# AI, GDPR and the EU AI Act: a 10-point check for estate agents

> A practical 10-point check for estate agencies using AI with client data: GDPR, EU AI Act transparency, WhatsApp consent, the UK position and local regulators.

URL: https://www.formule.io/uk/blog/ai-gdpr-eu-ai-act-estate-agents
Language: en
Publisher: Formule (Formule Labs Limited)
Updated: 2026-10-20
Sources checked: 2026-10-20

An agency that uses AI with client data has two rulebooks to read: the GDPR, which has applied since 2018, and the EU AI Act, whose transparency rules started to apply on 2 August 2026. Most of the work is not legal drafting. It is ten checks you can run in an afternoon before you paste an enquiry into a chatbot, switch on an AI assistant or let a tool draft messages to buyers. This guide is an AI GDPR checklist for estate agents, with worked examples and a short section for each of six markets. It is general information, not legal advice. Before you rely on any point, check it with a data protection adviser or your regulator.

If you are still deciding which tasks to give AI at all, start with [AI for estate agents](https://www.formule.io/uk/blog/ai-for-estate-agents). This page assumes you have a task in mind and want to use it safely.

## The 10-point check before you use AI with client data

- **Name the task and the data.** Write one line: "Draft a reply to a buyer enquiry, using their name, phone number and the property they asked about." If you cannot say what personal data goes in, you cannot check anything else.

- **Choose a lawful basis.** Under GDPR Article 6 you need a legal reason for each use. Answering an enquiry someone sent you usually rests on taking steps at their request or on your legitimate interest in replying. Marketing to old contacts needs a separate look (point 7). Write the basis next to the task, so the choice is deliberate.

- **Update your privacy notice.** Articles 13 and 14 require you to tell people what you do with their data and who receives it. If AI tools process enquiries, your notice should say so in plain words, including which kinds of provider receive the data.

- **Sign a processor agreement with the AI vendor.** When a vendor processes personal data for you, GDPR Article 28 requires a written contract that sets out what it may do with the data. Ask for the data processing agreement before you upload anything real. Check which sub-processors it uses, such as the companies that supply the underlying AI models. A personal chatbot login is no substitute, because no contract covers client data.

- **Check where the data travels.** Many AI services run on servers outside the EU or UK. GDPR Chapter V allows such transfers only with a valid mechanism, for example an adequacy decision or standard contractual clauses. Ask the vendor which countries process the data and which mechanism covers it.

- **Send less data.** Data minimisation (Article 5(1)(c)) means the tool receives only what the task needs. To draft a viewing confirmation, the AI needs a first name, the address and a time. It does not need the buyer's income, ID number or health remarks from your notes. Strip those before you paste, or keep them in a field the tool cannot read.

- **Keep marketing consent separate.** Sending promotional messages by email, SMS or messaging apps is governed by the ePrivacy rules (Directive 2002/58/EC) as implemented in each country, on top of the GDPR. In the UK these are the PECR rules, and the ICO's guidance says the electronic mail marketing rules apply to direct messages on social media or any similar message stored electronically. It also says you must not send marketing emails or texts to individuals without specific consent, and that the "soft opt-in" for existing customers does not cover new contacts or bought-in lists. A buyer who messages you on WhatsApp about one flat has not agreed to a monthly newsletter, whether a person or an AI wrote it.

- **Set a retention period.** Storage limitation (Article 5(1)(e)) means you do not keep identifiable data longer than needed. Decide how long AI-generated drafts, chat histories and enquiry data live, and delete them on schedule. Ask the vendor how long it keeps your inputs and whether it can delete them on request.

- **Be ready for rights requests.** People can ask for access, correction, deletion and objection. If client data sits in an AI tool, you must be able to find it and act. Test it once with a dummy contact. Also remember Article 22: a decision made solely by automated means that significantly affects someone, such as automatically rejecting a tenant, carries extra restrictions. Keep a person in that loop.

- **Put a human in charge and train them.** The agent reads and approves what goes out, and one named person owns the AI policy and trains the team. The EU AI Act adds a related duty on AI literacy in Article 4, covered next.

