Privacy Collection Notice Template for Mortgage Brokers

What a Collection Notice Does

A collection notice explains a particular collection of personal information at the point it happens. For a brokerage covered by the Privacy Act, Australian Privacy Principle 5 (APP 5) requires reasonable steps to notify clients of specified matters. Giving the notice before or during collection is the normal approach.

If that timing is impracticable, APP 5 requires notification as soon as practicable afterwards. The Office of the Australian Information Commissioner (OAIC) gives APP 5 guidance on both timing and content. A website footer alone can leave a client unaware when they send financial documents through another channel.

A privacy policy explains the brokerage’s broader handling practices. A privacy notice explains this collection, including its purpose and the consequences of withholding information. The OAIC’s APP 1 guidance distinguishes those documents.

A client can acknowledge receiving a notice without consenting to an optional use. A signature at the bottom of the fact-find does not automatically authorise every disclosure described in it.

Collection Notice Template

Use this privacy collection notice template as example wording, with a completed contact panel attached. Each clause has a different job. Check the finished version against APP 5’s required matters and your actual information handling.

Identify the Brokerage

Name the legal entity that collects the information. Include the trading name and a contact clients can use for privacy questions.

Brokerage legal name: ______

Trading name: ______

Privacy contact and role: ______

Email or telephone: ______

Postal address: ______

In this notice, “we” means the brokerage identified in this contact panel. Contact our privacy contact if you have a question about how we handle your information.

Explain What You Collect and Why

Keep only the categories and purposes that match the service. This example assumes a broker helping a client seek a home loan.

We collect your contact and identity details, information about your finances and the loan you want. Financial information includes employment, income, expenses, assets and debts.

We use this information to understand your requirements and financial situation. We also use it to help compare credit options and prepare an application you choose to make.

We usually collect information from you through our fact-find and supporting documents. Where we collect information from someone else, we tell you the source and circumstances of that collection.

Source and circumstances of any indirect collection: ______

For example, identify information received from a referral partner before the client contacted you. Obtain information directly from the client unless an applicable exception permits another route.

Name Any Legal Requirement

Where a law or court order requires or authorises collection, identify it and the information concerned. Do not write that all requested information is legally required.

Information required or authorised by law: ______

Name of the Australian law or details of the court or tribunal order: ______

Why that requirement applies to this collection: ______

Remove this clause when no such requirement applies. Ask your compliance adviser to confirm the actual requirement before using it.

Explain Missing Information

Tell the client the main practical consequence of withholding information. Separate a necessary loan assessment step from an optional service.

You can choose not to provide information we request. Without the financial information needed to assess your circumstances, we cannot complete that assessment or prepare a complete application.

Other consequences that apply to this service: ______

Describe the Usual Recipients

List the organisations or types of recipients your brokerage usually shares this information with. Include your aggregator and technology providers where they receive client information.

We share information needed to provide the broking service with the recipients listed here. These can include prospective lenders and our aggregator, according to the service you request.

Usual recipients and what each receives: ______

Purpose of each disclosure: ______

Identify credit reporting arrangements separately. A notice that mentions credit checks does not itself authorise your brokerage to obtain a consumer credit report.

Explain Overseas Disclosure

State whether overseas recipients are likely to receive the information. Where practicable, name their countries. Include relevant support access and subcontractors when mapping the provider’s arrangements.

Overseas disclosure likely: ______

Overseas recipients or service functions: ______

Countries where those recipients are located: ______

Information disclosed and purpose: ______

Complete the fields from the provider arrangements your brokerage actually uses. Hosting and overseas disclosure are different questions. The APP 8 guidance explains the distinction and the obligations for overseas disclosure.

Point to Access and Complaints Information

Give the client a usable way to obtain your privacy policy. Its access and complaint processes must match the brokerage’s actual process.

Our privacy policy explains how to request access to your personal information and ask us to correct it. It also explains how to complain about a privacy breach and how we handle complaints.

