A prospective tenant gives an agency a phone number at an inspection. A buyer later provides identity information for a property transaction. These are different situations, but both invite a practical question: what information is the agency collecting, why, and how will it be protected?

In January 2026, the Office of the Australian Information Commissioner (OAIC) conducted a privacy policy sweep that included the rental and property sector. Separately, the Australian Government plans to expand its Digital ID system to private-sector participants. Neither development removes an agency's responsibility to understand the rules that apply to its own work.

## What the OAIC sweep covered

The OAIC [announced in December 2025](https://www.oaic.gov.au/news/media-centre/privacy-compliance-sweep-to-put-privacy-policies-under-the-spotlight) that it would review the privacy policies of approximately 60 entities across six sectors, including rental and property. The announcement used an agent asking for a phone number at an open house as an example of in-person information collection. The OAIC's [annual report](https://www.oaic.gov.au/about-the-OAIC/our-corporate-information/oaic-annual-reports/annual-report-2025-26) confirms the sweep took place in January 2026.

The announcement focused on privacy policy requirements under Australian Privacy Principle 1.4. Being in a named sector does not mean an individual agency was included in the sweep or found to be non-compliant. Agencies should check which privacy requirements apply to them and seek advice where needed.

## What is changing with Digital ID?

The Australian Government Digital ID System (AGDIS) is a government system for verifying identity online. The government's [eligibility guidance](https://www.digitalidsystem.gov.au/the-australian-government-digital-id-system-agdis) says private-sector entities can apply to participate from December 2026. Its [June 2026 policy update](https://www.digitalidsystem.gov.au/news/policy-settings-for-charging-and-user-choice-in-the-australian-government-digital-id-system) describes businesses applying from 1 December 2026.

An application is not approval, and the availability and terms of a service should be checked with the relevant provider and regulator. The government's [Digital ID legislation overview](https://www.digitalidsystem.gov.au/what-is-digital-id/digital-id-act-2024) distinguishes accredited identity service providers from participating relying parties that use Digital IDs to verify customers. An agency should not assume that Digital ID changes its AML/CTF obligations or that any particular provider is connected to AGDIS.

## Privacy and AML/CTF records are separate questions

An agency providing designated services should consider its AML/CTF record-keeping obligations alongside its privacy obligations. [AUSTRAC's record-keeping overview](https://www.austrac.gov.au/industry-and-business/obligations-and-guidance/your-amlctf-program/develop-your-amlctf-programs/record-keeping/record-keeping-overview) explains that retention requirements depend on the type of record and the circumstances. Its [record-keeping checklist](https://www.austrac.gov.au/industry-and-business/obligations-and-guidance/your-amlctf-program/develop-your-amlctf-programs/record-keeping/record-keeping-checklist) also addresses secure storage and access controls.

For example, a customer due diligence record and a transaction record can have different retention starting points. Do not apply one blanket retention rule to every piece of information an agency holds. Check the relevant requirements for each record and obtain advice on your circumstances.

## A practical review for your agency

1. List the personal information your agency collects at inspections and during customer onboarding, and document why it is collected.
2. Review your privacy policy and notices against the requirements that apply to your organisation.
3. Identify the records your AML/CTF processes require, their applicable retention periods and who can access them.
4. If considering Digital ID, check the latest government guidance and the provider's actual accreditation, participation status and terms before making a decision.

AMLHive provides software to help agencies organise AML/CTF workflows and evidence. The agency retains its decisions and legal responsibilities. Standard eligible accounts receive a 14-day free trial; enterprise terms are negotiated separately. This article is general information, not legal advice.

## Sources

- [OAIC: privacy compliance sweep announcement](https://www.oaic.gov.au/news/media-centre/privacy-compliance-sweep-to-put-privacy-policies-under-the-spotlight)
- [OAIC: annual report 2025–26](https://www.oaic.gov.au/about-the-OAIC/our-corporate-information/oaic-annual-reports/annual-report-2025-26)
- [Australian Government Digital ID System: participation guidance](https://www.digitalidsystem.gov.au/the-australian-government-digital-id-system-agdis)
- [Australian Government: Digital ID policy settings](https://www.digitalidsystem.gov.au/news/policy-settings-for-charging-and-user-choice-in-the-australian-government-digital-id-system)
- [Australian Government: Digital ID Act overview](https://www.digitalidsystem.gov.au/what-is-digital-id/digital-id-act-2024)
- [AUSTRAC: record-keeping overview](https://www.austrac.gov.au/industry-and-business/obligations-and-guidance/your-amlctf-program/develop-your-amlctf-programs/record-keeping/record-keeping-overview)
- [AUSTRAC: record-keeping checklist](https://www.austrac.gov.au/industry-and-business/obligations-and-guidance/your-amlctf-program/develop-your-amlctf-programs/record-keeping/record-keeping-checklist)