- 27 Oct 2026
- 3 min read
- By Mollie Taylor, solicitor, and Michelle Christmas, special counsel, Carter Newell Lawyers
Privacy obligations for property agents: Why notice and consent forms matter
Real estate agents handle an enormous amount of personal information every single day — rental applications, bank statements, copies of passports, employment details, inspection photographs, and more. Understanding your obligations when it comes to collecting, and managing, that information is an essential part of the performance of real estate services.
The Legal Framework
APP entity
The Privacy Act 1988 (Cth) (the Act) and the 13 Australian Privacy Principles (APPs) govern how personal information is collected, stored, used, and disclosed.[1] The Act applies to “APP entities”, a term that captures both government agencies and private sector organisations.[2]
Under the current framework, the Act applies to those organisations with an annual turnover of more than $3 million,[3] and which disclose personal information about another individual for a benefit, service or advantage, or provide a benefit, service or advantage to collect personal information from someone else.[4]
Many Queensland property agencies will be classified as APP entities, particularly those managing substantial rent rolls, or where an agency trades in personal information, for example, by sharing tenant information through a tenancy database in return for a fee or other benefit.
APP 5
APP 5 requires that when an organisation collects personal information, it must take reasonable steps to notify the individual of certain matters at, or before, the time of collection. These matters include:
- Identity and contact details, including the name of the organisation and a way to contact it about privacy, such as a contact email address and telephone number.[5]
- Facts and circumstances of collection, including how, when and from where the information was collected, where this is not obvious.[6] For example, information obtained from a tenancy database or a referee.
- Whether collection is required, or authorised by law, and the relevant law.[7]
- The purposes of collection, including any secondary purpose the individual would reasonably expect.[8]
- The consequences for an individual if some, or all, of the information is not provided.[9]
- Who the entity usually discloses the information to or the types of recipients.[10]
- Information about access and correction in the APP entity’s APP Privacy Policy Complaints.[11]
- Whether the information is likely to be disclosed overseas, for example, use of an overseas-hosted application or software platform.[12]
An agency that fails to take reasonable steps under APP 5 may face a complaint to the Office of the Australian Information Commissioner (OAIC), an investigation by the OAIC, a formal determination or enforceable undertaking, and in serious cases, civil penalties.
Other privacy obligations
An agency may also be bound by privacy obligations even where the Act does not apply.
Agents have a duty of care to act as other reasonable agents would in the same circumstances. The REIQ Best Practice Guidelines set requirements for members, including not using or disclosing confidential or sensitive information obtained while acting for a client, except where the law requires disclosure,[13] and obtaining consent from all parties before communicating with them electronically.[14]
The REIQ Best Practice Guidelines also make it a requirement for property managers to provide a Privacy Notice and Consent Form to the client when entering into the PO Form 6 and to prospective tenancy applicants when their application is made.[15] In these circumstances, agents should consider the notification of privacy obligations as an essential part of managing personal information.
Why Privacy Notice and Consent Forms matter?
A Privacy Notice and Consent Form is one practical way to meet your privacy obligations. A Privacy Notice and Consent Form is a written form that tells an individual how their personal information will be collected, used, stored and disclosed, and records their consent to the handling of such information in the manner prescribed.
While agencies must check that the content of a consent form properly reflects what they actually do with collected information, using a Privacy Notice and Consent Form demonstrates your agency's compliance with legal and industry obligations at the point of collection, creates a clear record that the individual was informed and had consented, and sets the reasonable expectations of both parties about how personal information will be used.
In the event of a complaint or dispute, this documentation can be the difference between a matter which is readily resolved, or one which proceeds to a formal investigation.
When to use a Privacy Notice and Consent Form?
The Privacy Notice and Consent Form should be provided each time an agency collects personal information from a client, applicant, tenant or prospective buyer, so that the individual is informed at, or before, collection of the data. Examples of when a form may be used are set out below.
Property Management
|
Transaction |
When to Provide the Form |
|
Entering a PO Form 6A with a new landlord client |
At the time of signing the Appointment |
|
Processing a rental application |
With, or attached to, the application |
|
Onboarding a new tenant |
At the time of signing the General Tenancy Agreement |
|
Using or listing on a tenancy database |
Before listing; as part of the application process |
Residential and Commercial Sales
|
Transaction |
When to Provide the Form |
|
Entering a PO Form 6 with a new seller client |
At the time of signing the Appointment |
|
Collecting information from prospective buyers at open homes or inspections |
At the open home, or included in the buyer registration process |
|
Obtaining buyer details for a buyer registration or contact database |
At the point of data collection |
Conclusion
Privacy Notice and Consent Forms are not optional extras or bureaucratic formalities. They are a core element to a responsible agent’s collection and management of the personal information of their clients, tenants, and prospective buyers.
An agent’s use of a Privacy Notice and Consent Form:
- satisfies the agent’s obligations under the Privacy Act 1988 (Cth) and the REIQ Best Practice Guidelines;
- protects the agency in the event of a complaint, dispute, or regulatory investigation;
- builds trust with the people whose information you handle; and
- sets the right expectations from the very beginning of the agent-client relationship.
In the event that an agent is uncertain as to the proper management of personal information in the course of performing their duties in respect of property transactions, they are urged to contact the REIQ Legal Advisory Help Line prior to collecting, storing or using, the data.
Read more agency practice articles from the REIQ.
[1] Privacy Act 1988 (Cth) s 6, Schedule 1 (Australian Privacy Principles).
[2] An APP entity means an agency or organisation: Privacy Act 1988 (Cth) s 6(1). An organisation means an individual, body corporate, partnership, unincorporated association, or trust, but does not include a small business operator, registered political party, Commonwealth agency, or State or Territory authority: s 6C(1).
[3] A business is a small business, if its annual turnover for the previous financial year is $3,000,000 or less: Privacy Act 1988 (Cth) s 6D(1).
[4] Privacy Act 1988 (Cth) s 6D(4)(c) and (d).
[5] APP Guidelines, [5.9].
[6] APP Guidelines, [5.10]-[5.11].
[7] APP Guidelines, [5.12]-[5.14].
[8] APP Guidelines, [5.15]-[5.17].
[9] APP Guidelines, [5.18]-[5.20].
[10] APP Guidelines, [5.21]-[5.25].
[11] APP Guidelines, [5.26]-[5.27].
[12] APP Guidelines, [5.28]-[5.33].
[13] REIQ Best Practice Guidelines, ch 1, guideline 1(d).
[14] REIQ Best Practice Guidelines, ch 1, guideline 16.
[15] REIQ Best Practice Guidelines, ch 4, guideline 6.
You might also like
View All Articles
View All Articles
Start your Real Estate Career
Need help? 1300 697 347 or contact us