Rental applications and privacy: what changed for agencies in 2026

A rental application holds more about a person than almost anything else an agency handles. Identity documents, payslips, employment details, previous addresses and referees arrive in one bundle, and in a market as tight as Queensland's this spring, often from someone who has applied for five other properties the same week.

Queensland limited that collection from 1 May 2025. In 2026 the national privacy regulator ruled against a rental application platform, and a draft bill proposing new collection rules went out for consultation. This post covers what a Queensland agency may collect and keep, and what to check in its own process and tools.

What can a Queensland agency ask for in a rental application?

Only the information on the standardised application form, plus up to two supporting documents in each of three categories. Since 1 May 2025, Queensland property managers and owners must use the RTA's Rental application (Form 22) for general tenancies, or Form R22 for rooming accommodation, or their own version that complies with the Act (RTA, Application process).

The form is limited to name and contact details, previous tenancies, current employment, income, referees, the intended term, and a few prescribed items: date of birth, how many people will live there and how many are under 18, vehicles, financial ability to pay the rent, and pets if approved. The three document categories are identity, financial ability to pay the rent, and suitability for the property.

An agency cannot ask for:

• evidence of legal action or tribunal matters involving the applicant
• any breach notice (Form 11 or Form R11) the applicant has issued or received
• their rental bond history, including claims
• statements of their credit or bank account transactions.

You can ask for

The information on the standardised form

Contact details, previous tenancies, employment, income, referees and the prescribed items.

Up to two documents in each of three categories

IdentityAbility to paySuitability

You can’t ask for

Legal action or tribunal matters

Breach notices given or received

Rental bond history, including claims

Credit or bank transaction statements

An identity document can be sighted, and a copy kept only with the applicant's consent. If you ask for a bank statement, you must tell the applicant it does not need to show transactions. You must tell applicants which tenancy databases you use. And you must offer at least two ways to apply, one of them not restrictive: a third-party platform that collects applicants' information on your behalf, or a fee, makes a method restrictive, while emailing the application to you directly does not. Most of these rules carry a maximum penalty of 20 penalty units.

How long can an agency keep an applicant's information?

An unsuccessful applicant's personal information must be securely destroyed after three months. A tenant's must be destroyed within seven years after the tenancy ends, and that includes photographs taken during inspections (RTA, Personal information). The destruction rules apply to tenancies that commenced on or after 1 May 2025.

While it is kept, it must be stored securely and accessed only to assess the applicant's suitability. These obligations apply to every property manager and owner, including small businesses, whatever their size.

Applicant information rarely sits in one place. A payslip in the rentals inbox, a licence photo on a property manager's phone and an application in a shared drive are all covered, and the three-month clock runs on each.

What did the privacy regulator find against 2Apply?

The Privacy Commissioner found that the operator of the 2Apply platform collected more personal information than it needed, and collected it unfairly. The determination against IRE Pty Ltd, trading as InspectRealEstate, is dated 1 April 2026 and covers collection between March 2020 and 18 March 2025 (OAIC determination). It found breaches of Australian Privacy Principle 3.2, which limits collection to what is reasonably necessary, and APP 3.5, which requires fair means.

IRE was given 60 days to stop collecting ten kinds of information, including gender, student status, bankruptcy and retirement status, previous living history, other current applications, citizenship status and visa expiry. Most of those do not appear on Queensland's Form 22 list at all.

The decision was also the OAIC's first to assess a form's design, which it calls online choice architecture. It found confirmshaming and biased framing: the form told applicants that giving more information would speed up their application, and that leaving it out could affect whether they were considered suitable. It also found bundled consent, because applicants had to agree to direct marketing to apply. Privacy Commissioner Carly Kind said: "Renters often lack real choice when making rental applications" (OAIC media release).

The determination binds only IRE, but the Commissioner expects other RentTech providers to adapt, and sent it to real estate peak bodies to help agents, property managers and landlords consider what it means for them.

Does the Privacy Act apply to your agency?

Generally yes if its annual turnover is over $3 million. Businesses at or under that threshold are generally exempt, but some are covered regardless of turnover, including those that trade in personal information, operate a residential tenancy database, are related to a business the Act covers, or have opted in (OAIC, Small business). Since 1 July 2026 a sales agency is also an AML/CTF reporting entity, and must comply with the Privacy Act for those activities whatever its turnover (OAIC).

Agencies the Act does cover need a privacy policy that meets APP 1.4. In December 2025 the OAIC announced a sweep of about 60 entities' privacy policies, starting in the first week of January 2026, across six sectors including rental and property, where its focus is personal information collected during property inspections. Non-compliance can bring infringement notices and penalties of up to $66,000 (OAIC, compliance sweep).

Queensland's collection and destruction rules apply to every agency either way.

Can you put applicant information into an AI tool?

The regulator advises against putting it into a public one. The OAIC's guidance on commercially available AI products, published in October 2024, says privacy obligations apply to any personal information entered into an AI system, that entering it can be a use or disclosure under APP 6, and that organisations should not enter personal information, particularly sensitive information, into publicly available generative AI tools (OAIC, AI guidance). Pasting an applicant's payslip into a chatbot to summarise it is exactly that.

In the OAIC's 2023 Community Attitudes to Privacy Survey, 96% of Australians wanted conditions in place before AI is used to make a decision that might affect them, and only 15% were comfortable with businesses using AI to make decisions about them with their personal information (OAIC survey). From 10 December 2026, businesses covered by the Privacy Act that use software to make decisions which could significantly affect someone must say in their privacy policy what kinds of personal information and decisions are involved (OAIC consultation).

Answering a question about a listing is a different job from assessing an applicant. AgentFront's Rental Enquiry Email Assistant replies to prospective tenants' enquiries about listed rentals. It doesn't assess or rank applicants. For the limits any assistant needs, see what an AI assistant should never tell a caller.

What is in the draft privacy bill?

On 31 August 2026 the Attorney-General's Department released an exposure draft of the Privacy Amendment (Personal Data Protection) Bill 2026, with submissions closing on 18 September (Attorney-General's Department). It is a draft, not law. The department says the reforms respond to risks including artificial intelligence.

According to law firm Johnson Winter Slattery, the draft would require all collection, use and disclosure of personal information to be fair and reasonable, judged against factors such as a person's reasonable expectations, transparency and whether less information would do. Consent would have to be voluntary, informed, current, specific and unambiguous. The small business exemption would stay, but be narrowed (Johnson Winter Slattery).

What should an agency check in its own process?

Five checks cover most of the risk:

1. The form. Compare every field on your application, and on any platform you use, against the RTA's list. Remove anything extra.
2. The ways to apply. Offer at least two, one not restrictive, such as emailing the completed Form 22 to you.
3. The consent screens. Check whether applying requires agreeing to marketing, or the wording pressures applicants to hand over more.
4. Retention. Delete unsuccessful applicants' information three months on, in every inbox, drive and system where it lives.
5. AI tools. Keep applicant information out of public generative AI tools, and check what any paid tool does with what you put in.

This is general information, not legal advice. The Residential Tenancies Authority and the Office of the Australian Information Commissioner are the places to check how the rules apply to your agency.