In Victoria, an unsuccessful applicant’s information must be destroyed or permanently de-identified within 30 days after the rental agreement for the property is entered into. In Queensland it must be destroyed within three months of the start of the successful tenant’s agreement. In South Australia, the Residential Tenancies Act 1995 requires reasonable steps to destroy it as soon as practicable after 30 days from the date the tenancy agreement was entered into.
General informationAbout how long landlords and agents may keep application information, not legal advice about any record. The official pages are Consumer Affairs Victoria’s protecting a renter’s personal information and the Queensland RTA’s fact sheet for property managers and owners. South Australia’s timeframes are in section 76B of its Residential Tenancies Act 1995. The Consumer Protection WA page this guide draws on sets no timeframe for destroying application information; Consumer Protection WA is the place to ask.
What counts as the applicant’s information
Victoria calls it renter’s information: anything a renter, or someone applying to rent, discloses to the rental provider or agent when applying for or entering into an agreement, or for running it. Queensland’s definition is wider in one respect. Personal information there is information or opinion about an identifiable person, true or not, recorded or not, and it covers photographs or images of a person’s belongings or standard of living.
What it may be used for
Victoria and Queensland both narrow the purpose. In Victoria a renter’s personal information may be used only to decide whether they are suitable, or to meet another requirement of the Residential Tenancies Act 1997. In Queensland it may be collected only to assess whether the applicant suits the tenancy, and to manage the rental property.
While it is held, it has to be kept safe. Victorian rental providers and agents must take reasonable steps to protect it from:
- misuse or loss
- unauthorised access, modification or disclosure
In Queensland the property manager or owner must keep personal information stored securely, let only authorised people see it, and only to assess an application or manage the property, then destroy it securely when its time is up.
The clocks
| Whose information | State | Destroyed (or de-identified) by |
|---|---|---|
| An applicant who missed out | Victoria | Within 30 days after the rental agreement is entered into. |
| An applicant who missed out but agreed in writing that it may be used to apply for other premises | Victoria | Within 6 months after the agreement they first applied for is entered into. |
| A renter whose agreement has ended | Victoria | Within 3 years after the agreement’s end date. |
| An applicant who did not become a tenant | Queensland | Destroyed within three months of the successful tenant’s agreement beginning. |
| Information gathered during a tenancy to manage the property | Queensland | Destroyed within 7 years of the agreement ending, for agreements active on or starting after 1 May 2025. |
| An applicant who did not become a tenant | South Australia | Reasonable steps to destroy it as soon as practicable after 30 days from the date the agreement was entered into. |
| An applicant who consented to it being kept longer | South Australia | Reasonable steps to destroy it as soon as practicable after 6 months from the date the information was provided. |
| A tenant whose tenancy has ended | South Australia | Reasonable steps to destroy it as soon as practicable after 3 years from the end of the tenancy. |
Queensland’s seven-year rule does not reach back: information from tenancies that ended before 1 May 2025 does not have to be destroyed straight away. South Australia’s rules give way to any South Australian or Commonwealth Act on preserving records, and do not apply to the South Australian Housing Trust or its subsidiaries, registered community housing providers, or government agencies named in the regulations.
When Victoria allows it to be kept or shared
Consumer Affairs Victoria names a few limited situations in which a rental provider or agent need not destroy or de-identify the information, or may disclose it. They include where:
they believe disclosing it is needed to lessen or prevent a serious threat to someone’s life, or to a person’s or the public’s health, safety or welfare
they believe disclosing it is needed on behalf of a law enforcement agency to prevent illegal activity
the renter has given written consent to the disclosure, and the information is held for that purpose
an Act, a law, or an order of a court or tribunal requires them to keep or disclose it
These Victorian duties do not apply where the rental provider or agent is meeting a matching obligation under another privacy law. The page names the Commonwealth Privacy Act 1988, Victoria’s Privacy and Data Protection Act 2014, Public Records Act 1973 and Health Records Act 2001, and section 254 of the Crimes Act 1958.
If the rules are broken
In Victoria, breaching these obligations is a criminal offence, and penalties apply. In Queensland it is an offence not to follow the rules on collecting, storing and destroying personal information, and property managers and owners must also follow Commonwealth, and sometimes state, privacy law. An applicant or tenant worried about misuse can complain to the relevant regulator; the RTA points to Queensland’s Office of the Information Commissioner and the Office of the Australian Information Commissioner, and notes that the state’s own Act may apply only where the State manages the property.
Queensland also guards identity documents at the moment they are shown: one sighted in person may not be copied or recorded without the applicant’s consent. The rest of the document rules are in documents, two of each, and what may be asked in the first place is in what a rental application may ask.