Real Estate Agencies and the GDPR Duty to Inform Data Subjects

Real estate agencies process a large amount of personal data: names, contact details, identity documents, financial information, property preferences and sometimes employment or solvency information. For that reason, the duty to inform data subjects is especially important.

The Spanish Data Protection Authority has sanctioned real estate agencies for failing to properly inform people about the processing of their personal data. The issue is not merely formal: people must know who processes their data, for what purpose and how they can exercise their rights.

What information must be provided?

Under the GDPR, the controller must provide clear information about the identity of the controller, purposes of processing, lawful basis, recipients, retention period and data subject rights. This information should be available when the data is collected, not only after a complaint.

Common mistakes in real estate activity

• Collecting data through forms without a privacy notice.
• Requesting identity or financial documents too early.
• Using client data for marketing without a proper basis.
• Sharing data with owners, agencies or platforms without clarity.
• Keeping data indefinitely after the transaction ends.

How to comply in practice

• Use clear privacy notices on forms, websites and email processes.
• Limit documents requested to what is necessary at each stage.
• Define retention periods for prospects, tenants, buyers and owners.
• Document relationships with portals, CRM providers and external advisers.
• Train staff who collect data by phone, email or in person.

Why this matters

Real estate agencies often work quickly and collect information through many channels. Without a clear process, data protection failures become easy: WhatsApp messages, emails, printed forms, CRM entries and shared files may all contain personal data.

Conclusion

Informing data subjects is one of the most basic GDPR obligations, but it must be done properly. For real estate agencies, clear notices, minimisation and internal procedures reduce risk and improve trust with clients.