## What the EU AI Act asks of an agency

The AI Act (Regulation (EU) 2024/1689) mostly regulates the companies that build AI systems. An estate agency that uses an off-the-shelf tool is a "deployer", and the duties are lighter. The European Commission's service desk lists the dates: AI literacy and the prohibitions applied from 2 February 2025, the Article 50 transparency rules from 2 August 2026, and a transition to 2 December 2026 for certain providers whose systems generating synthetic content were already on the market. The Digital Omnibus on AI, in force since 27 July 2026 according to the Commission, moved the high-risk rules for Annex III systems to 2 December 2027. It did not move the Article 50 start date of 2 August 2026. The dates are amended from time to time, so confirm them on the Commission's AI Act page before you rely on one.

- **Article 4, AI literacy.** Providers and deployers must take measures to support the AI literacy of their staff and others using AI systems on their behalf, taking account of their knowledge, experience and the context. The amended text adds that this does not require guaranteeing a specific level of literacy for any individual. In practice: a short written rule on what staff may paste into AI tools, plus a record that you walked the team through it.

- **Article 50, transparency.** Systems meant to interact directly with people must be designed so that people are informed they are dealing with AI, unless that is obvious. That duty sits mainly with the provider, but an agency that puts a chatbot on its website or WhatsApp line should check that the disclosure appears. Deployers of systems that generate or manipulate image, audio or video content forming a deep fake must disclose that it is artificial, and AI-generated text published to inform the public needs disclosure unless a person has reviewed it and holds editorial responsibility. A virtual-staging image or a synthetic video of a property is the case to watch. Whether a particular image counts is a legal question, so label AI images clearly. The market rules for property visuals are in [our guide to AI virtual staging and property video](https://www.formule.io/uk/blog/ai-virtual-staging-property-video-rules).

- **High-risk uses.** Tools that score people, such as tenant screening, can fall into high-risk categories. Take advice before using one.

The AI Act does not replace the GDPR. Both apply, and the data protection authority remains your first contact for questions about personal data.

## The UK position

The EU AI Act is an EU regulation and does not apply in the UK itself. In the UK, UK GDPR and the Data Protection Act 2018 apply, supervised by the Information Commissioner's Office (ICO). UK marketing rules sit in PECR, as in point 7.

## Market by market

### United Kingdom: ICO

The ICO's guidance on AI and data protection was last updated in March 2023 and is under review after the Data (Use and Access) Act. Its transparency chapter points to a separate ICO product on explaining AI-assisted decisions. Start there if a vendor cannot explain how its tool reaches an output.

### Germany: state authorities and the DSK

Private companies such as estate agencies are supervised by the data protection authority of their Land, under section 40 of the Federal Data Protection Act, not by the federal commissioner (BfDI). The authorities coordinate in the Datenschutzkonferenz (DSK), which published an "Orientierungshilfe" on artificial intelligence and data protection on 6 May 2024. It is guidance (an Orientierungshilfe), not binding law.

### France: CNIL

The CNIL published two recommendations on AI and the GDPR on 7 February 2025. They say that where personal data is used to train a model and may be memorised, people must be informed, and that general information can suffice where direct contact is impossible. For an agency, the practical lesson is to ask vendors whether your client data is used to train their models.

### Spain: AEPD

The AEPD published a guide on adapting processing that uses AI to the GDPR on 13 February 2020. It covers legal basis, transparency, rights, automated decisions, data minimisation and whether AI tools involve international transfers. It was written before the AI Act, so use it for the GDPR questions only.

### Italy: Garante

The Garante runs a dedicated AI page that gathers its guidance and decisions, including its guidance on protecting personal data from web scraping, alongside the AI Act text and EDPB material. The EDPB's Opinion 28/2024 of 18 December 2024, requested by the Irish authority, covers data protection aspects of AI models and is worth reading if you choose among vendors.

### Poland: UODO

UODO published "Before you deploy an AI tool, check whether it complies with GDPR principles" on 6 August 2026. It offers four sets of questions, the first for small and medium businesses using ready-made AI systems. UODO says the questions do not establish compliance and need not be submitted to the authority. They make a good agenda for a vendor call.

