A teaser for a residential block arrives with the rent roll attached: forty tenants, names, unit numbers, rent, arrears and lease expiry. The sender is an intermediary in another country and the investor reading it sits in Dubai or New York. Nobody in that chain has asked whether the forty tenants are part of the asset. They are not. They are data subjects, and everyone who opened the file took on obligations under the General Data Protection Regulation.
The market treats the GDPR as a matter for the website privacy notice. In a transaction it governs the documents themselves: the teaser, the data room, the adviser in Singapore who reads it, and what everyone deletes at the end. Privacy for a family with assets in several countries has been treated elsewhere from the owner’s side; this article follows the documents.
What is personal data in a property transaction
Article 4(1) of the Regulation defines personal data as any information relating to an identified or identifiable natural person. In a commercial deal there is more of it than the parties assume: a private seller’s name and bank details, the beneficial owner of the selling company in the KYC file, every tenant in a residential rent roll with rent as an indicator of income and arrears as an indicator of difficulty, the guarantors behind retail leases, the staff of a hotel whose payroll sits in the data room because the buyer wants the wage bill.
Corporate data is outside the definition: a logistics park with a single corporate tenant carries almost nothing, a block of flats carries everything.
One category is stricter. Article 9(1) prohibits processing data revealing health unless an exception applies. A care home’s occupancy list will in most cases reveal the residents’ state of health. The operator processes it under article 9(2)(h), for the provision of care. The buyer of the building has no such basis, and a legitimate interest under article 6 does not supply one: article 9 requires its own exception. It needs the occupancy rate, not the residents’ names, and a data room that contains them has already gone wrong.
The legal basis: legitimate interest, not consent
Every disclosure needs a legal basis under article 6. The one that fits is article 6(1)(f): processing necessary for the legitimate interests of the controller or a third party, unless overridden by the interests or fundamental rights of the data subject. The seller has an interest in selling, the buyer in knowing what it buys, and a lease cannot be verified without reading it.
The European Data Protection Board’s Guidelines 1/2024 of 8 October 2024 set out three cumulative conditions: a legitimate interest; necessity, so that a less intrusive route would not do; and a balance against the rights of the people concerned, judged among other things by what they would reasonably expect. A tenant expects his building to change hands and the new owner to know his rent. He does not expect his name to circulate among twenty buyers who will never bid, or to reach an intermediary with no mandate.
Consent is not the answer. Asking forty tenants is impractical, invites refusal from a few and alerts the market to a sale, and consent withdrawn mid-process leaves a hole in the data room. Legitimate interest, applied with the minimization described below, is the basis the European market relies on.
Roles: who is controller and who is processor
Article 4(7) defines the controller as the party that determines the purposes and means of processing; article 4(8) defines the processor as the party that processes on the controller’s behalf. The seller is controller of its tenants’ and employees’ data. Its agent is usually a processor, although an agent who decides which buyers to approach and what to send them is taking controller decisions. The buyer becomes a controller the moment it receives the data room, because it uses the data for its own purposes.
The data room platform is a processor for whoever opens the room. Article 28(3) requires a contract, and the platform’s terms are that contract: where the servers sit, who has access, what is logged, what happens on closure. A provider hosting the room outside the EEA turns the seller into a data exporter before the first buyer logs in.
The buyer’s advisers are its processors. The valuer, the lawyer who reviews the leases, the consultant who sees the staff list: each needs an engagement letter containing the article 28(3) terms; a confidentiality clause alone does not meet them. Where the buyer is a club, each member reading the room is a controller in its own right.
Transfers outside the European Economic Area
Chapter V applies once a reader sits outside the EEA. Article 44 permits a transfer, and any onward transfer, only if the conditions of that chapter are met. Article 45(1) allows it without further authorization where the Commission has adopted an adequacy decision. The Commission’s list today includes the United Kingdom, renewed in December 2025, Switzerland, Japan, the Republic of Korea, Israel and Canada for commercial organizations. For the United States, Implementing Decision (EU) 2023/1795 of 10 July 2023 recognizes adequacy for commercial organizations certified under the EU-US Data Privacy Framework; a US investor that has not certified is not covered.
Singapore, the United Arab Emirates, Saudi Arabia and Qatar are not on the list. A seller opening a data room to a Gulf family office buying European property or to a Singapore fund needs a safeguard under article 46. The usual one is article 46(2)(c), the standard contractual clauses of Implementing Decision (EU) 2021/914 of 4 June 2021, in four modules according to whether exporter and importer are controllers or processors. Seller to foreign buyer is module one, controller to controller. The clauses are signed before access is granted.
