New South Wales rental ads and renter data: the 2026 Act explained

In this article

Written by

Kooky

Builder of Shaka, the payment router that pays every agent their commission on closing date.

About Kooky and Shaka →

A rental listing is two exchanges of information at once. The advertiser shows the home, in photographs that software can now tidy, furnish or invent. The applicant shows themselves, in documents that sit in somebody's files long after the keys are handed to somebody else. New South Wales has now legislated on both sides of that exchange in a single Act, and the people who will apply it day to day are property managers, leasing consultants and the landlords they act for.

The Residential Tenancies Amendment (Protection of Personal Information) Act 2026 passed the New South Wales Parliament on Thursday 24 September 2026 and received assent on Friday 2 October 2026, according to the Parliament's own record of the bill. This guide sets out what the text passed by both Houses contains: the status and start of each part, the rule on digitally generated or altered images, the other things a rental advertisement will have to state, the application form, the limits on collecting and keeping personal information, the penalties, and the powers of the Tribunal. It describes the position as read in October 2026, and says plainly what the Act leaves to regulations that had not been read for this guide, because a good part of the practical detail lives there.

Text of the bill as passed by both Houses, Parliament of New South Wales, September 2026. Maximum penalties. These provisions start by proclamation; the Government said on 25 September 2026 that it expected the laws to take effect in early 2027.

What the law is called and where it stands

The measure began life as the Residential Tenancies Amendment (Protection of Personal Information) Bill 2025, a Government bill introduced in the Legislative Assembly by Anoulack Chanthivong, the Minister for Better Regulation and Fair Trading. The Parliament of New South Wales now lists it as assented, as Act No. 38 of 2026, and records, under the label "Gazette publication", Government Gazette No. 419 of 9 October 2026. The page carries no commencement information, and the Gazette itself could not be opened for this guide.

It is an amending Act. The text passed by both Houses changes one statute only, the Residential Tenancies Act 2010, and makes no change to any other Act. So when the new rules are in force they will be read as sections of the Residential Tenancies Act 2010 itself: section 22B for advertisements, section 26 for pre-agreement disclosure, section 37A for rent records, and an amended Part 11 that runs from section 209 to section 218A.

The route through Parliament was long, and the dates matter because much commentary written along the way describes earlier drafts. The Parliament's bill page shows the following stages.

When the rules start

Assent and commencement are different events, and here the gap between them is the single most important fact for anyone planning around the Act.

Clause 2 of the text passed by both Houses gives two answers. One item, the amendment to section 73B on keeping animals, commences on assent, which means it has applied since 2 October 2026. Everything else commences on a day or days to be appointed by proclamation. The wording "day or days" allows the Government to switch the parts on separately, for example the advertising rules at one date and the application form at another. Whether it will do so is not stated in the Act.

The Government has given an expectation, not a date. In a ministerial release dated 25 September 2026, the day after the bill passed, the Minister's office said the new laws were expected to come into effect in early 2027, and that consultation had started to finalise the standard application form, the types of documents that may be collected and when they must be destroyed. The Tenants' Union of NSW, on a law-change page marked as updated in October 2026, likewise said the measure was likely to commence sometime in early 2027, although that page still described the bill as awaiting a final step in the Legislative Assembly, which the Parliament's record shows was completed on 24 September. The trade publication Elite Agent reported the same early 2027 expectation on 28 September 2026.

So the position on 10 October 2026, on the sources read, is this. In force: the amendment to section 73B, since 2 October 2026. Not reported as in force by any source read: everything else, including the image rule, the other advertising disclosures, the approved form, the collection and destruction rules, the privacy principle offence, the database changes and the Tribunal powers. No proclamation was read for this guide, and the one document not opened is Government Gazette No. 419 of 9 October 2026, which the Parliament's page lists without describing. An early 2027 start is the Government's stated expectation, not a date fixed by law. The text passed by both Houses also contains no savings or transitional provisions, so it does not itself say how the new rules will treat applications lodged, or information collected, before the start date.

