Privacy complaints up 60 per cent in a year of RentTech scrutiny
Privacy complaints to the OAIC rose 60 per cent to 5,268 in 2025-26, a year in which the regulator ruled on rental application data.
Privacy complaints to the Office of the Australian Information Commissioner rose 60 per cent to 5,268 in 2025-26, according to the OAIC's Annual Report 2025-26, released on 23 October. The OAIC also highlights the Privacy Commissioner's findings against a RentTech platform, a decision she has sent to real estate peak bodies so agents can check their own rental application process.
For agencies, the numbers matter because of what they hold: the identity documents and payslips renters hand over and, since 1 July, customer due diligence records required under anti-money laundering law.
The OAIC's year, by the numbers
- Privacy complaints received: 5,268, up 60 per cent, or nearly 2,000 more than in 2024-25.
- Privacy complaints finalised: 3,327, up from 3,123.
- Data breach notifications finalised: 1,327, as notifications rose 18 per cent, with 88 per cent finalised within 60 days against a target of 80 per cent.
- Civil penalties: $5.8 million ordered by the Federal Court against Australian Clinical Labs over a 2022 data breach, which the OAIC calls the first order of its kind in Australia.
Australian Information Commissioner Elizabeth Tydd said the increase in incoming matters "was reflective of the importance the community places on information access and privacy", and that community contacts provide insights to drive "our increasing focus on proactive regulatory activities including guidance, investigations and enforcement".
What the regulator found in the rental application process
In a determination dated 1 April and announced on 22 April, Privacy Commissioner Carly Kind found that IRE Pty Ltd, trading as InspectRealEstate, breached Australian Privacy Principles 3.2 and 3.5 through its 2Apply rental application platform, by collecting personal information that was not reasonably necessary and by collecting it by unfair means.
The information she found 2Apply did not need included applicants' gender, student status, bankruptcy status, citizenship status and visa expiry, two years of previous living history and current applications for other properties. The form told applicants that leaving information out "may affect whether you are considered as a suitable tenant for the property". IRE agreed, without admissions, to stop collecting several types of information, and must commission an independent review of its practices, including data retention.
Buyer enquiry this week, compared with last week?
Anonymous, one tap, no names. See straight away what’s happening in your local market.
"Renters often lack real choice when making rental applications. Either they hand over personal and private information, including ID documents and payslips, or risk housing precarity or even loss," Ms Kind said.
The determination makes no findings against agents, but notes that they choose which 2Apply fields are visible and mandatory, and which documents are required. "I encourage RentTech providers and real estate agents to turn their minds to the privacy of tenancy applicants, and to ensure collection of personal information is fair and limited to what is reasonably necessary," Ms Kind wrote.
Privacy policies under the spotlight
In December the OAIC announced its first privacy compliance desktop sweep, checking the privacy policies of about 60 businesses in six sectors, including rental and property, against APP 1.4, which sets out what a privacy policy must contain. It cited "real estate agents asking for phone numbers at open houses" and warned of infringement notices and penalties of up to $66,000.
Which agencies the Privacy Act covers
Businesses turning over $3 million or less a year are generally outside the Privacy Act. But the OAIC's guide for anti-money laundering reporting entities, updated on 28 August, says that since 1 July the Act applies to real estate professionals and other tranche 2 entities for the information they handle to meet those obligations. Its case study agency, turning over $1.1 million, is covered for customer due diligence but not for unrelated information handling. Real Estate Today has reported how small agencies lost their privacy exemption for AML work on 1 July.
What it means for agencies
- Audit the application form. Check your platform settings against the Commissioner's list, and ask whether each detail is needed from every applicant or only from the one approved, a distinction the determination draws.
- Check the privacy policy. The sweep tested rental and property businesses against APP 1.4. The policy should describe what the agency actually collects, from open home sign-ins to tenancy applications and AML identity checks.
- Know what you keep. Agents may download applications with all supporting documents and still hold them after a platform deletes its copy, the determination notes. Ms Kind warned renters face the risk "that their personal information may be compromised in a data breach or cyber attack". Set a rule for where those files go and when they are destroyed.
Latest from The Chat podcast
Inside H360: how Harcourts turns data into better businessesNick Jewitt, Head of Data and Analytics, Harcourts · 21 Oct 2026
Latest stories
