Keypads, fobs and key safes: Queensland's lock and entry rules apply

In this article

Written by

Kooky

Builder of Shaka, the payment router that pays every agent their commission on closing date.

About Kooky and Shaka →

The Residential Tenancies Authority (RTA) has a sentence on its locks and security page that settles a surprising amount. Keys, it says, include electronic key cards, swipe cards, fobs and remote controls. With that, the oldest object in property management was quietly widened to cover most of what now opens a door, a gate or a garage in Queensland, and the duties that attach to a brass key were carried across to the plastic and the electronic.

This guide follows that idea through a tenancy and a sale. It covers who must supply a lock and how many keys go with it, what changing a lock requires, why a door that can be opened from a phone does not shorten an entry notice, what the Act's personal information rules mean for a record of who came and went, whether a buyer or an applicant may be sent to a home with a code and no agent, and what should change hands at settlement. It names no device and no supplier. Where the sources read for it are silent, and on access codes they often are, it says so and does not fill the gap.

Residential Tenancies Authority pages on entry to the property and on personal information.

What Queensland tenancy law counts as a key

The RTA's page begins with the duty and then defines the object. The property manager or owner must supply and maintain all locks and provide keys, and keys include electronic key cards, swipe cards, fobs and remote controls.

Two things are worth noticing in that list. It is written by function: each item is something a person carries that lets them in. And it does not mention a number typed on a keypad or a credential held in a phone app. The page read for this guide says nothing about access codes at all.

That silence should be stated plainly. A code does the same job as a fob, and the RTA's list reads as a set of examples, so a code may well be treated as a key. But this guide did not find an RTA statement that says so. The sections below describe what the rules say about keys and locks, and point out each time a code is being reasoned about by analogy.

The page also ties locks to the minimum housing standards. To meet those standards, it says, all external-facing doors, and windows that can be reached without a ladder, must have functioning locks or latches. It adds that extra measures such as screens or grilles do not replace the need for a functioning lock or latch. The word that matters for an electronic device is "functioning". The duty is to supply and to maintain, and a lock that depends on power or a connection is still a lock the owner has to keep working.

Who supplies the lock, and how many keys go with it

The supply rule has three parts on the RTA's page.

First, each person named on the tenancy agreement must receive a set of keys to enter the property. Where several tenants are named, each of them must be given a key for each lock needed to gain access to the premises.

Second, the tenant must be given a key for each lock that is part of the premises. The RTA's examples are room doors, mailboxes, a toolshed door and built-in cupboards. For those other lockable areas, such as buildings, security gates, rooms, sheds, lockable cupboards and mailboxes, a single set of keys must be provided.

Third, for rooming accommodation, residents must receive a key to their room and, if necessary, a key to the house or apartment building.

Applied to a keypad or an app-controlled lock, the first part is the one to think about. The rule is counted per named tenant. A manager who sets one shared code for a household of three has given each of them the means to get in, which is the purpose of the rule. Whether three named tenants are each entitled to a credential of their own is not something the RTA's page answers, because it does not discuss codes. What it does make clear is where the obligation sits. Access is something the lessor's side provides to every named tenant, for every lock they need to pass. A fob, card or remote supplied with a system is squarely within the RTA's list of keys.

The page has one more instruction that suits electronic equipment. Where a security system, an alarm or cameras are installed, the owner or manager is advised to give the tenant the operating instructions or the product manual.

Changing a lock during a tenancy

The rules on changing locks are short, and they bind both sides. Outside situations of domestic and family violence, the RTA says, locks in a general tenancy can only be changed in three cases:

1. the tenant and the property manager or owner agree
2. there is an emergency
3. the Queensland Civil and Administrative Tribunal (QCAT) orders it.

Both parties must agree to a change, and neither may unreasonably withhold consent.

Replacing a keyed deadlock with an electronic one in the middle of a tenancy is a change of lock in the plainest sense. An owner who wants to fit one therefore needs the tenant's agreement, and a tenant who wants one needs the owner's. For the tenant there is a second requirement. The RTA says written approval is needed for fixtures and structural changes, using Form 23, the request for approval to attach fixtures or make structural changes. It also says a tenant who wants to install a security system or an alarm needs the written permission of the owner or manager first.

One exception stands apart. A tenant experiencing domestic and family violence who wishes to stay in the home can change the locks without the permission of the manager or owner, and the RTA publishes a separate guide to that process. In rooming accommodation, where a resident asks for a lock to be changed or repaired for protection from such violence, the provider must do it and must not give the new key to anyone else without the resident's agreement or a reasonable excuse.

That last rule shows what the law is protecting, and it is the reason remote administration deserves care. An electronic lock can usually be re-coded, or a credential withdrawn, without anyone visiting the property. The RTA's page does not say whether altering a code counts as changing a lock. It does say that each named tenant must have the keys needed to enter. A code changed without the tenant being given the new one would leave that tenant without the means of entry the page says they must have.

