Personal Data Protection: A Client Data Checklist for Property Agents
Data breach notification and data protection officer requirements under the Personal Data Protection (Amendment) Act 2024 took effect on 1 June 2025. Agents handle IDs, payslips and bank details daily; even if they do not reach the threshold for appointing a DPO, they should set rules for collecting, storing and deleting data.
Key requirements
DLA Piper summarised the Commissioner's guidelines on 4 March 2025: from 1 June 2025, a breach that causes or is likely to cause significant harm must be reported to the Commissioner within 72 hours, and affected individuals notified within 7 days of notifying the Commissioner; a breach affecting more than 1,000 people is of 'significant scale'. Controllers processing personal data of more than 20,000 people, sensitive data (including financial data) of more than 10,000 people, or carrying out regular and systematic monitoring must appoint a DPO and notify the Commissioner within 21 days of appointment.
Agent insight: five everyday rules
This is agent analysis. 1) Collect only what is needed now; a viewing does not need an ID copy. 2) Do not forward clients' IDs, payslips or bank details in group chats. 3) Store files in password-protected company systems, not personal phone galleries. 4) Delete or archive after a deal under company rules. 5) Report any suspected leak to the firm immediately.
AI tools and client data
When using AI to summarise client needs or draft follow-ups, remove names, ID numbers, phone numbers and bank details first. Firms should specify which tools may be used and which data must not be uploaded.
FAQ
Do small agencies need a DPO?
It depends on whether data volumes and types reach the guideline thresholds. Firms should confirm against the Commissioner's guidelines or with legal advisers.
Can clients ask for their data to be deleted?
Firms should have a process for client requests and keep necessary records under the law and contracts.
An agent’s follow-up message
To protect your personal data, I will only ask for your ID or income documents when needed, store files in the company system and never forward them in group chats; after the deal they will be handled under company rules. Ask me anytime if you have questions.