Who else holds the record, how long a supplier may keep it, and what the Privacy Act 2020 and the Australian Privacy Principles require of you.
Brokers ask whether a lead is exclusive. Fewer ask the follow-up question, which is exclusive for how long, and what the supplier is permitted to do with the record afterwards.
That second question decides whether the person you just spoke to gets a call from four other advisers next month, and whether both you and your supplier are inside the privacy law of the market you are operating in.
At minimum, two parties. You hold a copy, and the supplier holds the original along with the consent record, the submission metadata, and whatever verification evidence they gathered. That is normal and necessary, since a supplier who deleted the consent record could not defend the collection if a consumer complained.
The question is who else. Depending on the supplier, the list can also include an affiliate network that originated the traffic, a data enrichment vendor, an offshore call centre used for pre-qualification, and any other broker who bought the same record.
| Party | Why they hold it | Whether you should expect it |
|---|---|---|
| The supplier | Consent evidence, dispute handling, delivery audit | Yes, and a supplier who does not is a worse supplier |
| You, the broker | Advice file and client record obligations | Yes |
| An affiliate or traffic partner | They originated the enquiry before selling it on | Only if the supplier does not own the source |
| A pre-qualification call centre | They rang the consumer before you did | Ask directly, because it changes the consumer experience |
| Other brokers | The record was sold more than once | Only if you bought a shared lead |
Two principles do most of the work. IPP 9 of the Privacy Act 2020 requires that an agency does not keep personal information for longer than it is required for the purpose it can lawfully be used for. IPP 11 restricts disclosure of personal information to other parties.
The principle that catches lead buyers specifically is IPP 3A, which deals with information collected indirectly. When you obtain personal information about someone from a source other than that person, you have to take reasonable steps to make them aware of the collection, what it will be used for, and who now holds it.
The practical consequence: A broker who buys an enquiry and calls it without ever telling the consumer how they came to hold their details has an IPP 3A problem regardless of how clean the supplier is. The supplier can make this easy by disclosing the onward supply on the form itself. Ask whether they do.
The Australian Privacy Principles handle the same problem through a different route. APP 5 requires notification at or before the point of collection, covering the collecting entity, the purposes of collection, and usual disclosures.
APP 7 then governs direct marketing, and this is the provision that bites. Where personal information has been collected from a third party, or where the individual would not reasonably expect their information to be used for direct marketing, an organisation may only direct-market if it notified the individual under APP 5.1 that direct marketing was one of the purposes of collection. The OAIC guidelines list third-party lead generation by name as a source of data caught by this rule.
There is a second obligation attached: where the data did not come from the individual, the organisation must also make the individual aware of the right to opt out.
Sources of third party data include data list providers, third party mobile applications, third party lead generation and enhancement data.
OAIC, APP 7 direct marketing guidelines
A recycled lead is usually not a supplier acting in bad faith on a specific record. It is a retention policy running its course. The supplier sells an enquiry with a 30 or 90 day exclusivity window, the window closes, and the record returns to a saleable pool. Nothing in the contract was breached, and the consumer receives their fifth call four months after asking one question.
The consumer experience is identical to the bad-faith version, and so is the effect on your reputation, since you were one of the callers.
These belong in the supply agreement rather than in a sales conversation, because a retention policy that exists only as a verbal assurance is a policy that can change without telling you.
| Term | What good looks like |
|---|---|
| Exclusivity duration | Permanent, stated in the agreement, not a rolling window |
| Resale after the window | Explicitly prohibited rather than silent |
| Retention period | A stated period tied to the purpose, consistent with IPP 9 |
| Onward disclosure | A named list of processors, not "our partners" |
| Consumer disclosure at the form | The form tells the consumer their enquiry goes to a broker |
| Deletion on request | A defined process and turnaround for a consumer request |
How Lead Foundry answers this: Each enquiry is sold to one broker and is not resold when any period elapses, because there is no period. The consumer is told on the form that their enquiry goes to a licensed adviser, which is what makes your first call an expected one.
It depends entirely on the contract. Many suppliers sell exclusivity as a time-limited window of 30 or 90 days, after which the record can return to a saleable pool. That is the most common mechanism behind recycled leads. Ask whether exclusivity is permanent or windowed, and get the answer written into the supply agreement rather than stated on a call.
In New Zealand, IPP 9 of the Privacy Act 2020 requires that personal information is not kept for longer than it is required for the purpose it can lawfully be used for. There is no fixed number of months in the Act. A supplier should be able to state their retention period and tie it to a purpose, such as holding consent evidence for dispute handling.
In New Zealand, IPP 3A requires reasonable steps to make an individual aware when you collect their personal information from a source other than them, including what it will be used for and who holds it. In Australia, APP 5 requires notification of collection and APP 7 restricts direct marketing on third-party data unless that notification covered direct marketing. In practice the cleanest approach is a supplier whose form already discloses the onward supply, plus a first call that says how you came to be calling.
An enquiry that is sold again, often months after the consumer submitted it, either because an exclusivity window expired or because the record re-entered a saleable pool. From the consumer side it is indistinguishable from being spammed, and the broker making the fifth call absorbs the reaction.