THE REAL ESTATE LAWYER

Last updated: 28 October 2026

1. About this Privacy Policy

The Real Estate Lawyer is committed to protecting the privacy and security of personal information.

We collect, hold, use and disclose personal information in accordance with the Privacy Act 1988 (Cth), including the Australian Privacy Principles (APPs), and, where applicable, the Anti-Money Laundering and Counter-Terrorism Financing Act 2006 (Cth) (AML/CTF Act) and associated Rules.

The Privacy Act applies to personal information handled in connection with obligations under the AML/CTF Act, including by reporting entities that might otherwise qualify for the small business exemption under the Privacy Act.

This Policy explains how we manage personal information collected in connection with our legal practice, including information collected for customer identification, verification and other AML/CTF compliance purposes.

2. Personal information we collect

The types of personal information we may collect depend upon the legal services we provide and may include:

name, residential and postal address, telephone number and email address;
date of birth;
occupation and employment information;
information contained in identification documents such as passports, driver licences and other government-issued identification;
identification document numbers and verification information;
photographs or biometric information used as part of electronic identity verification processes;
signatures;
information concerning a person's citizenship or residency;
details regarding companies, trusts, partnerships and other entities with which a person is associated;
information identifying beneficial owners, controllers, trustees, directors, shareholders, partners, attorneys, agents or other relevant persons;
information regarding the nature and purpose of a client's instructions or business relationship with us;
source of funds or source of wealth information where required;
transaction and property information;
information obtained from publicly available sources, government records, electronic verification services, sanctions or politically exposed person screening and other verification services; and
other information reasonably necessary for us to provide legal services or comply with our professional, regulatory or legal obligations.

Where required for AML/CTF compliance, the information collected may include sensitive information where collection is authorised or required by law.

We seek to limit the personal information we collect to information reasonably necessary for our functions and activities and our legal and regulatory obligations. The OAIC requires reporting entities to take a data-minimisation approach to AML/CTF information.

3. How we collect personal information

We may collect personal information:

directly from you;
from persons authorised to act on your behalf;
through our client onboarding processes;
through identity verification and AML/CTF compliance platforms;
from government agencies, registers and databases;
from other parties involved in a legal transaction or matter;
from your accountants, financial advisers, brokers, real estate agents or other professional advisers where authorised or permitted by law;
from publicly available information; and
from third-party verification, screening and technology service providers.

We use triSearch and triConvey in connection with electronic verification of identity, customer due diligence and AML/CTF compliance.

TriSearch's AML/CTF Compliance Centre provides customer onboarding and due diligence functionality including verification of identity, PEP and sanctions screening, adverse-media checking, customer risk assessment and AML/CTF record keeping, integrated with triConvey.

triSearch states that data within its AML/CTF Compliance Centre is stored in secure, encrypted data centres located exclusively within Australia.

4. Identity verification and AML/CTF compliance

We may be required under the AML/CTF Act to undertake customer due diligence before or while providing certain designated services.

This may involve identifying and verifying clients and other relevant persons and, where appropriate:

verifying identity;
identifying beneficial owners or persons exercising control;
understanding the nature and purpose of the business relationship;
assessing money laundering, terrorism financing and proliferation financing risks;
undertaking politically exposed person and sanctions screening;
undertaking enhanced customer due diligence where required;
conducting ongoing customer due diligence; and
making reports or disclosures required or authorised by law.

We may use electronic identity verification and other third-party services for these purposes.

5. Identity documents and verification records

Identity documents contain personal information that requires particular care. We seek to minimise the collection and retention of copies of complete identity documents.

Identity documents may be viewed, collected or processed as part of an electronic identity verification or AML/CTF compliance process.

The AML/CTF Act does not itself require reporting entities to collect, use, disclose or retain copies of full identity documents for customer due diligence, ongoing monitoring or AML/CTF record keeping. The amount and nature of information reasonably necessary may nevertheless vary depending on the relevant AML/CTF risk and circumstances.

Our identity verification and AML/CTF processes may generate verification of identity records, KYC information, customer due diligence records, risk assessments, screening results, onboarding reports and other compliance records. Those records may be retained where reasonably necessary or required to document and demonstrate our compliance with applicable legal, regulatory and professional obligations.

Where a compliance record contains an image or copy of a complete identity document, we will not retain the complete identity document solely on the basis that the AML/CTF Act requires an AML/CTF record to be retained. We will periodically consider whether retaining the complete identity document remains reasonably necessary, required or authorised by law and, where it is not, take reasonable steps to destroy or de-identify the unnecessary information.

6. Why we collect, hold, use and disclose personal information

We may collect, hold, use and disclose personal information for purposes including:

providing legal services;
opening, administering and managing client files;
communicating with clients and other relevant persons;
conducting conflict checks;
verifying identity;
complying with conveyancing and electronic conveyancing requirements;
undertaking customer due diligence;
assessing and managing AML/CTF risk;
complying with the AML/CTF Act and Rules;
complying with legal, regulatory and professional obligations;
maintaining appropriate business and regulatory records;
protecting against fraud and other unlawful activity; and
administering and managing our legal practice.

