# How privacy law actually touches property data
A property manager in Austin exports a rent roll to email a lender. The spreadsheet has 140 rows: tenant names, Social Security numbers for background checks, monthly rent, late payment history, and notes like "disability accommodation, service animal approved." That single file, sitting in someone's Sent folder, touches at least three different legal regimes at once. Most landlords never think about it until a breach, a lawsuit, or an audit forces the question.
This lesson walks through that rent roll, field by field, to show exactly where the law attaches.
A rent roll (a property's master list of units, tenants, and rent status) is really a personal data inventory in disguise. Break it into columns and the regulatory picture gets clear fast:
Each column has a different regulator watching it. Treating the whole file as one undifferentiated "spreadsheet" is the first governance mistake.
The GDPR (General Data Protection Regulation, the EU's core privacy law, enforced by national Data Protection Authorities) applies when you process personal data of people in the EU, or when an EU-based fund or asset manager is the data controller for a portfolio.
Where this actually bites in real estate:
Under GDPR, tenants have a right to access their file, a right to erasure ("right to be forgotten"), and companies need a lawful basis (contract, legitimate interest, or consent) for every use of personal data. If a landlord keeps five years of a former tenant's payment history "just in case" with no retention policy, that is a GDPR violation if any EU nexus exists. Full text: GDPR official text via EUR-Lex.
The CCPA (California Consumer Privacy Act, amended by the CPRA, California Privacy Rights Act, enforced by the California Privacy Protection Agency) gives California residents rights to know, delete, and opt out of the sale or sharing of their personal data.
Real estate specific triggers:
CCPA applies based on business size and data volume thresholds (as of 2026, roughly: over $25 million in annual revenue, or handling data of 100,000+ consumers/households, or deriving 50%+ revenue from selling personal data; check current thresholds, they get inflation-adjusted). A single-owner duplex landlord is out of scope. A national multifamily REIT (Real Estate Investment Trust) running its own leasing app almost certainly is in scope.
Other US states now have their own laws worth knowing exist even if not detailed here: Virginia (VCDPA), Colorado (CPACPACost Per Acquisition: the total cost to generate one customer or conversion, computed by dividing total spend by the number of acquisitions.View full definition →), Connecticut (CTDPA). No single federal privacy law covers all of this yet, which is itself a governance risk: multi-state landlords must track a patchwork.
This is where real estate diverges sharply from other sectors. The Fair Housing Act (US federal law, enforced by HUD, the Department of Housing and Urban Development) makes it illegal to discriminate based on race, color, religion, sex, national origin, familial status, or disability, and critically, it restricts how you can use and store data that reveals those characteristics.
Concrete failure mode: a leasing agent's CRMCRMCustomer Relationship Management: software and strategy to manage and analyse customer interactions throughout their lifecycle.View full definition → (Customer Relationship ManagementCustomer Relationship ManagementCustomer Relationship Management: software and strategy to manage and analyse customer interactions throughout their lifecycle.View full definition → software) has a free-text notes field. An agent writes "family with young kids, might be noisy" or "wheelchair, needs ground floor." That note is now protected-class data sitting in a system with no access controls. If a rejected applicant later sues, that note becomes discovery evidence of discriminatory intent, whether or not discrimination actually occurred.
The data governancedata governanceData governance is the set of policies, roles, and processes that ensure data is accurate, secure, well-defined, and used responsibly across an organization.View full definition → lesson: protected-class information should never live in unstructured free text accessible to leasing staff making accept/reject decisions. Structured, access-controlled accommodation logs, reviewed only by compliance, are the safer pattern.
No invented numbers here, but the enforcement pattern is real and well documented:
The pattern across all three regimes is the same: the violation is rarely the initial data collection, it's the retention, the reuse, and the lack of access control afterward.
Knowledge check
1. Why does the lesson treat a rent roll as a 'data map' rather than a single undifferentiated spreadsheet?
2. Why are accommodation notes (e.g., 'disability accommodation, service animal approved') singled out as the most dangerous field in a rent roll?
3. A US-based landlord with no EU tenants leases a unit to an EU citizen who relocates to Austin for a US-based job. Under the lesson's framing, does GDPR likely apply to this tenant's data?
4. Select ALL correct answers about why a single rent roll file can trigger multiple, simultaneous legal regimes.
Select all the correct answers.
5. Select ALL correct answers about smart lock and keycard access logs in a rent roll.
Select all the correct answers.
A basic data governancedata governanceData governance is the set of policies, roles, and processes that ensure data is accurate, secure, well-defined, and used responsibly across an organization.View full definition → audit for a property portfolio should walk through:
1. Data inventory: what fields exist, in which systems (property management software, CRMCRMCustomer Relationship Management: software and strategy to manage and analyse customer interactions throughout their lifecycle.View full definition →, background check vendor, smart lock provider)?
2. Retention schedule: how long is former-tenant data kept, and is there a written policy? A common defensible pattern is deleting or anonymizing screening data 12 to 24 months after a lease ends, unless local law requires longer records.
3. Access control: who can see SSNs, accommodation notes, and payment history? Leasing agents rarely need SSN access; accounting rarely needs accommodation notes.
4. Vendor contracts: does your background-check vendor, smart-lock vendor, and leasing software have a Data Processing Agreement (DPA, a GDPR-required contract governing how a vendor handles data on your behalf) or equivalent CCPA service-provider terms?
5. Free-text field scan: search CRMCRMCustomer Relationship Management: software and strategy to manage and analyse customer interactions throughout their lifecycle.View full definition → and email systems for protected-class keywords (disability, pregnant, religion, national origin terms) in unstructured notes.
A simple technical check a data-literate ops person can run on an exported rent roll, in plain pseudocode:
for each record in rent_roll:
flag if SSN field is populated but not encrypted
flag if notes field contains protected-class keywords
flag if last_activity_date is >24 months old and record still retained
flag if record has no documented lawful basis / consent referenceThis is not a compliance guarantee, it is a triage tool to find where the real audit needs to focus.
GDPR Explained in Simple Terms