A door that opens remotely still waits for the notice

Digital access makes entry convenient: a tradesperson can be let in from the office, and an inspection can start without a trip to collect keys. None of that touches the law on entry, because the law on entry was never about the key.

The RTA's page on entry to the property opens by saying that when a tenant rents a property it is their home, and that the tenant's privacy is to be respected. A property manager or owner may enter only for a valid reason and only after giving the correct notice on the required form: the Entry notice (Form 9) for a general tenancy, and Form R9 for rooming accommodation.

Hours are limited as well. Entry must fall between 8am and 6pm, Monday to Saturday, and entry on a Sunday or a public holiday is possible only if the tenant agrees. For a general inspection the owner or manager must state a time or a two-hour window and must enter within it. The RTA notes that this timing requirement does not apply to others such as tradespeople or valuers.

Once a Notice to leave (Form 12) or a Notice of intention to leave (Form 13) has been served, there is a further cap: the owner or manager may not enter more than twice in any seven-day period, with exceptions that include entry by mutual agreement, smoke alarm and safety switch compliance, and entry believed necessary to protect the premises from imminent or further damage.

The RTA lists the cases in which no entry notice is needed. They are an emergency, protecting the property from damage that is about to happen, the tenant's verbal agreement, and site maintenance in a caravan park where the agreement provides for it.

The consequence for a remotely operated lock is simple to state. The ability to release a door from somewhere else adds no reason for entry and removes no notice period. A plumber sent to a tenanted unit with a one-day code needs the same 48 hours' notice on Form 9 as a plumber sent with a key from the board, unless the tenant has agreed to the time.

The entry log and the personal information rules

A keyed lock keeps no record. Most electronic systems do, and some record which credential opened the door and at what time. That is useful to a manager, who can show that a tradesperson arrived inside the notified window. It is also a record of when the people who live in the home come and go.

The RTA's page on personal information explains how the Act treats such material. Personal information is information or an opinion about a specific person, or about someone who can reasonably be identified, whether or not it is true and whether or not it is recorded. The page says it extends to photographs or images of a person's possessions or standard of living.

The page then sets out duties that apply to every property manager and owner, including self-managing owners and small businesses, whatever their size:

• personal information may be collected only if it is relevant to the application process or to managing the premises
• it must not be used for another purpose without the consent of the tenant or prospective tenant
• it must be kept secure, with access restricted to relevant persons, and this applies to physical and digital records alike
• information about a tenancy must be securely destroyed within seven years after the tenancy ends.

The RTA gives the maximum penalty for non-compliance as 20 penalty units, and says the rules apply to tenancy agreements that commenced on or after 1 May 2025.

The page does not mention entry records, cameras or access systems, and the RTA says the Act does not specifically refer to database or cloud-based systems. So the careful statement is this. A log that shows when a named tenant's credential was used is, on the ordinary reading of that definition, information about an identifiable person. If a manager or owner collects it, the questions the page poses are whether it is relevant to managing the premises, who is able to see it, how it is secured and when it is destroyed. The RTA describes secure destruction as information being permanently erased so that it cannot be accessed or reconstructed.

The RTA adds that property managers and owners must also comply with the Information Privacy Act 2009 of Queensland and the Commonwealth Privacy Act 1988 where those laws apply, and that it cannot advise on privacy law outside the tenancy Act. A tenant or prospective tenant who suspects misuse, it says, can complain to the relevant regulatory body.

Sending a buyer or applicant with a code and no agent

Self-guided inspection is the most ambitious use of digital access: an applicant or a buyer receives a code valid for a set period and walks through alone. For a tenanted home in Queensland the RTA's page on open houses and viewings answers the question in a single sentence. The property manager or owner must accompany prospective tenants or buyers, unless the tenant has agreed otherwise.

The default, then, is an accompanied viewing, and the exception is in the tenant's hands. A code issued to a stranger for a home where someone lives, without that tenant's agreement, is contrary to what the RTA's page requires, however short the period for which the code works.

The rest of the page applies in full to a viewing arranged by code. An open house, which the RTA describes as showing the property to prospective buyers or tenants during a specific advertised period, can only be held if the tenant agrees in writing. If the tenant does not agree, individual viewings may be arranged with an entry notice giving at least 48 hours, and a separate notice is needed for each entry. Further viewings can only be arranged after a reasonable amount of time has passed since the last one, a period the page does not define. The Sunday, public holiday and 8am to 6pm limits apply unless the tenant agrees.

The magazine's guides of 19 June 2026 on running an open home and of 13 August 2026 on selling a tenanted property set out the forms and the sequence.

