Picture this: You walk into an open-home inspection on a Saturday morning, scribble your name and phone number on a clipboard, and hand over your email for a follow-up. Or you click “enquire” on a real estate listing online. Maybe you’re a seller signing a listing authority, or a renter filling out a 40-question application on an application portal. In each case, you assume your details stay between you, the agent, and the other party. The truth is far more sprawling - and most Australians have no idea just how widely their personal information circulates the moment they engage with the property market.
In 2026, with the Office of the Australian Information Commissioner (OAIC) commencing its first-ever targeted privacy compliance sweep across real estate agencies, this issue has never been more relevant. Your name, contact details, property preferences, financial hints, and sometimes full identity documents don’t just lodge into one secure system. They flow through a complex chain of listing portals, customer relationship management (CRM) software, third-party service providers, marketing platforms, review sites, and data aggregators. Often without your explicit, granular consent.
This article pulls back the curtain on that journey for both buyers/sellers and renters. It explains why the system works this way, the risks it creates, what the law actually requires, and what you can do to protect yourself. Because in Australia’s red-hot property market, your data is one of the most valuable - and vulnerable - assets changing hands.
The Moment It Starts: Open Homes, Enquiries and Listing Authorities
The data collection begins the instant you show interest. At an open home, agents routinely ask for your full name, phone number, email, and sometimes even how you heard about the property or whether you’re pre-approved. The clipboard or tablet sign-in sheet is the entry point. For online enquiries on realestate.com.au or Domain, your details are automatically forwarded to the listing agent as part of the platform’s service to connect buyers and sellers.
According to industry guidance from realestate.com.au itself, when you submit an enquiry, the agent receives your information specifically for that property. Contact about that listing is permitted under the terms you implicitly accept by using the site. But expanding that contact to other properties or marketing requires fresh consent - something many agents seek via follow-up emails or forms.
Sellers sign listing authorities that often include broad consents for the agency to use and disclose your details for marketing the property, engaging photographers, conveyancers, and other professionals. These agreements frequently contain clauses allowing the agent to share your contact information with related entities or for “business purposes.” Few people read the fine print when they’re excited about selling.
Renters face an even steeper ask. A January 2026 report from the Australian Housing and Urban Research Institute (AHURI) found that many platforms now routinely present applicants with forms containing up to 50 questions. These go well beyond basic identity and income verification to include lifestyle details - pets, smoking habits, employment history, previous rental references, and sometimes even social media links or “housing needs” narratives. The report, titled “Implications of tenant data collection in housing,” highlights how digitisation has turned what used to be a simple application into a data-harvesting exercise.
Into the CRM: Your Details Enter the Agency’s Digital Ecosystem
Once collected, your information lands in the agent’s CRM system - tools like PropertyMe, Rex, Console, or iProperty. These are sophisticated cloud-based platforms that store not just contact details but notes from inspections, your expressed interest level, budget hints (if disclosed), and communication history. Many CRMs integrate directly with listing portals, automatically pulling in enquiries.
These systems are rarely on-premises; most are fully cloud-based platforms. Many leverage Australian data centres (such as AWS or Azure regions in Sydney and Melbourne) to store core customer data, helping agencies meet local compliance expectations around data residency. However, numerous platforms - and parts of the broader ecosystem - may still process or disclose certain information offshore (for example, credit card payments, SMS/email services, analytics tools, or global integrations, often in the US or other locations). This triggers additional obligations under Australian Privacy Principle (APP) 8 for cross-border disclosures. Agents must take reasonable steps to ensure any overseas recipients handle the data in line with similar privacy standards - though the level of enforcement, due diligence, and transparency can vary significantly, particularly among smaller agencies.
Inside the CRM, your data becomes part of the agency’s broader marketing engine. It can be segmented for targeted campaigns, used to generate comparable sales reports, or fed into automated email sequences. Even after settlement, many agencies retain the data for years, citing “legitimate business interests” such as future business development or record-keeping.
The Ripple Effect: Third-Party Sharing in Every Transaction
A single residential sale or lease typically involves a dozen or more external parties, each of whom may potentially receive some of your personal data.
Conveyancers or solicitors receive your full name, address, contact details, and proof of identity so they can prepare contracts and handle settlement. Building inspectors, pest controllers, and valuers gain access to property-related information that is tied to your name. If you authorise them, mortgage brokers receive your financial details. Photographers and marketing firms obtain your property address and seller contact details to coordinate campaigns and promotions. Advertising platforms and data analytics tools process aggregated information - and sometimes identifiable information - for targeting purposes.
