An agency wants your database. What can you safely bring?

Start with a contact’s expectations

ACMA says marketing emails and messages need consent, accurate sender details and an easy way to unsubscribe. Having a phone number in your address book is not, by itself, proof that someone agreed to marketing from a new agency. ACMA: Avoid sending spam.

If an interviewer asks whether you have a database, first ask what they mean. They may be asking about local connections or your ability to build relationships. That is different from asking you to hand over another business’s customer records.

Separate knowledge from files

You can describe your experience with follow-up systems without exporting a previous employer’s CRM. You can explain that you know a community without sharing private contact details. You can discuss how you would build new relationships through approved processes.

Treat former-employer lists, customer notes and transaction histories as material that needs permission and legal review. Do not assume that personally knowing a client gives you the right to transfer every record about them.

For a new starter, this can feel uncomfortable. You want to show that you will contribute. A careful answer also shows good judgement: “I can help build a database, but we need to confirm which information we may lawfully use.”

Public does not mean unrestricted

OAIC guidance explains that using publicly available information for marketing can still involve privacy obligations, and some public registers have specific restrictions. The Spam Act and Do Not Call rules may also apply. OAIC: Direct marketing.

Do not scrape names, emails or phone numbers just because a site lets you view them. Do not upload a list to test whether it “works”. Ask the agency’s responsible manager to check the source, permitted purpose, consent evidence and access controls first.

Build a better record from the start

For approved new contacts, record where the information came from, what contact they agreed to and how to honour a stop request. Keep only information needed for the legitimate task. Follow the agency’s approved system rather than creating an unofficial spreadsheet on your own device.

Privacy Act coverage and exemptions need checking for the actual business. Client-list ownership and confidentiality can also depend on contracts and other law. One checklist cannot decide all of those issues.

Your next step

Use Do you have to cold call or door knock in 2026? to prepare a permission-first plan. Ask who owns the system, who approves imports and who handles opt-outs. Trust is an asset you can build without taking a list you are not entitled to use.