Real estate — GDPR: minimising and securing files

What does GDPR cover?

The GDPR mandates data minimisation: collect only the data that is necessary. In real estate, the list of documents that may be requested from applicants is additionally governed by law. Files (leases, rent receipts, disputes) generate long-term processing activities that must be kept under control.

Unsuccessful applications cannot be retained without a legal basis.

Is the 'Real Estate' sector affected?

Agencies, property managers, social landlords, developers and platforms are data controllers. Service providers (management software, rental platforms) are data processors.

Candidates and tenants benefit from information rights and data subject rights.

Detailed obligations

Sanctions & risks

Fines of up to €20M or 4% of global turnover. The collection of unauthorised documents is a frequent and sanctioned breach.

Common mistakes in the sector

• 1Excessive documents. Requiring unauthorised supporting documents.
• 2Indefinite retention. Keeping applications without time limits.
• 3Unsecured documents. Storing identity documents without protection.
• 4Missing information. Not informing candidates.

Practical case

An agency was requesting unauthorised documents and retaining all files without any time limit. The remediation restricts documents to those permitted, defines retention periods and secures the files.

Compliance roadmap

1. 1

   Audit the records. Checking the list of required supporting documents.

2. 2

   Minimise. Minimise data collected.

3. 3

   Durations. Defining by file type.

4. 4

   Secure. Protect documents.

5. 5

   Inform. Update privacy notices.

Frequently asked questions