7. Disclosure of personal information

We may disclose personal information where reasonably necessary for the provision of our services or where authorised or required by law, including to:

government agencies and regulators, including AUSTRAC where applicable;
courts, tribunals and law enforcement agencies where authorised or required by law;
electronic conveyancing and property transaction service providers;
identity verification and AML/CTF service providers;
IT, cloud hosting, document management and practice management providers;
banks and financial institutions where relevant to a transaction;
barristers, experts, consultants and other professional advisers engaged in connection with a matter;
other persons with your authority or where otherwise permitted or required by law; and
other AML/CTF reporting entities, including real estate agents or agencies involved in a client's transaction, where we participate in a customer due diligence reliance agreement or arrangement permitted under the AML/CTF Act.

AML/CTF reliance arrangements

Where permitted under the AML/CTF Act, we may enter into agreements or arrangements under which another reporting entity relies upon customer due diligence undertaken by us, or we rely upon customer due diligence undertaken by another reporting entity. In connection with such an arrangement, we may disclose or receive customer identification, verification and other KYC information reasonably required for the purposes of the reliance arrangement. Any such disclosure is subject to applicable privacy, confidentiality and AML/CTF requirements, including restrictions on the disclosure of information where applicable.

We do not sell personal information.

8. Third-party service providers

We use third-party service providers in operating our legal practice and complying with our legal and regulatory obligations.

Our providers may include practice management, conveyancing, electronic identity verification, customer due diligence, AML/CTF compliance, document storage and other technology providers.

Before using third-party services involving personal information, we take reasonable steps appropriate to the circumstances to consider how the provider collects, handles, stores and protects personal information.

The OAIC's Privacy Essentials Checklist for AML/CTF reporting entities specifically recommends that reporting entities assess third-party privacy risks and review contractual arrangements to understand how providers collect, handle and store personal information.

As at the date of this Policy, triSearch states that data in its relevant AML/CTF service is stored in secure, encrypted data centres located exclusively within Australia.

9. Overseas disclosure

We take reasonable steps to identify whether personal information is likely to be disclosed to recipients located outside Australia and to comply with applicable requirements of the Privacy Act in relation to any overseas disclosure.

Where a service provider processes or discloses personal information overseas, we will address those arrangements in accordance with our obligations under the Australian Privacy Principles.

10. Storage and security

We take reasonable steps to protect personal information from misuse, interference, loss and unauthorised access, modification or disclosure.

Personal information may be held electronically through our practice management systems, document management systems, email systems, electronic conveyancing systems, identity verification platforms and AML/CTF compliance systems, and in physical records where applicable.

AML/CTF and customer identification information may form part of the electronic client or compliance record maintained through systems used by our practice.

Where third-party systems are used, we take reasonable steps appropriate to the circumstances to assess their privacy and information-security arrangements.

11. Retention and destruction

We retain records for the periods required by applicable legal, regulatory and professional obligations.

AML/CTF records are subject to statutory record-keeping requirements. AUSTRAC states that relevant AML/CTF records are generally required to be retained for seven years, including AML/CTF program records, customer due diligence records and relevant transaction records. Customer due diligence records are generally retained for at least seven years from the end of the business relationship and transaction records for at least seven years from completion of the transaction.

The requirement to maintain an AML/CTF record does not necessarily require us to retain a complete copy of an identity document.

Where personal information is no longer required for a permitted purpose and we are not legally required to retain it, we take reasonable steps to destroy or de-identify the information in accordance with our information governance and record-retention procedures.

12. Access and correction

You may request access to personal information we hold about you or request correction of information that you believe is inaccurate, out of date, incomplete, irrelevant or misleading.

Requests should be made using the contact details below.

Access or correction may be subject to exceptions permitted by law.

13. Privacy complaints

If you believe we have not handled your personal information appropriately, you may contact us using the details below.

We will consider and respond to privacy complaints in accordance with our obligations under applicable privacy legislation.

If you are not satisfied with our response, you may have a right to make a complaint to the Office of the Australian Information Commissioner (OAIC).

14. Data breaches

We maintain processes for identifying, assessing and responding to suspected or actual data breaches involving personal information.

Where a data breach is an eligible data breach under the Privacy Act 1988 (Cth), we will comply with applicable notification requirements.

The OAIC Privacy guidance for reporting entities under the AML/CTF Act includes maintaining a data-breach response plan as part of privacy preparedness.

15. Changes to this Policy

We may amend this Privacy Policy from time to time to reflect changes to our practices, technology and legal or regulatory requirements.

The current version will be made available through our usual communication channels and, where applicable, on our website.

16. Contact us

The Real Estate Lawyer

Privacy enquiries, requests for access or correction, and complaints may be directed to:

Privacy Officer
The Real Estate Lawyer
laura@therealestatelawyer.com.au
07 3262 6227
Level 10, 95 North Quay

Brisbane QLD 4000