Sales leads for Australian businesses

A "sales lead" is a person or business that may become a customer, together with the contact and other details a business holds about them. This page sets out, in general terms, how Australian businesses work with leads and the rules that apply along the way: the Spam Act for commercial email and SMS, the Do Not Call Register and the telemarketing industry standard for calls, the Australian Consumer Law rules on door-to-door and phone sales, the Privacy Act when collecting and using lead data, the ban on misleading conduct, contract basics when buying leads from another business, securing customer records, and scams that target businesses, with links to official Australian sources.

This is a free, non-commercial reference page. It is general information only, not legal, privacy, marketing compliance or cyber security advice, and it does not take into account your business's circumstances. It does not review, rank or recommend any lead-generation company, list broker, CRM, software or marketing service. For advice on your own obligations, speak to a qualified professional and check the official guidance linked below. This page is not affiliated with any business or government body, and listing is not an endorsement.

The guide

What a lead is, the rules for contacting people by email, SMS, phone and in person, privacy when collecting and using lead data, buying leads, keeping records secure and avoiding scams.

What a sales lead is, and qualifying leads

A sales lead is usually a contact who has shown some interest in what a business sells, or who fits the kind of customer it serves, together with the details held about them: a name, contact details, how and when the business came to hold those details, and what they asked about. Qualifying a lead simply means deciding, in a consistent way, whether it is worth pursuing and how: for example, whether the person has a real need the business can meet, whether they are able to buy, and when they are likely to decide. Whatever method is used, it helps to record for every lead where it came from and what the person agreed to, because the rules below depend heavily on consent, purpose and source.

Email and SMS: consent under the Spam Act

Commercial email and text messages are regulated by the Spam Act 2003, which is enforced by the Australian Communications and Media Authority (ACMA). The ACMA says express consent is best practice and can be given by filling in a form, ticking a box on a website, or over the phone or in person, and that you must keep a record of who gave consent, when and how. Inferred consent may apply where someone knowingly gave their address and would reasonably expect marketing through an ongoing relationship, but the ACMA says "Inferred consent is not as reliable as getting someone's express consent." You cannot ask for consent by electronic message, because the request is itself marketing, and "it's up to you to prove that you have a person's consent."

Email and SMS: identify yourself and let people unsubscribe

The ACMA says each message must accurately identify you or your business and include correct contact details, and if a third party sends it on your behalf, the message must still identify the business that authorised it. That information must remain correct for at least 30 days after the message is sent. Every commercial message must include a clear, free unsubscribe option that does not require extra personal information or an account, it must work for at least 30 days after sending, and requests must be honoured within 5 working days. Using or supplying address lists built with harvesting software, or the software itself, is prohibited, as is helping someone else break the rules.

Telemarketing and the Do Not Call Register

The Do Not Call Register is a free register, managed by the ACMA, where people and organisations can list Australian phone, mobile and fax numbers. Telemarketers can check, or "wash", their calling lists against it, and have 30 days to recognise a new registration. The register's official site says that any organisation that calls a listed number may be breaking the law, and that both the telemarketer and the business that commissions the call must comply. The ACMA lists exempt callers, such as government bodies, registered charities and registered political parties, but says exempt callers must still follow the other rules for calls. business.gov.au notes that if you call a number on the register, you may have to pay a fine.

Calling hours and conduct on calls

The Telecommunications (Telemarketing and Research Calls) Industry Standard 2017 sets rules for how calls are made, whether or not a number is on the register. The ACMA states that telemarketers may call Monday to Friday from 9am to 8pm and Saturday from 9am to 5pm, not on Sunday, and not on national public holidays; research calls have different permitted hours, set out on the same page. Callers must give their name, their employer's name and, if calling for someone else, that business's name; say why they are calling; end the call if asked or if the person indicates they do not want to continue; and display caller ID with a return number.

Door-to-door and phone sales to consumers

Under the Australian Consumer Law, a sale to a consumer made by phone, at their door or in a public place after an uninvited approach can be an unsolicited consumer agreement. The ACCC says this includes follow-up contact after a consumer gave their details for a different purpose, such as a competition entry, and that the rules do not apply to agreements worth less than $100. Door-to-door visits are allowed on weekdays from 9am to 6pm and Saturdays from 9am to 5pm. Sellers must identify themselves, the business and the reason for contact, leave or end the call when asked, and give a written agreement. Consumers have a 10 business day cooling-off period, extended to 3 or 6 months in some cases of non-compliance, and during it payment generally cannot be taken. The ACCC also notes that uninvited sales of financial products, such as insurance, are generally not permitted.

Collecting lead data: privacy and collection notices

The Privacy Act 1988 and its 13 Australian Privacy Principles (APPs) apply to businesses with an annual turnover of more than $3 million, and to some smaller businesses, including those that buy or sell personal information. Under APP 5, the OAIC says a business must tell people certain things "at or before the time" it collects their personal information, or as soon as practicable afterwards: who it is and how to contact it, the circumstances of collection, why it is collecting the information, the consequences if it is not collected, who it usually discloses that kind of information to, how to access, correct or complain, and whether it is likely to disclose the information overseas. These obligations also apply when information is collected from a third party, such as a lead supplier.

Direct marketing under APP 7 and bought lead lists

APP 7 governs using or disclosing personal information for direct marketing. The OAIC says sensitive information can only be used for direct marketing with consent, and other information may be used where the person would reasonably expect it or has consented. For information obtained from a third party, the APP guidelines say direct marketing is allowed only if the person has consented or it is impracticable to get consent, and a business "is not excused from obtaining consent by reason only that it would be inconvenient". Each message must include a simple, free way to opt out, opt-outs should generally be actioned within 30 days, and on request a business must tell the person where it got their information. Email and SMS covered by the Spam Act, and calls covered by the Do Not Call Register Act, are generally outside APP 7, but the OAIC suggests following APP 7 as good practice for all direct marketing.