Article 49 offers derogations for specific situations, among them a contract with the data subject, a contract in the data subject’s interest or legal claims. None fits a prospective buyer reading a rent roll. The clean solution is to minimize what crosses the border.
Minimization: the teaser, the rent roll and staged access
Article 5(1)(c) requires that personal data be adequate, relevant and limited to what is necessary. Applied honestly, this solves most of the problem. A teaser needs no personal data at all: location, size, use, occupancy, passing rent, lease profile and price guidance.
The rent roll can be anonymized for the first round: unit numbers, rent, indexation, lease dates, break options and arrears, with tenants identified by a code. Names and guarantor details go to the selected bidder in the second round, and payroll to the buyer of an operating hotel once exclusivity is signed. Staged access is also a commercial measure: it limits what each losing bidder walks away with.
Where the company rather than the building is sold, the room also holds the accounts and disputes that a share deal passes to the buyer, with their employees and claimants. The same staging applies.
The NDA as a data protection instrument
Most confidentiality agreements say nothing about personal data. A well drafted NDA does two jobs. On confidentiality, it defines the information, restricts its use to evaluating the transaction and limits the recipients. On data protection, it records that the recipient is a controller, will process the data only for the transaction, will share it only with named categories of advisers under equivalent terms, will apply the security required by article 32, and will delete or return it at the end.
Where the recipient is outside the EEA, the standard contractual clauses are annexed. Where it will use a foreign cloud or adviser, the NDA says so. A seller who signs an NDA silent on data has handed its tenants’ data to a stranger on trust. The NDA is also the place to prohibit forwarding. The clause allowing disclosure to unnamed “potential financing parties and co-investors” is how a rent roll reaches people the seller never knew existed.
When an intermediary forwards the teaser
Forwarding between intermediaries, described in how off-market deals actually reach an investor, is where control is lost. The intermediary who receives a file from the seller’s agent and sends it to five contacts has decided the purpose and means of that processing. It is a controller. It owes the data subjects a legal basis, which it lacks without a mandate, and information under articles 13 and 14, which it will never give; and it owes the seller nothing, because it signed nothing.
Article 83(5) sets the maximum fine for breaches of articles 5, 6 and 9, of data subject rights and of the transfer rules in articles 44 to 49 at EUR 20 million or 4 per cent of total worldwide annual turnover of the preceding year, whichever is higher. Article 83(4) caps breaches of duties such as security and processor contracts at EUR 10 million or 2 per cent. Such fines are not imposed for one forwarded rent roll, but a tenant who finds his arrears discussed by a fund abroad has a complaint any supervisory authority will take.
Forward teasers that contain no personal data. Never forward a rent roll, a lease or a payroll received from another party. Send the interested investor to the mandate holder, who opens the data room under its own NDA and transfer paperwork.
Security, retention and the end of the process
Article 32(1) requires measures appropriate to the risk. In a transaction the risks are known: an email that appears to come from the seller’s lawyer, a change of bank details the day before completion, a request to resend the data room link to a new address. So are the measures: no funds moved on an emailed instruction without a call to a known number, individual logins and no bulk download, documents shared through the room rather than as attachments, and a named person on each side who confirms any change of contact details. Article 33(1) requires a controller to notify its supervisory authority of a breach without undue delay and, where feasible, within 72 hours; a lost data room login can be such a breach.
Article 5(1)(e) limits storage to what the purpose requires. For losing bidders the purpose ends when they lose; access closes the same day and each confirms deletion in writing. For the buyer the tenants’ data becomes its own operating record from completion, with its own notice to the tenants. The seller archives the room only as far as warranty claims require.
Picture a listed vehicle selling residential blocks in three countries to a US fund, a Korean insurer and a Gulf family office. The sell side anonymizes the rent rolls for the first round, opens the second to two bidders under NDAs with the standard clauses annexed, checks that the US bidder is certified under the Data Privacy Framework and the Korean one covered by adequacy, and fixes a deletion date. It is one afternoon of drafting, and when the winner’s compliance team asks how the tenants’ data reached it, there is an answer.
This article is informational and does not constitute tax or legal advice. The treatment of any structure depends on its facts and on the law of each jurisdiction involved. Each engagement is subject to scope and applicable regulation.