Privacy policy location: ______

You can ask our privacy contact for a copy using the details in the contact panel.

Add an AI Tools Clause

An AI tools clause explains which client information a provider processes and the job it performs. Place it beside the notice’s collection purposes and recipient details, before the client supplies the relevant information.

Use this example only for the AI activities your brokerage has approved:

We use the AI tools described in the panel below to help process information for your broking service. The panel names the provider and explains what information it receives.

AI provider and product: ______

Task performed, such as transcribing a meeting or extracting information from documents: ______

Client information processed: ______

Who can access the information and outputs: ______

Countries of processing and any overseas recipients: ______

Retention period and deletion arrangements: ______

Provider’s permitted uses of the information, including any model training: ______

Human review before an output is used: ______

Available alternative and any consequence of declining an optional AI activity: ______

Name a provider’s actual terms instead of promising that all AI tools keep data in Australia or exclude it from training. Keep any recording permission separate from notice of document processing.

The OAIC’s guidance on commercially available AI products explains why AI use belongs in privacy notices. It also explains that a notice alone does not establish consent to collect sensitive information. An AI clause does not replace the assessment of whether the proposed use is lawful.

Privacy Consent Form

A privacy consent form records a particular permission. APP 5 does not impose a general requirement for written consent to collect ordinary personal information. The consent rules depend on the information and the proposed use.

Under APP 3’s collection rules, collecting sensitive information generally requires consent as well as reasonable necessity, unless an exception applies. Health information is an example. Financial information is personal information but is not automatically sensitive information in the Act’s defined sense.

Express consent can be spoken or written. Written records help show the precise choice, but a signature does not repair unclear or bundled consent. The OAIC’s consent guidance requires a voluntary and informed decision that is current and specific.

Written authority is required for an access seeker acting for a client to obtain credit reporting information. The OAIC’s access seeker guidance also restricts who can use that route and how the information can be used. A broker must establish that the route fits before using the example authority below.

Example Consent Form

Use separate choices for separate purposes. Complete the activity details before the client chooses, and collect a separate response from each applicant.

Client’s full name: ______

Brokerage legal name: ______

Collection notice version received: ______

I acknowledge receiving the collection notice. This acknowledgement records receipt and does not give consent to the optional activities below.

Use this authority only where the brokerage lawfully acts as an access seeker:

I authorise the brokerage named above to request my consumer credit report from the credit reporting body named below on my behalf.

Credit reporting body: ______

Specific purpose and permitted use of the report: ______

Authority ends at this event or after this period: ______

My choice, agree or decline: ______

For a specific collection of sensitive information, use a separate permission:

I consent to the brokerage collecting the sensitive information described below for the stated purpose. The recipients of that information are identified below.

Information and why it is needed: ______

Recipients and permitted use: ______

Consequence of declining: ______

My choice, agree or decline: ______

For optional AI-assisted recording, attach the completed AI panel and describe the specific meeting:

I consent to the brokerage recording and transcribing the meeting identified below using the provider named in the attached AI panel. The panel explains the processing and retention arrangements.

Meeting and purpose: ______

Alternative if I decline: ______

My choice, agree or decline: ______

Finish the form with a record of the decision:

I can withdraw a consent by contacting the privacy contact in the notice. Withdrawal applies to future activities that rely on that consent. It does not automatically require deletion of records the brokerage must lawfully retain.

Client signature or recorded electronic decision: ______

Date of decision: ______

Staff member recording the decision: ______

For a new use outside the original collection purpose, APP 6 requires consent or another applicable exception. Do not turn the form into agreement to any future use, or treat it as a waiver of overseas disclosure responsibilities.

Before adding this data privacy consent form to the fact-find pack, check that an applicant can decline one optional activity without accepting it through another clause. Retain the completed notice version with each recorded choice so staff can follow the permission the client actually gave.