Agencies often justify this sharing under the “reasonably necessary” test in the Australian Privacy Principles (APPs). But the sheer breadth of these disclosures can surprise people. One agency might upload your details to a shared marketing list; another might integrate with retargeting ad networks that follow you around the internet with property ads long after you’ve bought or sold.
The Review Site Connection: RateMyAgent and the Post-Sale Review Request
One of the most common - and least understood - disclosures happens after settlement. Many agencies automatically or semi-automatically feed vendor and purchaser details into review platforms like RateMyAgent, often through direct CRM integrations or bulk uploads after a sale closes.
RateMyAgent’s own privacy policy (last substantially updated on May 11, 2018, but still operative as of 2026) states that when an agent provides information about their sellers for testimonial or review purposes, the platform will only use that information in the way the agent authorises - and the agent must have the seller’s consent. In practice, this consent is frequently buried in the original listing authority agreement (which may include broad permissions for marketing and feedback collection) or sought via a post-settlement email from the agent. However, some agents add or upload details to the platform even in cases where the party has not explicitly agreed to participate in review requests or share their information for that purpose, relying instead on assumed or implied permissions from the agency relationship or transaction data already held.
Once your name, email, property address, and sale price are entered into the system, RateMyAgent uses them to send automated review requests.
While RateMyAgent states it complies with the Privacy Act and does not sell personal data for unrelated marketing purposes, the key privacy issue arises earlier in the process. In order for review invitations to be sent, contact details from the transaction must first be uploaded or transferred to the platform by the agency. In some cases, this information may be disclosed through broad, presumed, or implied consent mechanisms, or in circumstances where the individual involved never provided clear, fully informed consent for their details to be shared with a review platform for that purpose.
RateMyAgent was contacted for comment but did not respond by the time of publication.
Rentals and PropTech: A Whole New Level of Data Hunger
The AHURI report paints a particularly stark picture for renters. With 57 rental PropTech products identified in Australia as of early 2025, the sector has embraced algorithmic tenant screening, risk scoring, and automated decision-making. Applications now routinely request identity documents (passport, driver’s licence), payslips, bank statements, rental ledgers, and references - all of which can be scanned and stored digitally.
Some platforms go further, incorporating “lifestyle” questions that have little bearing on tenancy suitability but create rich behavioural profiles. This data doesn’t stay with one agency. It can flow to tenancy databases (residential tenancy databases or RTDs), credit reporting bodies (with consent), and even be shared between agencies via integrated platforms.
The power imbalance is acute: in a tight rental market, applicants feel they have no choice but to hand everything over. NSW moved in mid-2025 to introduce a standard rental application form and limit unnecessary data collection, with penalties for non-compliance. Other states are watching closely, but nationally the rules remain patchy.
When Things Go Wrong: Breaches That Hit Close to Home
The risks are not theoretical. In 2022, two major real estate franchises both suffered significant data breaches affecting tenants, landlords, and tradespeople. Personal information stored in rental property databases was potentially exposed to unauthorised third parties. These incidents made headlines and prompted warnings from digital rights groups about the sector’s appetite for data.
The OAIC’s January 2026 compliance sweep is a direct response to ongoing concerns. Targeting around 60 businesses across high-risk, in-person collection sectors - including rental and property services - the sweep examines whether privacy policies clearly explain what data is collected, why, how long it is kept, and who it is shared with (including overseas). Privacy Commissioner Carly Kind has highlighted the “power and information asymmetries” in these situations: consumers often hand over details quickly without reading policies.
Penalties for non-compliant policies can reach $66,000 via infringement notices under the strengthened enforcement powers introduced in 2024-2025 reforms. From June 2025, individuals also gained a statutory tort for serious invasions of privacy, opening the door to civil lawsuits.
Additional transparency rules for automated decision-making (relevant to PropTech scoring tools) kick in from December 2026, requiring organisations to disclose in their privacy policies how they use AI or algorithms that could significantly affect individuals.
What the Law Actually Says - And Where the Gaps Remain
The Australian Privacy Principles (APPs) under the Privacy Act 1988 remain the core framework for handling personal information in Australia. Several key rules are particularly relevant here.
