Construction sector compliance: GDPR, Data Act & AI Act

Why the 'Construction' sector is in scope

The construction sector employs a large and mobile workforce, with badge readers, time-tracking systems, and sometimes geolocation of machinery or personnel. These GDPR processing activities call for proportionality, information notices, and controlled retention periods, with employee geolocation being particularly sensitive.

Cascading subcontracting, characteristic of the sector, multiplies data exchanges (employees, certificates) and requires clarifying roles and governing data flows.

Digitalisation (BIM digital modelling, connected equipment and tools) generates data to which the Data Act facilitates access for the operator. AI applications (planning, site safety) remain emerging and most often fall under limited risk.

GDPR — employees, subcontracting, construction sites

Construction companies act as data controllers for employee, subcontractor, and site data (badge access, time tracking, equipment geolocation). They must apply data minimisation and provide appropriate notices, govern geolocation practices, and secure data exchanges within cascaded subcontracting arrangements.

Key obligations

• Proportionality and information (badge readers, time tracking).
• Framework for geolocation of equipment and personnel.
• Clarification of data flows in subcontracting.
• Security and retention periods.

Data Act — connected machinery and BIM

Connected machinery, tools and sensors, along with digital twin (BIM) data, generate data to which the Data Act facilitates access for the operator and sharing with designated third parties. This is a matter of independence from equipment manufacturers.

Key obligations

• Operator access to data from connected machinery.
• Sharing with designated third parties.
• Accounting for data from the digital building model.
• Revision of service contracts.

AI Act — emerging use cases

AI use cases in construction (planning, safety risk detection, quality control) are emerging and most often fall under limited risk. A use case constituting a safety component of equipment could fall under high risk.

Key obligations

• Classify AI uses (often limited risk).
• Check the possible role of a security component.
• Transparency where applicable.

Comparative overview of regulations

How these regulations interact

GDPR is central: large workforce, time-tracking, geolocation and cascading subcontracting. The proportionality of geolocation and the security of inter-company data flows are the key challenges.

The Data Act and AI primarily come into play on the equipment and digital twin side: access to connected machinery data (operator independence) and AI uses that are generally of limited risk.

Application timeline

• 1GDPR. In force; geolocation vigilance.
• 2Data Act. From 12 September 2025 for connected devices.
• 3AI Act. Prohibitions since February 2025; high-risk depending on the equipment.

Applicable penalties

GDPR up to €20 M or 4%. Data Act: national sanctions. Disproportionate geolocation of staff and insecure data exchanges in subcontracting arrangements are the most concrete risks.

Compliance roadmap

• 1Map. Inventorying employees, subcontractors, time-tracking, geolocation.
• 2Proportionate geolocation use. Limit and inform on the location of machinery and personnel.
• 3Securing subcontracting. Clarify roles and secure cascading data flows.
• 4Opening machine data. Implement Data Act access rights for the operator.
• 5Steer. Register, security and periodic review.

How Data Comply One supports the sector

Data Comply One covers GDPR, AI Act, NIS2 and DORA on a single platform, with outsourced DPO and CISO, and supports the construction sector on time-tracking, geolocation, subcontracting and access to data from connected machinery.

DCO offers tailored templates (register, geolocation framework, data processing clauses).

Frequently asked questions