The part that has started is narrow: new section 73B(1A) and (1B) let a tenant who applies for consent to keep an animal within 7 days of entering the agreement keep it while the request, and any Tribunal application that follows a refusal, is dealt with. The wider rules on pets sit outside this guide.

The image rule: digitally generated or altered photos

The image provision is short. New section 22B(5) of the Residential Tenancies Act 2010 deals with digitally generated or altered images "that would be reasonably likely to mislead or deceive a person", in an advertisement or other offer relating to residential premises offered for rent. A landlord or landlord's agent must not include such images unless the advertisement or offer states the fact that the images are digitally generated or altered, together with any other information the regulations prescribe.

Three features of that wording are worth reading slowly.

First, the Act does not name artificial intelligence. It speaks of images that are digitally generated or altered. A room furnished by an image-generation model, a sky replaced in editing software and a wall crack removed with a retouching tool are all, in ordinary terms, digital generation or alteration. The technology used is not the test.

Second, the test is the effect. The duty attaches to images reasonably likely to mislead or deceive, not to every edited photograph. The Act does not list which edits cross that line. The ministerial release that announced the bill on 29 June 2025 gave two examples of what the Government had in mind: artificially generated furniture that makes a single room look as though it fits a double bed, and digitally modified photographs that hide property damage. Those examples come from the release, not from the section.

Third, the remedy is disclosure, not prohibition. Section 22B(5) does not ban a generated or altered image. It requires the advertisement to say what the image is. The Act does not set the words of that statement, its size or its position; it allows regulations to prescribe additional information, and section 22B(9) allows regulations to set the form in which required information appears. Section 22B(6) lets the Secretary issue guidelines on the subject. No guidelines were read for this guide.

Who carries the duty? The obligations in section 22B fall on landlords and on agents of landlords, and the maximum penalty is set per subsection. One point on defences needs care. Section 22B(7) gives an agent a defence where the agent did not know, and could not reasonably have found out, the matters required to be stated. In the text passed by both Houses that defence is tied to subsection (1), the rule about supply networks described below. It is not expressed to cover the image rule in subsection (5).

What else a rental advertisement must state

The image rule is one of several disclosure duties that section 22B gathers in one place.

Section 22B(1) concerns an "exclusive supply network", the Act's term for the arrangement the Government's release called an embedded network. An advertisement for premises that have one must state that fact and name the relevant service, along with any prescribed information. "Relevant service" is defined in section 3(1) as electricity, gas, hot water, chilled water, internet access or a service prescribed by regulation. The same information returns at a second point. Under section 26(2B) and (2C), before a tenant enters an agreement for such premises, the landlord or agent must disclose the network, the service and any prescribed information, in the prescribed form and way.

Section 22B(2) requires the advertisement to say so if the landlord lives at the premises. Section 22B(3) requires it to specify restrictions on keeping animals that arise under an Act, a council order, a scheme by-law or a community rule. Section 22B(4) requires it to state a decision of the Tribunal that allows the landlord to refuse a species of animal, and to name the species. Section 22B(8) adds an open category: advertisements must include whatever information the regulations require.

The application form and what may be asked

The second half of the Act turns to the applicant. The ministerial release of 29 June 2025 set out the problem in the Government's words. It estimated that 187,000 pieces of identification information were being collected from renters in New South Wales each week, and listed examples of what applicants had been asked for: personal photographs, social media account details, relationship details, information about children, and the number of tattoos a person has. The release said around a third of people in the state rent their homes, and quoted the Minister: "Renters are entitled to dignity and privacy when living in a rental property."

The Act's answer is a single form. Under section 210D(1), personal information relating to a tenancy application may be collected only in the approved form. The form is approved by the Secretary. The release described it as a standard rental application form that makes clear what information can and cannot be collected.

The Act does not itself contain the form or a list of permitted questions. Section 218A(1) gives the regulations the power to settle that detail: the types of information that may be collected and the circumstances, the methods of collection, and limits on the documents a tenant may be asked for. The release said that after the bill passed, the Government would consult stakeholders to finalise the form, the types of documents that may be collected to assess an application, and when those documents must be destroyed. The release of 25 September 2026 said that consultation had started. Neither the approved form nor the regulations had been read for this guide, so the list of what may be asked remains an open point.

