# Privacy law and real estate: what an agency may collect, and keep
Buyers, tenants and open-home visitors hand agencies a great deal of personal information. How the Privacy Act, its small business exemption and Queensland tenancy law limit it.
---
Few businesses see as much of a person's life as a real estate agency. A tenant hands over payslips and identity documents. A buyer gives a name, a phone number and often a budget before walking through a front door. A seller discloses a mortgage, a divorce or a deceased estate. Most of it now arrives through online forms and sits in cloud software for years.
The rules on what an agency may ask for, and how long it may keep the answer, come from two directions. The Commonwealth Privacy Act 1988 sets general principles for handling personal information, but exempts most small businesses, which is what many agencies are. Queensland's tenancy legislation sets specific limits on rental applications, and those limits apply to every lessor and agent in the state whatever their size. From 1 July 2026 a third layer arrives: anti-money-laundering duties that require agencies to collect identity information from buyers and sellers, and that pull even small agencies under the Privacy Act for that information.
This guide sets out which law applies to whom, what each one allows an agency to collect from the three groups it deals with most, and what must happen to the information afterwards. It describes the position at the end of June 2026.
$3 millionannual turnover below which a business is usually exempt
13Australian Privacy Principles for covered organisations
2documents per category in a Queensland rental application
Turnover threshold from the Office of the Australian Information Commissioner; document limit from the Residential Tenancies Authority's guidance on the rules in force since 1 May 2025.
## Two sets of rules, and which one applies
The Privacy Act is a general law. It applies to Commonwealth agencies and to private organisations, and it regulates "personal information": information or an opinion about an identified person, or a person who can reasonably be identified. It is administered by the Office of the Australian Information Commissioner (OAIC).
Queensland's Residential Tenancies and Rooming Accommodation Act 2008 is a specific law. It governs the relationship between lessors, agents and tenants, and since 2025 it has contained its own rules on what may be collected in a rental application and when it must be destroyed. It is administered by the Residential Tenancies Authority (RTA).
The two operate side by side. A large agency handling a rental application must satisfy both. A small agency outside the Privacy Act must still satisfy the tenancy Act. Neither law deals specifically with buyers or open-home visitors, so for those groups the Privacy Act, where it applies, is the main source of rules.
Which law covers which situationPosition at June 2026
Situation
Privacy Act 1988
Queensland tenancy Act
Rental application, agency above $3 million turnover
Applies
Applies
Rental application, small agency
Usually exempt
Applies
Open-home register, agency above $3 million turnover
Applies
Not addressed
Open-home register, small agency
Usually exempt
Not addressed
Identity checks on buyers and sellers from 1 July 2026
Applies to any reporting entity, for that information
Not addressed
Listing a former tenant on a tenancy database
Applies to the database operator
Applies to the lessor or agent
Sources: OAIC guidance on small business; RTA guidance on rental applications.
## The Australian Privacy Principles in plain terms
An organisation covered by the Privacy Act must follow the thirteen Australian Privacy Principles, known as the APPs. They are written as principles, not as lists of permitted documents, so they ask an agency to justify what it does instead of telling it exactly what to do. Those that matter most in a real estate office are these.
**Open and transparent management (APP 1).** The organisation must have a clear, current privacy policy explaining what it collects, why, and how a person can see their information or complain.
**Collection (APP 3).** Personal information may be collected only if it is reasonably necessary for one or more of the organisation's functions or activities. Sensitive information, a defined category that includes health information, racial or ethnic origin and criminal record, generally needs the person's consent as well. Collection must be by lawful and fair means, and from the person directly unless that is unreasonable or impracticable.
**Notice (APP 5).** At or before collection, the person must be told who is collecting, why, what happens if the information is not given, and who it is usually disclosed to. This is the purpose of the collection notice at the foot of a well-drafted form.
**Use and disclosure (APP 6).** Information collected for one purpose may not be used or disclosed for another unless the person consents, would reasonably expect the related use, or an exception such as a legal requirement applies.
**Direct marketing (APP 7).** Using personal information to market to the person is restricted, and every marketing message must carry a simple way to opt out.
**Overseas disclosure (APP 8).** Before sending personal information to an overseas recipient, which includes some offshore support and software providers, the organisation must take reasonable steps to ensure the recipient handles it consistently with the APPs.
**Security and destruction (APP 11).** The organisation must take reasonable steps to protect information from misuse, loss and unauthorised access, and must destroy or de-identify it once it is no longer needed for a permitted purpose and no law requires it to be kept.
**Access and correction (APPs 12 and 13).** A person may ask to see the information held about them and to have errors corrected.
Covered organisations are also subject to the notifiable data breaches scheme: when a breach is likely to result in serious harm, the affected people and the OAIC must be told.