## Worked example: a WhatsApp follow-up draft

An agent wants AI to draft replies to portal enquiries and send them on WhatsApp. Run the ten checks. The task: reply to enquiries with name, number and property. Basis: steps at the buyer's request. Notice: updated to mention AI tools. Vendor: processor agreement signed, sub-processors and countries checked. Minimisation: the notes field with a buyer's financing details is excluded. Marketing: replies to the enquiry go out, newsletters do not, unless the buyer opted in. Retention: drafts deleted after 90 days. Rights: a dummy contact traced and erased. Human: the agent approves every message. For the follow-up workflow itself, see [AI lead follow-up on WhatsApp](https://www.formule.io/uk/blog/ai-lead-follow-up-whatsapp). If you connect an assistant to your CRM, the same checks apply to what it can read, as covered in [ChatGPT and Claude for estate agents](https://www.formule.io/uk/blog/chatgpt-claude-for-estate-agents).

## What Formule does, and what it does not claim

The provider of the Formule self-serve service is Formule Labs Limited, a company registered in Ireland (CRO 815470), as decided on 10 October 2026. Its [privacy policy](https://app.formule.io/privacy) names it as the controller and gives privacy@formule.io for questions and data requests. The policy also names the services behind the AI features, so you can see the providers involved.

Really, the Formule AI agent, drafts and the agent approves. According to Formule's documentation, nothing is sent from WhatsApp until the agent approves it, and Really's changes to your data wait for the agent's approval. Connecting WhatsApp requires a consent step in which the agent agrees to the assistant reading lead conversations. In-app chats with Really are visible only to the user, not to the manager.

This article makes no claim about certifications, hosting regions or data processing agreements. As far as we can verify, Formule's public privacy policy and documentation do not state them, so ask privacy@formule.io for the processor agreement and the data location before you put client data in, as you would with any vendor. You can see how Formule works in your market on the [Formule page](https://www.formule.io/uk) or [start free](https://app.formule.io/signup?lang=en).

## Keep a one-page record

Write the ten answers on one dated page per AI task, and review it whenever the tool or the law changes. It is what you show a client or a regulator who asks how you use AI.

## Sources
- https://ai-act-service-desk.ec.europa.eu/en/ai-act/article-50
- https://ai-act-service-desk.ec.europa.eu/en/ai-act/article-4
- https://digital-strategy.ec.europa.eu/en/policies/regulatory-framework-ai
- https://ai-act-service-desk.ec.europa.eu/en/ai-act/timeline/timeline-implementation-eu-ai-act
- https://app.formule.io/privacy
- https://docs.formule.io/llms-full.txt
- https://ico.org.uk/for-organisations/uk-gdpr-guidance-and-resources/artificial-intelligence/guidance-on-ai-and-data-protection/
- https://ico.org.uk/for-organisations/direct-marketing-and-privacy-and-electronic-communications/guide-to-pecr/electronic-and-telephone-marketing/electronic-mail-marketing/
- https://www.gesetze-im-internet.de/englisch_bdsg/englisch_bdsg.html
- https://www.datenschutzkonferenz-online.de/orientierungshilfen.html
- https://www.bfdi.bund.de/EN/Home/home_node.html
- https://www.cnil.fr/en/ai-and-gdpr-cnil-publishes-new-recommendations-support-responsible-innovation
- https://www.aepd.es/es/prensa-y-comunicacion/notas-de-prensa/la-aepd-publica-una-guia-para-adaptar-al-rgpd-los-productos-y
- https://www.garanteprivacy.it/temi/intelligenza-artificiale
- https://www.edpb.europa.eu/our-work-tools/our-documents/opinion-board-art-64/opinion-282024-certain-data-protection-aspects_en
- https://uodo.gov.pl/pl/138/4533
- https://eur-lex.europa.eu/legal-content/EN/TXT/?uri=CELEX:32016R0679
- Knowledge-Base/12_comms/decisions.md