Our website uses cookies so we can analyse our site usage and give you the best experience. Click "Accept" if you’re happy with this, or click "More" for information about cookies on our site, how to opt out, and how to disable cookies altogether.
We respect your Do Not Track preference.
These key facts outline your privacy rights when you’re applying for, or renting, a property. If you'd like more detailed information, read our full guidance.
We also have a large number of tenancy-related answers to common questions available on our AskUs database.
If a potential landlord asks you for information that you don’t think they need yet, you can let them know about this information, or question them.
Landlords must take reasonable steps to ensure you know:
You can request access to the personal information that a landlord or property manager holds about you. You can also request it be corrected if it’s wrong.
Read about the exceptions that can apply.
We have a large number of tenancy-related answers to common questions available on our AskUs database.
For other rights, read the Tenancy Services guidance resources.
Download the PDF version of the Key facts (PDF, 194KB)
The Privacy Act 2020 governs how landlords and property managers collect, use, disclose, store, and give you access to your personal information. Personal information covered by the Privacy Act is any information that tells us something about a specific individual.
Landlords and property managers have obligations under the Act to manage your personal information responsibly. This guidance is designed to help you know your rights as a tenant or as an applicant for a rental property when landlords and property managers collect and use your personal information.
This guidance is not designed to cover:
Landlords and property managers can collect information from people when it’s connected with the activities of finding tenants and managing tenancies.
Landlords and property managers can only collect personal information that is necessary and only in ways that are lawful, fair, and not unreasonably intrusive. The table below will outline what information landlords and property managers can collect from you at different stages of a tenancy.
When landlords collect your personal information, they generally need to collect it from you directly.
However, landlords and property managers can look you up on the internet to get more information about you too. Information you post on sites like Facebook, Instagram, TikTok, LinkedIn, or news stories may be publicly available, depending on privacy settings. Collecting publicly available information is an exception to the rule that personal information should be collected directly from the person concerned. Landlords should still have a good reason to collect that information.
It’s not okay for a landlord or property manager to go beyond that. For instance, if you don’t have public social media profiles, a landlord or property managers can’t ask to friend you or ask an existing friend to check you out for them.
Another exception is where you give your consent for the landlord or property manager to collect information about you from someone else. For example, you might authorise a landlord or property manager to do a credit check on you through a credit reporting agency, or to get references from your former landlord or property manager or other people who know you.
How much information you give to a landlord or property manager when you apply for a property is your choice, but the amount you provide may affect a landlord or property manager’s decision to offer you a property.
Under the Privacy Act, landlords and property managers must tell you the consequences (if any) if you don’t provide all or any part of the information requested.
If your application will be unsuccessful if you don’t provide information the landlord or property manager requires to assess your suitability as a tenant, the landlord or property manager must tell you so. But you shouldn’t be disadvantaged if you refuse to provide information the landlord or property manager shouldn’t be asking for in the first place.
Before collecting your personal information, or as soon as possible afterwards, landlords or property managers must take reasonable steps to ensure you know:
If online tenancy application websites want to disclose your personal information to third parties, they need to clearly inform you that that’s one of the purposes that they’re collecting the information for. Alternatively, they can ask you to give informed consent to these disclosures. Consents are usually at the end of the application forms, where you click ‘OK’.
Landlords and property managers must have reasonable security safeguards (both physical and electronic) to protect your personal information against loss, unauthorised use or disclosure, and misuse.
If a landlord or property manager has a privacy breach that they believe caused (or is likely to cause) serious harm to you, they need to tell the Office of the Privacy Commissioner (OPC) as soon as possible. They will usually also need to tell you about the breach so that you can take steps to protect yourself from the consequences. OPC can provide advice to the landlord or property manager to help them understand what they need to do to rectify the situation.
If you’re personally affected by a privacy breach, you can complain to OPC. You can also complain if your landlord or property manager has not complied with their obligations to keep your information safe or told you about a breach of your personal information.
The Privacy Act gives you the right to ask landlords and property managers for the personal information they hold about you. They need to respond to your request promptly and generally no later than 20 working days after you make the request.
You can ask for any information the landlord or property manager may have collected about you like rental payment records and complaints.
Even when you’ve only applied to rent a property, and were unsuccessful, you can ask to see the information a landlord or property manager used to make their decision. That doesn’t mean you can ask for information about who the landlord or property manager decided to give the tenancy to.
In most circumstances, and agency should not charge a fee to the requester for accessing or correcting their personal information. However, there are some circumstances where it may be appropriate to charge people to access or correct their personal information. We have information on charging for personal information.
Landlords or property managers don’t always have to give you access to your information, though. For example, they can withhold information if:
If the landlord or property manager doesn’t provide some of the information you asked for, they must tell you why they’re withholding it. If you asked for your personal information and weren’t satisfied with the landlord’s or property manager’s response, you should contact the landlord or agency to see if you can resolve the matter directly.
The Privacy Commissioner can direct a landlord or property manager to provide you with access to your personal information if the landlord or property manager failed to provide access without a proper reason.
You have the right to ask a landlord or property manager to correct the personal information they hold about you. They can decline, though, if they believe the information they have about you is correct. If a landlord or property manager declines to correct the information, they need to explain why.