## The small business exemption and its limits
The exemption is the single most important fact about privacy law in real estate. According to the OAIC, a small business is one with an annual turnover of $3 million or less, and small businesses are generally not covered by the Privacy Act. Many independent agencies and individual franchise offices fall under that line.
The exemption is not as wide as it looks. The OAIC lists the categories of small business that are covered regardless of turnover. Those most relevant to property are:
- a business that trades in personal information, meaning it provides a benefit, service or advantage to collect personal information, or discloses it for a benefit. An agency that sells or swaps its database of buyers or tenants is in this group;
- an operator of a residential tenancy database;
- a credit reporting body;
- a reporting entity under the Anti-Money Laundering and Counter-Terrorism Financing Act 2006;
- a business related to a body corporate that is itself covered, which can bring a small subsidiary of a larger group inside the Act;
- a contracted service provider to the Commonwealth.
A small business may also choose to opt in to the Act, and the OAIC notes that some do so to build consumer trust. Separately, any business that handles tax file numbers, whatever its size, must follow the binding rule on tax file number information that the OAIC administers.
Turnover for this purpose is the business's total income from all sources, which for an agency includes commission on sales and management fees, not the value of the property sold or the rent collected for owners.
From 1 July 2026
Anti-money-laundering duties bring small agencies partly under the Privacy Act
Real estate agents who broker sales become reporting entities under the anti-money-laundering law on 1 July 2026. The Privacy Act then applies to a small agency for the personal information it handles in meeting those duties, such as identity documents collected for customer due diligence. It does not, by that route alone, extend to everything else the agency holds.
One more development applies to everyone. The first round of amendments following the Privacy Act Review passed federal Parliament late in 2024. It created a statutory right to sue for serious invasions of privacy, in force since 10 June 2025, which is not tied to the small business threshold. It also set 10 December 2026 as the start date for a requirement that privacy policies explain certain automated decisions. That Act left the small business exemption in place. The Australian Government agreed in principle, in its 2023 response to the review, that the exemption should eventually be removed after consultation, but no legislation doing so had been introduced at the time of writing.
## What may be asked of a rental applicant in Queensland
Queensland's rules on rental applications changed on 1 May 2025, and they are the most detailed privacy rules any Queensland property business faces. They apply to all lessors and agents, with a limited exception from the form requirement for certain government and community housing lessors that the Act calls relevant lessors.
According to the RTA, an application for a residential tenancy must be made on a standardised application form: Form 22 for general tenancies and moveable dwellings, and Form R22 for rooming accommodation. The applicant must be offered at least two ways to submit it, and one of them must not be restrictive. A restrictive method, in the RTA's words, includes one that requires submission through an online platform or to a third party who is not a real estate agent, or one that costs the applicant money, such as an application fee or a background check fee.
The supporting documents that may be requested fall into three categories, and no more than two documents may be requested in each.
The three categories of supporting documentMaximum of two documents requested per category
Category
What it is for
Rule to note
Identity
Confirming the applicant is who they say they are
The applicant may give copies or show originals in person
Financial ability
Showing the applicant can pay the rent
Credit statements and bank transaction details may not be requested
Suitability
Assessing the applicant as a tenant
Tribunal history and bond claim history may not be requested
Source: Residential Tenancies Authority fact sheet for property managers and owners.
An applicant may choose to offer more than two documents in a category. The RTA says a property manager or owner may accept them, so long as the extra documents have not been requested, encouraged or solicited.
The RTA also lists information that must not be requested at all: details of legal action taken by the applicant, including matters before the Queensland Civil and Administrative Tribunal; any notice to remedy a breach the applicant has received; the applicant's rental bond history or bond claims; and a statement of the applicant's credit account or bank account showing transactions.
Identity documents get special treatment. Where an applicant chooses to show original documents in person, the property manager or owner is prohibited from keeping a copy or recording the details of the document without the applicant's consent. In a July 2025 article on compliance, the RTA explained that notes may be taken at a sighting, limited to what is reasonably necessary to assess suitability, while photocopies, scans and photographs need consent. The maximum penalty it cites for keeping identity copies without consent is 20 penalty units, the same maximum that applies to using a non-compliant form or failing to offer two ways to apply.
## Storing and destroying tenant information
The Queensland rules go beyond collection. The RTA's guidance says personal information gathered through the application process may be collected only for the purpose of assessing the applicant's suitability as a tenant and for managing the rental property. It must be stored securely and accessed only by authorised persons.
Two destruction deadlines apply, and they are fixed periods, unlike the Privacy Act's "no longer needed" test.
The life of a rental application's data
CollectionOnly on the standard form, with no more than two requested documents per category, for assessing suitability and managing the property.
Unsuccessful applicantsTheir personal information must be destroyed within three months of the start of the successful tenant's agreement.
The tenantPersonal information must be destroyed within seven years of the agreement ending.
