Who is responsible
Your brokerage decides why and how buyers’ and owners’ data is used, so it is the data fiduciary. Software providers that process data on your behalf, such as your CRM, are data processors working under your instructions.
The core duties
In short: tell people what you collect and why, have a lawful basis (usually consent or the enquiry itself), keep data safe, keep it only as long as needed, and respond when people ask about their data.
- Give a clear notice when you collect data, in a language the person understands.
- Record consent — what, when, on which notice — and make withdrawal as easy as giving it.
- Let people access, correct and erase their data, and nominate someone.
- Protect data with reasonable security and report breaches.
- Delete data you no longer need, unless the law requires you to keep it.
Where brokerages usually slip
Spreadsheets shared on WhatsApp, agents keeping client lists on personal phones, exports nobody tracks, and old leads kept forever. Each of these makes it hard to answer a rights request — or to know what leaked when someone leaves.
A checklist you can act on
- Put a versioned notice on every form and landing page; store which version each lead saw.
- Keep a consent ledger with proof and withdrawals across channels.
- Mask phone numbers by role and audit every reveal and export.
- Set retention rules — for example, purge junk leads after a few months.
- Have a rights-request process with identity verification and a clock.
- Offboard staff in one step: reassign their leads and revoke devices.
- Sign a data processing agreement with every processor you use.
A note on legal advice
This guide is a practical summary, not legal advice. Read the Act and Rules or ask a lawyer about your specific situation, especially if you handle large volumes or sensitive documents.
Written by the PropZolo team. General information, not legal or tax advice.