If the landlord or property manager won’t make the correction, they must, if possible, attach a ‘statement of correction’, which is your comment on the accuracy of the information.
If you aren’t satisfied with how your access or correction request has been dealt with, you can make a complaint to us.
For more information, see our guidance for organisations on requesting and correcting personal information.
Landlords and property managers should only retain your personal information for as long as may be required for a lawful purpose. They must delete your information once they no longer have a lawful use for it.
For example, once you’ve moved out of the rental property, there might be no need for your old landlord or property manager to keep your information, apart from some information they are legally required to keep for a certain amount of time under other legislation, such as the Residential Tenancies Act, or other legitimate business reasons.
If you’re an unsuccessful applicant for a property, there’s generally no need for the landlord to retain your information for very long once the property has been rented.
Once your personal information is no longer needed, it should be securely disposed of.
Landlords or property managers must only use information the purpose it was collected for.
For example, landlords or property managers may take photos of the property during a property inspection. These photos should only be of the property, for example, not inside drawers. It may be appropriate to take photos inside a wardrobe if it is necessary to document damage to the property.
Photos containing tenants’ personal information that are collected to manage the maintenance of the property, should not also be used for a sale of a house, unless the tenants gave consent for the landlord or property managers to do so.
There are exceptions to this rule. Some exceptions are that the use has been authorised by the tenant, or that it was necessary to use it to maintain the law or to lessen a serious threat to life or health.
Landlords or property managers can’t disclose your personal information to someone else unless it’s for the purpose it was collected for. There are exceptions to this rule, like those for using personal information.
Online applications may ask you to consent to the disclosure of your personal information to third parties. Make sure you read and understand these consents and don’t just click ‘OK’. You should have the ability to opt out, and your decision to do so shouldn’t impact on your application (except where the disclosure is required for an essential part of the selection process, such as a credit check).
Landlords sometimes share information about tenants on so-called tenant ‘blacklists’. These blacklists can be formal (such as a database held by a third party) or informal such as a list hosted on a private social media group that’s accessible only to group members. Using information supplied by landlords or other sources they claim to provide information about ‘bad tenants’ so that landlords can avoid renting to these tenants.
Tenant ‘blacklists’ are problematic under the Privacy Act. They lack transparency and are likely to contain information that’s inaccurate or incomplete. They can unfairly keep tenants out of the rental market based on inaccurate information. They also represent a risk to the security of tenant information, as such lists could be leaked to unauthorised individuals. For these reasons, the use of tenant ‘blacklists’ has been criticised by groups representing both tenants and landlords.
Landlords or property managers collect your personal information mainly for the purposes of selecting tenants and managing tenancies. The information shouldn’t be used for another purpose, such as disclosing information about you to other landlords or property managers (except with your informed consent, such as for a reference). Information on blacklists could also be inaccurate, disputed, or wrong.
In addition, tenant ‘blacklists’ could breach other legal restrictions. The information on them could be defamatory. It could also breach suppression orders, including name suppression orders relating to Tenancy Tribunal proceedings that can be made under the Residential Tenancies Act.
If information about you is disclosed and you suffer harm as a result, you need to complain to the agency in the first instance, and then you can make a complaint to OPC.
A landlord or property manager should never ask you whether you have experienced or are currently experiencing family violence when deciding whether to rent you a property. This information is highly sensitive and it would be unreasonably intrusive for them to ask you about this.
If you want to end your tenancy because you have experienced family violence, you will need to give your landlord or property manager a withdrawal notice and provide qualifying evidence that you have experienced family violence during the tenancy. Acceptable types of evidence include:
Evidence of family violence does not include the nature of the family violence, just that it has occurred.
For further information about family violence withdrawal notices, see the Tenancy Services website.
Key things to know to protect your personal information:
If you’re concerned about the questions a landlord or property manager is asking, try raising this concern with them first. It’s possible you’ll be able to resolve your concerns if you understand why they are asking the question, or if the information they need could be provided in another way.
If you think your landlord or property manager has failed to comply with the Privacy Act in relation to your personal information, you can formally complain to the Privacy Commissioner.
Privacy Act complaints must show not only that there was a breach of the Act but also that you suffered harm as a result (although this isn’t necessary if your complaint is about access to or correction of your information). ‘Harm’ can mean a range of things, such as financial loss, missing out on something you need or are entitled to, or significant emotional distress.
If we decide to investigate the complaint, and form a view that there has been a breach of privacy which has caused you harm, our focus will be on facilitating a settlement between you and the landlord or property manager.
If you and the landlord or property manager can’t settle the complaint through our process, you can file a claim in the Human Rights Review Tribunal. If the Tribunal decides there’s been an interference with your privacy rights, it can award remedies. The remedies can include requiring the landlord or property agency to pay financial damages.The Privacy Commissioner can also take enforcement action without having received a complaint. If the Commissioner considers a landlord or property manager to have breached the Privacy Act, the Commissioner can issue a notice requiring the landlord or property manager to comply with the Act.
Read more about the Commissioner’s approach to compliance and enforcement.
We also encourage you to learn more about the Privacy Act by completing our e-learning modules, so you can be an informed consumer and ask the right questions in tenancy situations.
You can contact us for more information.
Download the PDF version of the full Privacy Act guidance for tenants (PDF, 495KB)