Three other rules in the Act shape the application stage, and they do not depend on the form.

• Direct collection. Under section 210C(1), a landlord or agent who intends to collect personal information must offer the tenant a way to give it directly. Under section 210C(2) and (3), a residential tenancy entity may collect personal information about a tenant only directly from the tenant, unless the tenant consents to another method or the regulations permit one. Regulations may prescribe permitted or prohibited methods.
• Inspection first. Under section 210D(2) and (3), a tenancy application cannot be accepted before the applicant inspects the premises, unless the applicant states in writing that they cannot inspect or do not wish to inspect first.
• Identity checks late. Under section 210E, identity verification information may be collected only if the landlord intends to enter into an agreement and has notified the tenant in writing beforehand. What counts as identity verification information is to be prescribed by regulation.

Who is bound: the residential tenancy entity

Part 11 uses a defined term to say who must follow the privacy rules. Under section 210A(1), a "residential tenancy entity" covers landlords, agents, and employees or contractors of landlords or agents who handle tenants' personal information. It also covers any person a tenant engages to share that information with a landlord or agent. Public sector agencies are excluded, as is any person the regulations exclude, although section 218A(1) lets regulations apply provisions to the public sector.

That last limb of the definition matters for technology. The release of June 2025 spoke of clear privacy rules for landlords, agents and rental platforms. The definition set out above does not list platforms as a category of their own. A service reaches the definition in one of the listed ways: as a contractor of the landlord or agent that handles tenants' personal information, as a person the tenant engages to pass information on, or by being prescribed. Whether a given application service falls inside therefore depends on how it is engaged, which is a question of fact in each case.

Not every duty falls on every entity. The image and advertising rules, the direct collection offer in section 210C(1), the approved form and the identity verification rule are addressed to landlords and agents. The general duty not to breach a privacy principle, and the ban on using unlawfully collected information, apply to residential tenancy entities as a class.

Storage, use and destruction

A reader looking for a single retention period in the Act will not find one. The Act works in three layers.

The first layer is the Australian Privacy Principles. Section 210 adopts the principles as in force from time to time, and section 210A(2) to (4) applies them to residential tenancy entities as they apply to organisations under the Commonwealth Privacy Act 1988. "Personal information" is defined in section 3(1) by reference to the same Commonwealth Act. Section 210A(5) then creates the state offence: a residential tenancy entity must not contravene a principle in relation to a tenant's personal information. The effect is that the national principles become enforceable under New South Wales tenancy law against landlords and agents in respect of tenant information. Section 210A(6) prevents a double finding: a person found guilty or acquitted under the Privacy Act cannot be found guilty under Part 11 for the same act or omission. The principles themselves are a federal instrument, and their content on security, access and destruction was not read for this guide.

The second layer is Division 1B, which section 210B says applies in addition to the principles. Its sharpest rule is in section 210F. Information collected in contravention of Part 11 or the regulations must not be used, and the section gives examples: it must not be used to verify identity, to assess a tenant's ability to pay rent, or to assess whether the tenant is likely to meet obligations under the tenancy. Under section 210F(2), that information must be destroyed within 2 business days after the entity becomes aware of the contravention. Regulations may permit certain uses, set holding periods and exempt some material from destruction.

The third layer is the regulations. Section 218A(1) lists what they may cover, and the list reads like the table of contents of an agency privacy manual: security of information, notification, methods of consent, destruction periods, access and correction, record-keeping, and reporting to the Secretary. It also includes digital identity verification, restrictions on use and disclosure even where the tenant consents, and a prohibition on using tenants' information to market financial products. The periods for which application documents may be kept, for successful and unsuccessful applicants alike, belong to this layer. They are not in the Act.

One further duty concerns records the agency already keeps. Under section 37A, when a tenancy ends the landlord or agent must give the tenant a written statement of the rent record for the tenancy period, within the prescribed period or, if none is prescribed, within 7 days.

