The Residential Tenancies Amendment (Protection of Personal Information) Act 2026 applies the Australian Privacy Principles to landlords, agents and rent-tech platforms for tenants' personal information, with no small business exemption. It also limits what can be collected: approved-form applications, identity checks only at signing intent, direct collection, and prompt destruction of improperly collected data. [1]
The Act received assent on 2 October 2026, and most provisions commence by proclamation, which the Government expects in early 2027 (we have used 1 March 2027 as an estimate). Agencies that start now can change their processes before the date rather than after it.
What is the new law, and when does it start?
The Residential Tenancies Amendment (Protection of Personal Information) Act 2026 applies the Australian Privacy Principles (APPs) to residential tenancy entities for tenants' personal information. That covers landlords, agents and rent-tech platforms. [1]
The Act received assent on 2 October 2026. Most provisions commence by proclamation, which the Government expects in early 2027. The date of 1 March 2027 is an estimate only, and regulations are still under consultation. [1]
That uncertainty is a reason to plan, not to wait. The core rules are already in the Act. The regulations will add detail, and agencies that have already mapped how they handle tenant data will adjust to that detail much faster.
Why is there no small business exemption?
Many agencies and individual landlords have been outside the Privacy Act because they fall under the small business threshold. The new Act removes that gap for tenancy information. It applies the APPs with no small business exemption. [1]
For a boutique agency, this is the biggest change. Obligations that once applied mainly to larger groups, such as having a clear privacy policy, collection notices, security safeguards and a way to handle access and correction requests, now need to be met by agencies of any size when they deal with tenant information.
For principals and directors, the question is less about the size of the agency and more about whether anyone can show how tenant information is actually handled. Can you say where applications are stored, who can see them and how long they stay there? If the answer depends on one property manager's habits, that is worth fixing before commencement.
What can agents collect, and when?
The Act restricts what can be collected from prospective tenants. The rules in the Act are: [1]
- Applications can only be taken in the approved form.
- Identity verification can only happen once the landlord intends to sign.
- Information is collected directly from the applicant by default.
- Information that was improperly collected must be destroyed within 2 business days.
In practice, this challenges common habits. Do your application forms add extra questions beyond the approved form? Do you ask every applicant for identity documents at the inspection or application stage? Do you gather information about applicants from third parties or from social media as a matter of routine? Is there a way to find and destroy improperly collected information inside 2 business days?
The regulations are still under consultation, so details such as what the approved form contains should be confirmed once they are final. The four rules above are the parts to plan around now.
What does this mean for rent-tech platforms and third parties?
Rent-tech platforms are named in the Act alongside landlords and agents. [1] Many agencies use platforms for applications, screening, identity checks and communications, so the agency needs to know what those platforms collect, where the data goes and who holds it.
Useful questions to ask: Does the platform collect only what the approved form allows? Can it delete improperly collected information quickly enough to meet a 2 business day window? Do your supplier contracts say who is responsible for what? Is any tenant data sent or stored overseas? Our Cross-border & third-party privacy assessment looks at that last question, though most agencies will start with a wider view of their practice.
A platform being covered by the Act does not remove the agency's own responsibility. Agencies still choose the tools, configure them and decide what staff put into them, so it pays to check settings and contracts rather than assume the vendor has it covered.
Beyond the tenancy Act: other privacy exposure
Once the APPs apply, agencies sit inside the wider Privacy Act environment. Three points matter.
First, individuals can now sue directly for serious invasions of privacy, including against small businesses outside the APPs. This creates litigation exposure on top of regulator enforcement. [2]
Second, the OAIC has said it will target power and information imbalances, including excessive collection. [3] A tenancy application, where the applicant has little bargaining power, is an obvious example of that kind of imbalance.
Third, breach handling matters. In the Australian Clinical Labs case the Federal Court ordered $5.8m in penalties, with separate amounts for failing to protect data, for inadequate breach assessment and for failing to notify promptly. [4] That case involved a pathology business, not an agency, but it shows that slow assessment and slow notification are each penalised separately. Tenant files hold identity documents, income details and contact information, so a breach plan is worth having in place.
A practical preparation checklist
Agencies typically work through these steps before commencement:
- Inventory: list where tenant information is collected, stored and shared, including email inboxes, property management software, spreadsheets and rent-tech platforms.
- Forms: check that applications use the approved form and nothing more.
- Identity checks: move verification to the point where the landlord intends to sign.
- Direct collection: review any routine use of third-party sources.
- Destruction: set a way to find and delete improperly collected data inside 2 business days.
- Notices and policy: make sure tenants are told clearly what is collected and why.
- Suppliers: review contracts and settings with platforms and other providers.
- People: name someone responsible for privacy. In many agencies this is an accidental privacy officer doing the job on the side, so give them time and support.
- Breach readiness: know who decides, who notifies and how quickly.
This is general information, not legal advice. Agencies should get advice on their own situation, particularly as the regulations are finalised.
How an APP compliance gap assessment helps
Because the Act applies the APPs, the most useful early question is how your current practice measures up against all 13 principles. TFIQ's APP compliance gap assessment rates practice against APPs 1 to 13 and applicable state law, with the evidence behind each rating. It also tests readiness for the Privacy Act reforms, including the statutory tort, and ends with a prioritised remediation roadmap with owners and timeframes. The standard assessment takes 3 to 4 weeks.
TFIQ tests what the organisation actually does with personal information, not just what its policies say. Gaps are ranked by risk, so the roadmap starts where exposure is highest. Legal advice, drafting of remediated policies and notices, and technical security testing are not included.
If you want a lighter first look, the Privacy health check is a short, fixed-fee review scored against the APPs, with the five things to fix first, and takes 1 to 2 weeks.
Frequently asked questions
Does the new law apply to small agencies and individual landlords?
Yes. The Act applies the APPs to residential tenancy entities for tenants' personal information with no small business exemption. It covers landlords, agents and rent-tech platforms. Check your own circumstances with a legal adviser. [1]
When do the changes start?
The Act received assent on 2 October 2026. Most provisions commence by proclamation, which the Government expects in early 2027. The 1 March 2027 date is an estimate, and regulations are still under consultation. [1]
Can we still verify a tenant's identity at application?
The Act restricts identity verification to the point where the landlord intends to sign. Collecting identity documents with every application is the practice most likely to need changing. Confirm details against the final regulations. [1]
What happens to information we collected improperly?
The Act requires improperly collected information to be destroyed within 2 business days. Agencies need a way to find it quickly, including in emails, shared drives and platforms. [1]
Can tenants take legal action over privacy?
Individuals can sue directly for serious invasions of privacy, including against small businesses outside the APPs. This adds litigation exposure on top of OAIC enforcement. [2]
Start with a Privacy health check, or book an APP compliance gap assessment, to see where your agency stands before the Act commences.
Related: Compliance and Privacy · Privacy Compliance Review and Audit Readiness · Fractional Privacy Officer Service · Privacy Act ADM Changes: 10 December 2026 Guide · Contact us
Sources
- NSW Parliament – Bill details: Residential Tenancies Amendment (Protection of Personal Information) Bill 2025 (NSW Parliament)
- OAIC – Statutory tort for serious invasions of privacy (OAIC)
- OAIC releases regulatory action priorities for 2025-26 (OAIC)
- OAIC – Australian Clinical Labs ordered to pay penalties in relation to Medlab Pathology data breach (OAIC)
