AI for Australian real estate agents: protect tenant details

In property management, AI usually starts with a paste: a tenancy application to summarise for the landlord. It carries the lot, from date of birth and employer to the licence, card number included, and the Medicare card that makes up the 100 points of ID.

The paperwork does not stop there. The condition report names the tenants who signed it, the bond lodgement form carries their details again, and a previous rental ledger shows what one person paid and when. All of it ends up in the agency inbox and the CRM, which is where staff copy from.

The Privacy Commissioner looked hard at that bundle in April 2026, finding the 2Apply platform had collected more than a tenancy application needs. In Western Australia, Consumer Protection reminds property managers that verifying an applicant’s identity isn’t a requirement, and an applicant who sends a licence anyway can mark the copy with the street it is for. One who uses a passport can send a watermarked passport copy naming the property and the month. Renters in Queensland, South Australia, the ACT, Tasmania and the Northern Territory can do the same with a licence copy before they apply.

In Victoria the list is shorter by law. Consumer Affairs Victoria says rental providers must use the prescribed application form and may not ask for anything outside it, detailed bank statements with daily transactions and bond history included. A Victorian applicant who sends a licence can still send a copy watermarked for that one property.

How can AI help real estate agents with applications? By turning a long form into four lines the landlord can read on a phone, as long as the applicant’s identity stays behind. Highlight the application, press the key, and paste.

In the invented application below, the reference, the applicant’s name, date of birth, NSW licence number, mobile and email reach the chat as placeholders. The rent, the net pay and the clean ledger stay readable, because they are what the landlord is deciding on and none of them names anyone. A Medicare number in the same text would come out too.

The model writes its summary around [PERSON_1], and Nonimo drops the real name back in on your screen before it goes to the landlord. How long OpenAI holds a paste is a separate question.

Before any AI tools for real estate agents come into it, there is the line the OAIC drew on 1 April 2026 in its 2Apply determination: collect only what a tenancy application reasonably needs, and collect it fairly.

The determination is about a RentTech platform, but agencies run all through it. The platform had collected too much, by unfair means, in a rental market whose power imbalance, the Privacy Commissioner wrote, favours real estate agents, property managers and landlords. An applicant can push back a little with a NSW licence copy that names the one application it is for, and nothing the agency needs is hidden by it.

Paragraph 10 is the one to read out at the next property management meeting. Paragraph 95 names identification documents, proof of income and details such as the number of names on a Medicare card. A WA licence adds another such detail, the card number on the back, rarely needed by an agency.

None of that mentions AI. The OAIC’s AI guidance of 21 October 2024 does, and its best-practice advice is to leave personal information out of any generative AI tool the public can use. Whether the Privacy Act reaches a smaller agency depends on turnover and a few exceptions, which our guide to the Privacy Act and chatbots walks through.

On the sales side, the paperwork starts once an offer is accepted: the sales advice to both sides’ solicitors or conveyancers, the vendor’s statement in Victoria, the deposit into the trust account, and the land itself by volume and folio, folio identifier or strata plan.

Since 1 July 2026 there is a second file. An agency brokering a sale or purchase provides a designated service under the AML/CTF Act and identifies seller and buyer. For an individual, AUSTRAC’s guide suggests full name, date of birth, residential address and a unique identifier such as a passport or driver’s licence number (NSW licences add a card number). The OAIC’s guidance for reporting entities, updated 28 August 2026, uses a real estate agency turning over $1.1 million as its case study.

Nonimo treats an identification note or a sales email like any other text: the passport number, the birth date, the address, the BSB and account of the deposit become placeholders, while price, deposit and settlement terms stay readable. Reform may yet widen the Privacy Act further; an exposure draft Bill went to consultation in September 2026 and is still with the government.

Plenty of tools sell AI to real estate agents; Nonimo sits in front of them. It installs like any other program on a Mac or a Windows PC, from the download buttons at the head of this page.

Each computer installs it on its own, and nobody at the agency changes chatbot or learns a new screen.

Across the whole agency, IT can push out a browser extension, set by policy, that covers text without anyone pressing the key, as our page for organisations explains.

Start with the property managers, whose inboxes take applications every day, then the sales admin who handles the file once an offer is accepted. The records the Privacy Act and the AML/CTF Act ask for stay the agency’s own, in its own systems. More on our security page.