Since the GDPR's entry into force, 82 fines related to the Real Estate sector (+15 in comparison to the 2025 ETR) have been imposed on data controllers. Insofar as the amounts of the fines were published, those fines as of now amount to slightly over EUR 3 million (an increase of roughly EUR 200k in comparison to the 2025 ETR). Both the absolute amount of fines and the individual fines remain low in comparison to other sectors.
The increase in comparison to the 2025 ETR is mostly owed to two fines issued by the Italian Data Protection Authority (Garante) of EUR 100k and EUR 40k for insufficient fulfilment of information obligations and non-compliance with essential data processing principles. Fines have been issued by DPAs from 13 different countries, mostly to homeowner associations and real estate management companies.
Roughly 35% of fines in the Real Estate sector – 30 out of 85 – have been issued for non-compliance with general data processing principles, with an insufficient legal basis for data processing being in close second place at 31% (27 out of 85 fines).
Key numbers
Let's take a closer look
- The majority of published fines in this sector range from EUR 500 to EUR 50,000. This is mainly due to the structure of data controllers fined in the Real Estate sector, as most are comparatively small businesses or homeowner associations.
- A substantial fine of EUR 14.5 million initially issued by the DPA of Berlin to a property company for the indiscriminate and unlimited retention of personal data (including sensitive data such as tax, social security and health insurance data), which would have significantly boosted the total amount of fines in the Real Estate sector, has been overturned and the court process in this regard is ongoing (ETid-98, ETid-99).
- Issues connected to the direct marketing activities of real estate businesses are becoming increasingly relevant to Data Protection Authorities. Since the 2025 version of the ETR, 7 fines have been issued for non-compliant direct marketing activities – accounting for nearly half of all new fines issued since then.
Main takeaways
Compliance hotspots
- The topic of video surveillance in particular continues to dominate GDPR fines in the Real Estate sector. The widespread use of CCTV systems in residential buildings and properties entails a variety of risks regarding data protection. In some cases, data subjects have not been informed of the surveillance measures or (e.g. in the case of ETid-1523) the provided information did not meet the requirements of Art. 13 GDPR. Furthermore, there usually is no justification for CCTV systems to record audio and thereby potentially tenants’ and visitors' conversations. Data controllers also need to ensure that the data collected by the CCTV system is sufficiently secured against unauthorised access and they may not actively publish data themselves. Perhaps most relevant, data controllers must be careful with placement of cameras: A significant share of fines in the context of CCTV surveillance were issued because cameras would capture images of public property such as public streets or walkways or common areas of private property (e.g. ETid-2163 or ETid-2395) or even the inside of private apartments if the resident opened the door as in the cases of ETid-486 and ETid-1627.
- In many cases, it is an established practice to publish documents on noticeboards accessible to the public or at least to anyone within the building, e.g. to inform owners and renters of developments and relevant dates of interest for the whole property, such as scheduled maintenance work. Recently, however, there have been cases where homeowner associations published enforcement notices containing personal data of property owners on such noticeboards (see ETid-2010 or ETid-2162). On a similar note, fines have been issued for the unauthorised public display of pictures of properties that also included individual persons without their approval (see ETid-1971 and ETid-1998) on the controllers' websites for marketing purposes. These fines highlight the importance of adherence to general data processing principles regarding any information made publicly available. This is of particular relevance for the Real Estate sector, where there is a regular need to publish certain information, for example in the form of notices on noticeboards or the publication of photographs of buildings and apartments as part of advertisements for the lease of such buildings or apartments.
Outlook
The Real Estate sector has so far been rather consistent with regard to which areas are of particular interest to Data Protection Authorities. Due to the large amount of personal data processed by real estate companies, particularly data relating to tenants, owners and visitors, AI may be of some interest to them. We expect Data Protection Authorities to be on the lookout for non-compliance with regard to the use of AI (e.g. preselection of potential tenants, surveillance of buildings, predictive maintenance). Nonetheless, the topics of video surveillance and public communication via noticeboards etc. will remain relevant and should remain a focus for companies to ensure compliance with data protection requirements.
