Regulation4 min read
GDPR in rental management: the professional's checklist
Record of processing, minimisation, retention periods, individuals' rights, processors: the points to check when processing rental data.
The homePad team
A rental application file, a lease, an inspection report and its photos, a repair request: property management rests on personal data. In the European Union, the General Data Protection Regulation (GDPR) applies to every professional who processes it. This checklist suggests an order of work. It is a practical guide, not legal advice: for a particular situation, contact your data protection authority or a legal adviser.
List the processing activities and keep the record
Start with the list of what you do with data: selection of applicants, lease management, inspection reports, repairs, accounting, prospecting. For each of them, the record of processing activities states its purpose, the categories of individuals and of data concerned, the recipients, the retention period and the security measures. An agency or a property management firm processes this data on a regular basis: the record must therefore be kept, whatever the size of the organisation.
- each processing activity has a written purpose and a legal basis, most often the performance of the contract or a legal obligation, sometimes legitimate interest, more rarely consent
- one person is in charge of the record and updates it with each new tool
Collect less, keep it for less time
The principle of data minimisation forbids asking for a piece of data “just in case”. In France, the list of supporting documents a landlord may require from a prospective tenant and from their guarantor is set by a decree of 5 November 2015: no other document may be demanded.
The GDPR sets no period in figures. It requires that data not be kept longer than the purpose demands. It is up to you to set a period for each category, to write it down and above all to apply it.
- the photos in an inspection report show the home and its defects, not the occupants, their papers or their personal belongings
- free-text comments contain neither judgements about people nor information about their health, their opinions or their origin
- the files of unsuccessful applicants are deleted once the tenancy has been awarded
- the data of a lease is kept for its duration, then archived with restricted access for as long as a possible dispute or a legal obligation requires
- a purge takes place on a fixed date, messaging services and phones included
Inform individuals and respond to their requests
At the time of collection, each individual must know who is processing their data, for what purpose, on what basis, who receives it, how long it is kept and how to exercise their rights. These rights are access, rectification, erasure, restriction, objection and portability. You have, as a rule, one month to respond to a request.
- a privacy notice appears on forms, leases, inspection reports and the website
- a contact address is reserved for these requests and someone checks it
- a procedure states who responds and how the requester's identity is verified
Secure the data and oversee your processors
Security is decided on field devices as much as on servers: locked tablets and phones, individual accounts, access rights limited to what each person needs, backups. Any service provider that processes data on your behalf, whether a software vendor, a hosting provider or a call centre, is a processor within the meaning of the GDPR. A contract must provide that it acts only on your instructions and specify the security measures, the use of other processors and what happens to the data at the end of the contract.
- a data processing agreement is signed with each provider and the place where the data is hosted is known
- staff accounts are closed on the day they leave
- every data breach is recorded and, if it presents a risk to individuals, notified to the supervisory authority no later than 72 hours after it is discovered
- staff are trained when they join, then regularly
Know when to go further
A data protection impact assessment is required before launching processing likely to result in a high risk to individuals. In France, the CNIL (the French data protection authority) publishes the list of the types of processing for which it is required: check whether yours are on it. Appointing a data protection officer is mandatory only in certain cases, in particular for public bodies and for organisations whose core activity is the regular and systematic monitoring of individuals on a large scale, or the large-scale processing of sensitive data. In the other cases, appoint at least a lead contact.
Administrative fines can reach 20 million euros or 4% of worldwide annual turnover, whichever is higher.
The GDPR applies in France, Belgium and Luxembourg, each of these countries having its own supervisory authority and additional national rules. Switzerland has its own Federal Act on Data Protection. Check locally which framework applies.
What homePad brings
homePad hosts its clients' data in Europe. Reports, their time-stamped photos and their electronic signatures are centralised on a single platform, which avoids scattering them across phones, messaging services and shared folders.
- GDPR
- personal data
- rental management
- compliance