GDPR for Real Estate Professionals

Who is the controller

The agency is normally the data controller. Self-employed agents may be joint controllers with the agency depending on the contract.

Information notices

Clients must receive a layered privacy notice covering identity, purposes, legal bases, recipients, retention and rights, with the AML purpose clearly identified.

Lawful basis

AML processing relies on legal obligation. Marketing and CRM activities require consent or legitimate interest with a balancing test.

Records of processing

Maintain a register of processing activities including KYC, marketing, video surveillance, web analytics and HR.

Vendor management

Sign processor agreements with CRMs, KYC vendors, signature platforms and cloud storage providers. Verify international transfer safeguards.