Public service announcement: NSW landlords, the Privacy Act now applies to you

On 2 October 2026, the Residential Tenancies Amendment (Protection of Personal Information) Act 2026 (NSW) (the Act) received assent.

When the majority of the amendments in the Act commence (on a day appointed by proclamation), it will amend the Residential Tenancies Act 2010 (NSW) (the Residential Tenancies Act) to require landlords and real estate agents to take steps to protect the privacy of their tenants. We note that only provision that has commenced thus far relates to keeping pets.

What are the changes?

Once commenced, the Australian Privacy Principles (APPs) will apply to landlords and agents in relation to personal information about a tenant.

The APPs are a set of information protection principles contained in the Privacy Act 1988 (Cth) (Privacy Act) and regulate how agencies and organisations collect and otherwise handling personal information.

In addition, the Act provides that landlords and agents will only be able to:

• collect personal information about a tenant directly from the tenant (except with consent) and in the approved form, and
• collect identity verification information about a tenant with notice, and only if the landlord intends to enter into a residential tenancy agreement with the tenant.

What do the changes mean?

Currently, real estate agents are only required to comply with the APPs if:

• they have an annual turnover of more than $3 million, or
• they assist in selling, buying or otherwise transferring real estate (but only to the extent that it relates to their compliance with the Anti-Money Laundering and Counter-Terrorism Financing Act 2026 (Cth)).

Once the Act commences, all landlords, agents and those acting on their behalf in NSW will need to comply with the APPs where it concerns personal information about a tenant.

This means:

• having an up-to-date privacy policy
• only collecting personal information in connection with a tenancy when it is reasonably necessary to do so (and for sensitive information, with the consent of the tenant) and in a lawful and fair manner
• giving notice about the collection at or before the time they collect personal information (or as soon as practicable afterwards)
• only using or disclosing personal information for the primary purpose for which it was collected (subject to exceptions), and
• taking reasonable steps to protect personal information from misuse, interference or loss, or unauthorised access, modification or disclosure.

In addition:

• personal information about a tenant can only be collected directly from the tenant, except with the tenant’s consent (for example, this would regulate collecting personal information from a prospective tenant’s social media account), and
• identity verification information about a tenant can only be collected with notice, and only if the landlord intends to enter into a residential tenancy agreement with the tenant (identity verification information will be prescribed in the regulations but is likely to include passport documents and drive licences).

This means that renters must be able to provide information directly, rather than being locked into a third‑party platform and tightens rules for tenancy databases and property technology platforms. If a landlord uses an agent, the agent may be able to take care of some of these obligations (for example, giving a collection notice to the tenant). However, landlords themselves will need to ensure they meet all of the matters they are responsible for, for example having an up-to-date privacy policy.

The penalties

The penalties for non-compliance will vary from case-to-case.

Agents who are already subject to the Privacy Act may be subject to a civil penalty not exceeding 2,000 Commonwealth penalty units ($728,000) for interfering with privacy of individuals, or up to $50 million for serious interferences with privacy.

If not currently subject to the Privacy Act, the agent (and now landlords) could be subject to a maximum penalty of:

• for a breach of the APPs – 100 NSW penalty units ($11,000) for individuals and 450 NSW penalty units ($45,000) for other types of contravening entities, and
• for other breaches of new information handling provisions in the Residential Tenancies Act – 50 NSW penalty units ($5,500) and 200-300 NSW penalty units ($22,000 to $33,000) for other types of contravening entities.

Key takeaways

If you are a landlord or agent, you will need to be aware of your obligations under the Residential Tenancies Act when the amendments commence.

For landlords who use an agent to manage their property, reach out to your agent to see what you need to do personally to comply with your new obligations.

Otherwise, you can reach out to Sparke Helmore for a privacy policy and collection notice (amongst other documents) to use for your tenancy arrangements or if you require further advice.