A vacant home is a different case, and the sources read for this guide have less to say about it. The RTA's entry and viewing rules protect a tenant in occupation. Where no tenancy is on foot, an unaccompanied viewing is a matter of the owner's instructions to the agent and of the agent's own duties, and this guide did not read a Queensland source that deals with unaccompanied inspections of vacant property. It therefore offers no rule on them.

Key safes fitted near a door belong in the same discussion. Nothing on the RTA pages read for this guide mentions them. A key safe is a way of storing a key, and whoever takes the key out of it and opens the door of a tenanted home is entering. The reason, the form, the notice and the accompaniment rule are the same as if the key had been collected from the agency.

One provision of the Act is relevant here. Section 59, as published on the Queensland legislation website, limits what a lessor or agent may take from a prospective tenant to four things: a key deposit, a holding deposit, a rental bond and rent. The maximum penalty for taking anything else is 20 penalty units. An access arrangement for inspections cannot become the occasion for a new kind of charge on applicants.

Giving everything back at the end of a tenancy

The RTA's end-of-tenancy rule is as broad as its definition. All keys must be returned, including any copies the tenant has made, and the page spells out that this covers fobs, access cards and remote controls. If they are not returned, the tenant may be invoiced for the cost of replacing the keys, which can include the cost of changing the locks.

For electronic access the return has two sides. The physical items go back in the ordinary way. Credentials are different, since a code cannot be handed over a counter, and the RTA's page does not address them. The next tenant's security then depends on every credential issued during the tenancy being withdrawn, including any given to cleaners or tradespeople.

When the home is sold: devices, codes and accounts

A sale raises a different handover. The buyer of a house with an electronic lock, a gate motor, an alarm and perhaps cameras is acquiring equipment that works only for someone who holds the right credentials, and some of it may be registered to the seller's account with a supplier.

The source read on this point is a practitioner's one. In an article published on 17 August 2026 on pre-settlement inspections, the Queensland firm Spot On Conveyancing includes in its checklist that all keys for doors, windows and gates should be available and working, and tells buyers not to forget garage door remotes, alarm system codes and smart-home system transfers. It suggests arranging the inspection three to five days before the settlement date, so that there is time to act on a problem, and says that a buyer's conveyancer can raise missing contract inclusions with the seller's legal representatives.

That is a checklist and not a statement of law, and it should be read as one. The article does not cite a contract clause on keys or codes, and this guide did not read the standard contract's wording on the subject, so it does not describe what the contract requires. What the article usefully does is extend the buyer's inspection list from objects to access. A buyer can ask before settlement which devices stay with the property, how many remotes and fobs exist, and how control of any app-operated equipment will pass.

Where the property is sold with a tenant in place, the two regimes meet. The buyer becomes the lessor, and the duties described above pass with the role: the tenant keeps the keys the Act requires them to have, and any personal information handed over with the file remains subject to the tenancy Act's rules. The RTA's page on personal information anticipates exactly this, saying that sharing may be needed when the property manager or owner changes during an agreement and must be done securely.

Doors and entry systems in a body corporate building

In a unit building, some access hardware serves the whole scheme and not one lot. This guide read only general material on the point. The Queensland Government's body corporate pages describe by-laws as the rules a body corporate makes to control and manage common property, with driveways, car parks and swimming pools as examples, and list separate guidance on making, changing and enforcing by-laws and on when a body corporate may enter a lot. The detailed pages on those topics were not read, so nothing is said here about what a particular by-law may require of a front door, a key safe fixed to a common wall or the issue of building fobs.

The practical point is narrower. Before a device is attached to common property, the scheme's own by-laws are the document to check, and the body corporate is the party to ask.

What the sources leave open

A guide of this kind should be honest about its edges. On five questions the pages read for it give no direct answer:

• whether an access code or an app credential is a key in the RTA's sense, since its list names cards, fobs and remote controls
• whether each named tenant is entitled to a separate credential
• whether altering a code is a change of lock that needs agreement
• whether a record of door openings is personal information for the purposes of the tenancy Act
• what rules, if any, govern unaccompanied inspections of a vacant home.

The first four can be approached by reading the existing rules for their purpose: each named tenant must be able to get in, nobody else comes in without a reason and a notice, and what is recorded about the tenant is kept only for managing the premises. Disagreements about locks and entry go the same way as other tenancy disputes. The RTA suggests the parties talk, record what they decide and, if they cannot agree, use its free dispute resolution service; for rooming accommodation it notes that a resident can apply to QCAT for a ruling on security.

Kooky, from Shaka

Kooky edits Queensland Estate and builds Shaka, the payment router he made for Queensland property professionals. One payment comes in, and every agent, agency and party in the deal receives their signed share on closing date.

About Kooky and Shaka →