staff session now. Next, build an annual refresher into the calendar.

• Governance: Appoint a privacy lead now. Next, build privacy into the board reporting cycle.

A three page PDF you can work through this week. Download it here:

Get the checklist

How Savira helps real estate agencies

Most privacy problems in real estate aren't decisions anyone made. They're things that were set up once and never revisited. Open home forms and staff processes are worth getting advice on, and we'll tell you so. What Savira handles is the ongoing part: the policy, the consent on your website, and the record of what people agreed to.

Generate and maintain a privacy policy that reflects what your agency actually does, collect and record consent through your website, and keep an auditable record of who agreed to what and when, so you can answer a tenant, a vendor or a regulator without digging through inboxes. Every new listing, campaign and application then starts from the same baseline. Start from our real estate privacy policy template.

Whether you're a single office or a franchise network, you get the compliance foundations without needing a consultant or a developer. See how Savira works for real estate agencies.

This guide was last updated 29 August 2026 to reflect the commencement of AML/CTF Tranche 2 on 1 July 2026, updated OAIC privacy guidance for reporting entities, and the latest compliance sweep announcements. Australian privacy law keeps evolving, so we'll keep it current as the rules change.

This is general information, not legal advice. Every business handles information a bit differently, so if you're not sure how this applies to yours, it's worth checking with a lawyer or privacy adviser.

Sources: Privacy compliance sweep to put privacy policies under the spotlight and Privacy guidance for reporting entities under the Anti-Money Laundering and Counter-Terrorism Financing Act (OAIC). To see where your agency stands, get my risk score.