Tenancy databases

Part 11 already regulated residential tenancy databases, the listings landlords and agents consult to check an applicant's tenancy history. The Act tightens that scheme. A database is redefined in section 209 as one that holds personal information about a person's former occupation of premises under a tenancy agreement and a breach of that agreement. Section 210H takes outside the scheme a database used only by the entity that keeps it or by its staff.

Under section 212, listed information must now be unambiguous and relevant, as well as meeting the existing conditions. Under section 216, a landlord or agent must, on written request, confirm whether it has listed a person's information and provide a copy, and a database operator must do the same for what it holds; no fee may be charged. Under section 218(1), where the privacy principles or the regulations require removal of a listing within a stated period shorter than 3 years, the shorter period applies.

Penalties in units and in dollars

The Act states penalties in penalty units, in pairs: one maximum for an individual and a higher one in any other case, which in practice means a corporation.

The Act does not state dollar amounts. The ministerial release of 29 June 2025 did: up to A$11,000 for individuals and A$49,500 for corporations for breaches of the privacy rules, and A$5,500 for individuals and A$22,000 for businesses for failing to disclose misleading altered photographs. The release of 25 September 2026 repeated the A$11,000, A$49,500 and A$22,000 figures. Set beside the units, those figures are consistent with a value of A$110 a unit: 100 units and 450 units for the privacy duty, 50 units and 200 units for the image duty.

The value of a penalty unit is set outside this Act and was not read on a legislation page for this guide, so the dollar figures are those of the two releases and the A$110 is arithmetic built on them.

Two further points complete the picture. Section 218A(2) allows a regulation to create an offence with a maximum of 450 penalty units, so the regulations may carry their own penalties. And the text passed by both Houses does not itself create penalty notice offences, the on-the-spot fines; whether any are added by regulation is not known from the Act.

What the Tribunal can order

Fines are one consequence. The Act also gives the person whose information is at stake a route of their own. Under section 210G(1), on application, the Tribunal may restrict the collection, use or disclosure of personal information, require that a person be given access to their information, or require that information be destroyed, amended or de-identified. The Tribunal must give a copy of any such order to the person affected.

Section 187(2)(b1) adds money. The Tribunal may order compensation for economic loss arising from a contravention of the privacy divisions of Part 11 or the regulations made under them. A person who can show an economic loss caused by such a contravention therefore has a claim that does not depend on a prosecution.

What is settled and what is still open

What is settled is the text and its status. The Act is made; one amendment on keeping animals has applied since 2 October 2026; the rest starts on a day or days to be proclaimed, which the Government expects to fall in early 2027. What NSW Fair Trading tells agents to do in the meantime is not settled by anything read here: the regulator's page on changes to rental laws, as read on 10 October 2026, carried no dated update and did not mention this Act, so nothing in this guide should be taken as its position.

What is open is most of the operating detail:

• the commencement date or dates, to be set by proclamation, whether the parts will start together, and the content of Government Gazette No. 419 of 9 October 2026;
• the approved application form and the list of information and documents it allows;
• what counts as identity verification information;
• how long documents may be held and when they must be destroyed in ordinary cases;
• any prescribed wording, form or placement for the image statement, and any guidelines from the Secretary;
• how existing records and pending applications are treated at the start date, on which the Act is silent.

There is also one conflict, and it sits between two Government releases. The release of 29 June 2025 put the volume of identification information collected from renters at 187,000 pieces each week. The release of 25 September 2026 gave the same number as collected from all rental applicants every year, and said the laws would cover more than 2.3 million renters across the state. Neither release explains the difference, so the figure is best quoted with its date and its period.

The Act fixes the principle and the penalty. The form, the document list and the retention periods are still to be written.

Kooky, from Shaka

Kooky edits Agents Estate and builds Shaka, the payment router he made for real estate professionals. One payment comes in, and every agent, agency and party in the deal receives their signed share on closing date.

About Kooky and Shaka →