GDPR and AI for letting agencies: what to check
Tenant data is personal data. Five questions to ask any software that uses AI on it, including us.
Key takeaways
- Software handling tenant data needs an Article 28 processing agreement.
- Ask where data is stored and whether it trains AI models.
- The EU AI Act asks assistants to say they are an AI.
Start with the processing agreement
Under the GDPR (AVG in Dutch), software that handles tenant data on your behalf is a processor. You need a data processing agreement (Article 28) that says what it may do with the data, where it is stored and who else is involved.
Five questions to ask
- Where is the data stored and processed? Is it inside the EU?
- Is our data used to train AI models? (It should not be.)
- Who can see what? Is there role-based access?
- Is every action logged, so we can show who did what?
- Does the assistant tell tenants it is an AI?
The EU AI Act
The EU AI Act adds transparency rules: people should know when they are talking to an AI system. For agencies that means an assistant answering tenants has to say what it is.
Our answers
Sargo is built under the GDPR with a processing agreement for every agency, role-based access and a full audit log. We do not train AI models on your data, and the assistant always identifies itself. You can read the details on our GDPR page.
Questions and answers
Do letting agencies need a data processing agreement for software?
Yes. Software that handles tenant data on your behalf is a processor under the GDPR, so you need an Article 28 data processing agreement.
Is tenant data used to train AI models?
It should not be. Ask your supplier in writing. Sargo does not train AI models on your data.
Sargo reads the message, finds the clause and prepares the decision. Your team approves.
This article is general information, not legal advice. Rules change; check the current law or ask an adviser for your situation.