The RTA notes that the seven-year rule applies to tenancy agreements that were active on, or began after, 1 May 2025. It also takes a broad view of what personal information is: the definition covers photographs that show a tenant's possessions or standard of living, which brings routine inspection photographs within the rules.
For an agency covered by the Privacy Act, the two regimes stack. APP 11 still requires reasonable security throughout, and the Queensland deadlines set the outer limit for keeping the file. An agency's software settings matter here, because an application platform that retains every applicant's documents indefinitely by default would put its user in breach of the three-month rule.
## Buyers, sellers and the new identity checks
Until now, an agency selling a property had little legal reason to collect identity documents from a buyer before a contract was signed. That changes with the extension of the anti-money-laundering regime on 1 July 2026. AUSTRAC's published guidance says real estate professionals who broker the sale, purchase or transfer of real estate must carry out customer due diligence, which means establishing and verifying the identity of their customers and, where a customer is a company or trust, of the people who own or control it.
This creates a duty to collect, which sits alongside the Privacy Act's limits on collection. The two fit together in this way. The anti-money-laundering law supplies the purpose and the legal requirement, so collecting identity information for due diligence is plainly "reasonably necessary". The Privacy Act then governs how the information is handled: it must be secured, used only for the purpose it was collected for or a permitted related purpose, and not kept on a marketing database because it happens to be to hand. The anti-money-laundering law has its own record-keeping periods, which is one of the cases where a law requires retention and the APP 11 destruction duty yields to it.
For a seller, an agency already collects a good deal under Queensland law, because the appointment form required by the Property Occupations Act 2014 records the client's details and the terms of the appointment, and the agent must be satisfied the person appointing them is entitled to sell. From 1 July 2026 the seller is also a customer for due diligence purposes where the agency brokers the sale.
## Open homes and enquiry lists
An inspection register, a name and a phone number taken at the door or through a booking app, is the most common collection in the industry and the least regulated. No Queensland statute requires a visitor to an open home to give their details, and none prohibits an agent from asking as a condition of entry. An owner is entitled to know who has been through the property, and the practice has an obvious security purpose.
Where the agency is covered by the Privacy Act, the principles apply in the ordinary way. A name and a phone number for security and follow-up on that property is easy to justify as reasonably necessary. A photograph of a driver licence taken at the door is harder: the agency would have to show why identity evidence, and not merely a name, is needed from a person who is only looking. The visitor must be given a collection notice, in practice a short statement on the booking page or beside the register. Adding the visitor to a general marketing list engages APP 7, which requires an opt-out in every message and limits marketing to what the person would reasonably expect or has consented to.
Where the agency is a small business outside the Act, those requirements do not bind it as law, though the statutory privacy tort that began on 10 June 2025 applies to serious invasions of privacy by anyone, and electronic marketing messages are regulated separately under the Commonwealth's spam legislation whatever the sender's size.
## Tenancy databases and inspection photographs
Two other pieces of Queensland tenancy law deal with personal information directly.
The first concerns tenancy databases, the commercial lists that record tenants who have left owing money or in breach. The Residential Tenancies and Rooming Accommodation Act restricts when a person may be listed. In outline, a listing may be made only after the tenancy has ended, only for reasons the Act approves, such as an amount owing that exceeds the bond or a tribunal termination order, and only after the person has been told of the proposed listing and given a chance to respond. An applicant must be told if an agent usually uses a database, and a listing cannot be kept for more than three years. The database operators themselves, as the OAIC's list confirms, are covered by the Privacy Act whatever their turnover.
The second concerns photographs. A lessor or agent who wants to use a photo or image showing a tenant's possessions in an advertisement needs the tenant's written consent under the tenancy Act. Photographs taken at routine inspections are, on the RTA's reading, personal information subject to the storage and destruction rules described above.
## Who enforces what, and where complaints go
The split between the two regimes carries through to enforcement.
Breaches of the Queensland rental application rules are offences against the tenancy Act. The RTA investigates them and may prosecute, and it offers a free dispute resolution service for disagreements between tenants and managing parties. Disputes that are not resolved there may go to the Queensland Civil and Administrative Tribunal.
A complaint that a covered organisation has breached the Australian Privacy Principles goes first to the organisation, and then to the OAIC, which can investigate, conciliate and make determinations, and which gained additional penalty and infringement notice powers under the 2024 amendments. The OAIC cannot act on a complaint about an ordinary small business that falls within the exemption, which is the practical gap tenants and buyers most often meet.
> For a Queensland tenant, the tenancy Act is often the stronger protection: it binds every agent and owner, whatever their size, and it sets dates where the Privacy Act sets tests.
The picture is likely to keep moving. The anti-money-laundering extension starts two days after this guide's date, and further Privacy Act reform has been foreshadowed by the Australian Government without a published timetable. The working rule for anyone handing over or receiving personal information in a Queensland property dealing is to ask three questions: which law covers this business, what purpose justifies this item, and when must it be destroyed.