Real estate sector compliance: GDPR & AI Act

Why the 'Real Estate' sector is concerned

The compilation of application files (rental, purchase) is the sensitive point: the law limits the supporting documents that can be required, and the GDPR mandates data minimisation. Collecting unauthorised documents is a frequent and sanctioned breach.

Rental management and customer relations generate long-term processing activities (leases, receipts, disputes) whose retention periods must be carefully managed.

Using a solvency scoring system for applicants implicates the AI Act: an automated assessment of the creditworthiness of natural persons may fall under the high-risk category, with significant non-discrimination requirements. Connected buildings (technical management), on the other hand, fall under the Data Act for the data they generate.

GDPR — records and supporting documents

Real estate professionals act as data controllers for applicant, tenant, and buyer files. The critical point is the limitation on supporting documents: only those that are authorised may be requested. Added to this are information obligations, security requirements, and appropriate retention periods.

Key obligations

• Strict limitation of supporting documents that can be required.
• Data minimisation and candidate information.
• Regulated retention periods for files.
• Data and document security.

AI Act — creditworthiness scoring

A tool that automatically assesses the creditworthiness of applicants may fall under the high-risk category within the meaning of the AI Act (assessment of the creditworthiness of natural persons). High-risk obligations then apply, with bias management being essential to prevent any discrimination in access to housing.

Key obligations

• Qualify credit scoring (potentially high risk).
• Bias control and non-discrimination.
• Human oversight and information.
• Alignment with GDPR (automated decision-making).

Comparative overview of regulations

How these regulations interact

Real estate illustrates the link between GDPR data minimisation and non-discrimination: requesting excessive documentation (GDPR) or automating a biased creditworthiness screening (AI Act) leads to the same risk — unfairly excluding housing applicants.

Creditworthiness scoring combines GDPR (automated decision-making, information, minimisation) and the AI Act (high risk, bias management, human oversight). Connected buildings add a Data Act layer for data generated by building management systems.

Application timeline

• 1GDPR. In force; controls on supporting documents.
• 2AI Act. High-risk: From 2 August 2026 for creditworthiness scoring.
• 3Data Act. From 12 September 2025 for data from connected devices.

Applicable penalties

GDPR up to €20M or 4%, AI Act up to €35M or 7%. The collection of unauthorised documents and discriminatory scoring are major risks, given the stakes around access to housing.

Compliance roadmap

• 1Limit attachments. Requiring only authorised supporting documents.
• 2Minimise and inform. Minimise data collected and inform applicants.
• 3Frame retention periods. Define retention periods for files, leases and unsuccessful applications.
• 4Govern scoring. Qualify and control the biases of any creditworthiness scoring system.
• 5Steer. Register, security and periodic review.

How Data Comply One supports the sector

Data Comply One covers GDPR and the AI Act on a single platform, with an outsourced DPO, and supports agencies, property managers and platforms on supporting documents, retention periods and any solvency scoring.

DCO provides tailored templates (list of permitted documents, candidate information, scoring framework).

Frequently asked questions