The NZ Privacy Act and your open home sign-in sheet: what agents need to get right

Every open home sign-in sheet — paper or digital — is a form of personal information collection under the Privacy Act 2020. That’s not a technicality. A visitor’s name, phone number, and email address are exactly the kind of information the Act was written to cover, and real estate agents collect it every single weekend, often without thinking about it as a compliance activity at all.

This isn’t a scare piece. Most agents aren’t doing anything malicious with a sign-in sheet — the problem is almost always carelessness, not intent. But carelessness is still where the exposure sits, and a few of the Act’s principles map uncomfortably well onto exactly what a paper clipboard does.

The principles that actually apply at your front door

New Zealand’s Privacy Act 2020 sets out 13 Information Privacy Principles (IPPs). Not all of them are relevant to an open home, but several are worth knowing cold.

IPP 1 — Purpose

You need a genuine, identifiable reason for collecting someone’s details. “Lead generation and follow-up” is a legitimate purpose — nobody’s suggesting agents shouldn’t collect contact details at an open home. But it means you should be able to say, plainly, why you’re collecting it, and that purpose should be the one you actually use it for.

IPP 3 — Telling people what’s happening

When you collect information directly from someone — which is exactly what a sign-in sheet does — the Act expects them to know why. In practice, that’s a short line at the top of the sheet or screen: what it’s for, whether it’s optional, and roughly what happens to it next. Most paper sign-in sheets say nothing at all beyond “name / phone / email.” A visitor signing that has no idea if they’re about to get one follow-up email or added to a database indefinitely.

IPP 4 — Fair collection

Collection has to be fair and not unreasonably intrusive. A shared clipboard where every visitor can read the previous fifteen people’s phone numbers isn’t a purpose problem, it’s a fairness and manner-of-collection problem — nobody agreed to have their number displayed to strangers as the price of looking at a kitchen.

IPP 5 — Storage and security

Personal information has to be protected against loss, misuse, and unauthorised access. A paper sheet sitting on a table in an occupied house, visible to every subsequent visitor and photographable by anyone, is about as far from “secure storage” as it’s possible to get without actually trying. This is the principle a sign-in sheet breaches hardest, and it’s rarely the one anyone thinks about.

IPP 9 — Retention

Information shouldn’t be kept longer than it’s needed for the purpose it was collected for. If a visitor didn’t buy, didn’t engage, and hasn’t been in contact in a year, there’s no ongoing purpose that justifies still holding their number. Most offices have no retention or deletion policy for open home leads at all — the sheets get filed, the CRM entries never get pruned, and the data just accumulates.

IPP 11 — Disclosure

You can’t hand a visitor’s details to another agent, another office, or a third party outside the original purpose without a proper basis for doing so. A shared spreadsheet of “everyone who’s come through our opens this month,” passed around a franchise group, needs more thought than it usually gets.

IPP 6 and 7 — Access and correction

People have the right to ask what personal information you hold about them, and to ask you to correct it if it’s wrong. This rarely comes up over an open home lead, but it’s not hypothetical — a visitor who’s had persistent unwanted contact off the back of an open home sign-in is entitled to ask what you’ve got on file and have it fixed or removed. Being able to answer that request in five minutes rather than not being able to answer it at all is a reasonable bar to aim for.

What this looks like in practice, not theory

None of this means you need a lawyer standing at your open home. It means a few concrete habits:

• Put a short privacy line on your sign-in, whether it’s paper or digital — what it’s for, and that it’s used for follow-up on this and similar listings.
• Don’t leave the sheet or screen visible to the next visitor in line. If you’re using paper, that means covering completed rows or using individual slips rather than a running list everyone can read.
• Set an actual retention rule. A sensible default is to keep unconverted leads for a defined period — 12 months is common practice — and then delete them, rather than letting the CRM fill up indefinitely.
• Don’t share visitor lists outside the purpose they were collected for, even internally, without thinking about whether the person would reasonably expect that.
• Know that a visitor can ask what you hold on them — IPP 6 gives people the right to request their own information, and you need to be able to answer that request.

Where digital sign-in genuinely helps — and where it doesn’t automatically fix anything

Moving from paper to a tablet or app fixes the worst of the IPP 5 storage problem — nobody’s reading the last fifteen entries over your shoulder if each visitor gets their own screen. It doesn’t automatically fix IPP 9 retention; a digital database is just as capable of quietly accumulating five years of stale leads as a filing cabinet is, unless someone actively manages it.

This is part of why we built Open Property the way we did. Each visitor signs in on their own device — their own phone, tapping their own card — not a shared screen the next person in line can see. And because the visitor holds the pass themselves, in their own Google Wallet, rather than it living purely inside our database, they’re not handing their number to yet another system whose retention practices they have to trust blindly. It doesn’t make retention and disclosure obligations disappear — those are still on you as the agent, whatever tool you use — but it removes the most visible, most obviously careless failure mode: everyone’s details sitting out in plain view on a clipboard.

The honest bottom line

Nobody’s going to get a knock on the door from the Privacy Commissioner over an open home sign-in sheet in isolation. But the habits that create real privacy exposure — no stated purpose, no security around the sheet, no retention policy, casual disclosure between offices — are exactly the habits a clipboard makes easy and a bit of deliberate process makes avoidable. It costs nothing to add a line explaining why you’re collecting details and to stop leaving the sheet where the next fifty people can read it.

If you want the sign-in itself to be private by default, see how Open Property works at openlocally.com/openproperty — NZ$29 per agent per month, first month free.