NSW passes new privacy protections for renters
This week, the NSW Parliament passed the Residential Tenancies Amendment (Protection of Personal Information) Bill 2025.
For the roughly one in three people in NSW who rent, this is a welcome change. The NSW Government estimates that about 187,000 pieces of identification information are collected from renters every week. For agents and landlords, it is a serious compliance task.
A few key points:
1. The Australian Privacy Principles will apply to landlords and agents
The Bill amends the Residential Tenancies Act 2010 so that the Australian Privacy Principles (APPs) apply to landlords, their agents, and anyone engaged by them or by tenants to deal with tenants' personal information - such as rent tech platforms. These are the Bill's "residential tenancy entities". The APPs apply to these entities across the board, so the small business exemption in the Commonwealth Privacy Act 1988 will not be available to them.
That matters, because many agencies, and most individual landlords have never had to meet APP obligations. The penalties are significant: up to $11,000 for individuals and $49,500 for corporations, for each breach of the APPs.
Enforcement will sit with NSW Fair Trading, and NCAT can also make orders restricting the collection, use or disclosure of personal information, or requiring its access or destruction. In my experience, most real estate agents have, to date, considered themselves exempt from the Privacy Act, and are not currently in a position to comply.
2. Data minimisation is now the default
Agents and landlords will have to use a standard rental application form, which sets out what can and can't be requested. Renters will no longer be asked for unecessary such as personal photographs, social media account details, or information about their children. ID documents such as driver licences and passports will be collected only from the preferred applicant before the lease is signed.
The NSW Government has started consulting on the final form, on which documents can be collected, and on when they must be destroyed. Those details will come through regulations in the coming months.
This is data minimisation in practice, and it is the same principle that sits behind APP 3. Fair Trading's existing guidance on rental applications already treats it as best practice. That includes deleting unsolicited information, such as a tax return the agent didn't ask for, as soon as it is received.
3. AI-altered listing images must be disclosed
Agents and landlords must also disclose when rental listing images have been digitally altered or generated by AI. The concern is images that hide faults or misrepresent room proportions, such as virtual furniture covering damage. Failing to disclose carries penalties of up to $22,000.
When does this start, and what should rental tenancies entities do?
The Government expects the laws to take effect in early 2027. That leaves a limited window, and agents, landlords and rental serice providers should start now. At a minimum, consider:
Collection notices and processes: what you ask for, why, and how you tell applicants about it.
Storage and security controls: where applicant data sits, who can access it, and how it is protected, including in any third-party platforms you use.
Retention and disposal: what you hold on past applicants and tenants, how long you should retain it, and how you will securely destroy records you no longer need. It is likely that many agents will need to remeidate stores of over-retained data.
Need help?
If these changes affect you, get in touch with Sabirus Advisory.
Sources