Misleading conduct in sales and advertising

The ACCC says claims made in advertising and sales "must be accurate, truthful and based on reasonable grounds", and that "It makes no difference whether a business intends to mislead or not." A statement that creates a false overall impression can break the law even if each word is accurate, fine print must not conflict with the overall message, and "A business must be able to prove any claim they advertise." Claims about the future need reasonable grounds at the time they are made. The ACCC also warns against claims about stock, delivery times or consumer rights that are not true. Anyone can report a false or misleading claim to the ACCC.

Buying leads from a lead-generation company

Buying leads is a business-to-business purchase, so it is worth having the terms in writing. business.gov.au says it is "much safer to have your contract in writing than to rely on someone's word", that once you sign a contract it is legally binding, and that you can negotiate even standard form contracts. The ACCC says unfair terms in standard form contracts are banned, with penalties, and that from 9 November 2023 small businesses with fewer than 100 employees or less than $10 million in annual turnover are covered for new or varied contracts. Ask the supplier how each lead was collected and what the person agreed to, because the Spam Act, the Do Not Call Register and APP 7 consent rules still apply to you. In July 2026 the ACCC said that unless the purpose of data collection to generate a sales contact is clearly disclosed, "a sale remains unsolicited", while noting that view has not been tested.

Keeping lead and CRM data secure

Lead records and customer relationship management (CRM) systems hold names, contact details and notes that are personal information. business.gov.au says you may be legally responsible for protecting customers' personal information, and "When you no longer need your customers' personal information, you must destroy or de-identify it." Under the Notifiable Data Breaches scheme, a breach likely to cause serious harm must be notified to affected people and the OAIC. The Australian Cyber Security Centre's small business guide starts with turning on multi-factor authentication, updating software and backing up information, and recommends ensuring "each user can access only what they need for their role", using unique passwords stored in a password manager, limiting shared accounts and planning for incidents.

Scams that target businesses

Scamwatch warns that small businesses are targeted with false invoices and requests for "payment for directory listings, advertising and domain name renewals you didn't order", and with offers that look like a great deal for the business but are not. In business email compromise, or payment redirection, scams, criminals pose as a supplier and send an invoice with changed bank details; Scamwatch advises "Stop and check any changes to payee information on invoices" and calling the business on a number you found independently. The ACSC guide suggests a formal process for staff to follow when payment requests are received or bank details change. Be cautious of unsolicited offers of leads, listings or advertising, check invoices against written orders, and report scams to Scamwatch.

Directory

Official Australian sources on spam, telemarketing, privacy, consumer law, contracts, cyber security and scams, instead of a list of lead-generation companies, list brokers or software. Each entry was checked against its own official website.

What is listed. Only government bodies and official government services whose page could be fetched and checked are included, and each link goes to that body's own page. The list is not complete and is in no particular order. No lead-generation companies, list brokers, CRMs, software or marketing services are listed.

Not an endorsement. Listing is not a recommendation. This page is not affiliated with any organisation below and does not review, rank or recommend any product, service or provider.

Inclusion in this directory is not an endorsement. Links are to official websites as published at the time of checking.

Questions to ask before contacting or buying leads

Plain questions worth answering internally, and putting to any lead supplier, before you email, text, call or visit a lead.

Do we have a record of each person's consent: who gave it, when and how?

Under the Spam Act it is up to the sender to prove consent. A record made at the time is far easier to rely on than a supplier's general assurance.

Does every email and SMS identify our business and include a working unsubscribe?

Sender details and the unsubscribe must stay valid for at least 30 days, and unsubscribe requests must be honoured within 5 working days.

Have our calling lists been washed against the Do Not Call Register?

Unless an exemption or consent applies, listed numbers should not be called, and both the caller and the business that commissions the calls must comply.

Do our callers and door-to-door staff know the hours and what they must disclose?

Check the permitted hours on the ACMA and ACCC pages, and that staff give their name, the business and the reason for contact, and stop when asked.

If we sell to consumers on an uninvited approach, do we follow the unsolicited agreement rules?

Written agreements, cooling-off rights and limits on supply and payment apply, and breaches can extend the cooling-off period to months.

Does the Privacy Act apply to us, and what does our collection notice say?

Businesses that buy or sell personal information can be covered regardless of size. Collection notices apply even when information comes from a third party.

How did the lead supplier collect each lead, and what were people told?

Ask for the wording people saw and agreed to. The ACCC has said that unless the sales purpose is clearly disclosed, a resulting sale remains unsolicited.

Does the lead supply contract contain terms we could not negotiate?

Read the whole contract, check price, length, refunds for bad leads and termination, and seek advice. Unfair terms in standard form contracts are banned.

Can we back up every claim our sales scripts and ads make?

The ACCC says a business must be able to prove any claim it advertises, and intent to mislead is not required for a breach.

Who can access our lead and CRM data, and is multi-factor authentication on?

Limit access to what each role needs, use unique passwords, back up, and delete or de-identify information you no longer need.

How do we check an unexpected invoice or a change of bank details?

Verify using contact details you found independently, not those in the email, and keep written records of what was ordered and by whom.

About this page

saleslead.com.au is a free, non-commercial reference page published by Radiant Life Distributors Pty Ltd, Adelaide. It is general information only, not legal, privacy, marketing compliance or cyber security advice. It sells nothing, does not review, rank or recommend any lead-generation company, list broker, CRM, software or marketing service, and makes no claims about results. It is not affiliated with, or endorsed by, any organisation listed; listing is not an endorsement. Information was checked against official websites in October 2026; law and guidance change, so confirm current details with the organisations linked above.