APP 1 requires entities to manage personal information in an open and transparent way, which includes maintaining and clearly communicating a privacy policy. APP 3 limits the collection of personal information to only what is reasonably necessary for the entity’s functions or activities. APP 6 restricts the use or disclosure of personal information for a secondary purpose without the individual’s consent, unless that secondary use or disclosure is reasonably expected or otherwise authorised by law. APP 8 specifically addresses cross-border disclosures of personal information and sets out the obligations agencies must meet when sending data overseas.
Historically, small businesses with an annual turnover under $3 million were largely exempt from these requirements, unless they fell into specific exceptions such as providing health services, trading in personal information, or operating as part of a franchise. However, following advocacy from the AHURI report, privacy groups, and the OAIC itself-which argued the exemption was outdated given the privacy risks in data-heavy sectors like real estate-the exemption was removed entirely through the Privacy and Other Legislation Amendment Act 2024. As of late 2025, all businesses, including small real estate agencies, must now comply with the full suite of APPs, regardless of size.
In practice, agency agreements and the terms of service on listing portals often rely on broad, catch-all consent clauses. Courts may later scrutinise these consents for fairness and whether they were genuinely informed and voluntary. The 2024 reforms also strengthened penalties for breaches and introduced a new statutory tort for serious invasions of privacy, giving individuals a direct right to sue in some cases. However, the full rollout of these changes remains staggered, and enforcement resources at the OAIC continue to be stretched.
Taking Back Control: Practical Steps for Buyers, Sellers and Renters
You are not powerless. Before signing anything:
Ask the agent for their full privacy policy and a clear list of everyone who will receive your data. Request it in plain English.
Negotiate minimal collection. For open homes, ask if providing just a phone number is sufficient. For rentals, push back on irrelevant lifestyle questions and cite the AHURI findings or NSW reforms where applicable.
Use your APP rights. You can request access to the personal information an agency holds about you, ask for corrections, or request deletion once the transaction is complete (subject to legal retention periods).
Read the fine print on review requests. You can decline to participate in RateMyAgent or similar without affecting your transaction.
For sellers, consider adding a specific clause to the listing authority limiting data sharing to essential transaction parties only.
Monitor for unsolicited contact after the deal. If you start receiving calls from unrelated brokers or agents, ask where they got your details and lodge a complaint if consent was not properly obtained.
Time for Systemic Change
The industry is not monolithic - many ethical agents dislike the data sprawl and actively support tighter rules. But competitive pressures and the sheer convenience of PropTech tools continue to push in the opposite direction. The ongoing OAIC compliance sweep, the recommendations from the AHURI report, and the state-level reforms already underway in NSW all signal that regulators are finally paying close attention to these issues.
Privacy advocates and industry watchers are calling for several key changes to address the gaps. They want a standardised national “data minimisation” framework specifically tailored to real estate transactions, which would limit collection to only what is essential. They are pushing for mandatory granular consent checkboxes at every point of data collection, rather than relying on broad blanket consents that few people read. There is strong support for stronger regulation of tenancy databases and PropTech algorithms, including requirements for regular bias audits to prevent discriminatory outcomes. Many also argue for better consumer education initiatives and simpler, clearer privacy notices delivered right at the point where data is collected.
Until these systemic improvements are in place, the onus will continue to fall on individuals to ask the right questions and actively exercise their privacy rights.
Your House, Your Data - Know Where It Goes
Next time you walk into an open home, click “enquire,” or fill out a rental application, remember: your personal information is entering a complex, interconnected ecosystem designed for efficiency and marketing as much as for facilitating the transaction. It travels further, stays longer, and is shared more widely than most people realise.
Awareness is the first defence. Ask the hard questions upfront. Read the policies. Exercise your rights. In Australia’s property market - where a home is often the biggest financial decision of your life - your data deserves the same careful protection as your deposit.
The OAIC sweep running through 2026 may force some agencies to clean up their acts. But real change will come when consumers start demanding transparency as standard practice. Your data trail starts with you - make sure you control where it leads.
You might also like
Disclaimer: Every effort has been made to ensure the accuracy of the information provided, but we make no guarantees regarding its completeness or reliability. The data is presented for general informational purposes only and does not constitute financial, investment, or legal advice. We are not liable for any errors, omissions, or consequences arising from its use. Users should verify details with relevant sources and seek professional advice where appropriate for the most accurate and up-to-date guidance.
