Cross-Border Data Transfers for an International Property Portfolio

What actually crosses the border in a property portfolio

Real-estate operators often assume they are outside the data-transfer debate because they do not run a tech business. In practice a large share of the value chain is hosted overseas: tenant relationship management, lease and payment systems, occupancy analytics, CCTV platforms at car parks and entrances, visitor management, and payroll for staff in several countries. Where a supplier or a group company outside the EEA receives or accesses identifiable data, a transfer regulated by Chapter V of the GDPR has taken place.

The personal data in scope is broad. Tenant and occupier identity and lease terms, rent and payment collection records, car-park security footage and property occupancy data, information about visitors and contractors, and employee HR files are all examples that can be processed overseas. Because the categories are heterogeneous, a single legal shortcut rarely works — the compliance design has to follow each data flow separately.

• Tenant and occupier records: identity, lease, rent history and correspondence.
• Surveillance and occupancy data captured by cameras at car parks, lobbies and communal areas.
• Visitor and contractor logs from access-control and management platforms.
• Employee and payroll records processed by a central or cloud HR provider.
• Analytics and smart-building logs linked to identified individuals.

First stop: adequacy decisions remove the barrier

Article 45 of the GDPR lets the European Commission decide that a third country or territory offers an adequate level of protection. The effect is that personal data can flow from the EU (and Norway, Liechtenstein and Iceland) to that country without any further safeguard. The Commission's current list includes Andorra, Argentina, Brazil, Canada (commercial organisations), the Faroe Islands, Guernsey, Israel, the Isle of Man, Japan, Jersey, New Zealand, the Republic of Korea, Switzerland, the UK, Uruguay, the European Patent Organisation, and US commercial organisations participating in the EU-US Data Privacy Framework.

Adequacy is not permanent: decisions are reviewed periodically and can be amended or withdrawn, and most cover only commercial transfers, not law-enforcement exchanges. So the list must be checked at design time and revisited on a schedule. If a property group sends data to a subsidiary in an adequacy country, that leg needs no further transfer mechanism — a meaningful simplification when most of your portfolio sits in adequacy jurisdictions.

When adequacy is missing: SCCs and the transfer impact assessment

Since 4 June 2021 the European Commission's modernised standard contractual clauses are the default tool for transfers between EU/EEA controllers or processors and parties outside the EEA. The 2021 SCCs cover the main routing shapes (controller-to-controller, controller-to-processor, processor-to-processor and processor-to-controller) and must be signed before the transfer starts.

Following the Schrems II ruling, signing the clauses is only part of the job. The European Data Protection Board's recommendations on supplementary measures set out a six-step analysis: know your transfers and map them; identify the transfer tool; assess whether the recipient country's law and practice undermine the tool; adopt supplementary measures where needed (for example end-to-end encryption, pseudonymisation or strong organisational controls); take any procedural steps; and re-evaluate periodically. That documented analysis is often called a transfer impact assessment, and regulators expect it to be genuinely country- and flow-specific, not a template with a tick-box.

• Map every flow: data category, exporting entity, recipient, country and system.
• Choose the SCC module that matches your controller/processor relationship.
• Assess the destination country's law and government-access practice.
• Add supplementary measures if the assessment shows gaps in protection.
• Document the assessment and set a regular re-evaluation cycle.

Structured options for groups: BCRs and the Data Privacy Framework

A property group with entities in many countries often finds individual SCCs unmanageable. Binding corporate rules let an entire group adopt one set of internally binding data-protection rules, approved by a lead supervisory authority, so intra-group transfers no longer need per-flow contracts. BCRs are more expensive to set up but become efficient once the portfolio spans many jurisdictions with recurring flows.

For US destinations, the EU-US Data Privacy Framework gives a dedicated adequacy route: personal data can flow freely from the EU to US organisations that have self-certified and appear on the Department of Commerce's list. The safeguards behind the framework also make it easier to use other tools, such as SCCs, with US recipients. Because certification lapses, always verify that the specific US processor is an active DPF participant before relying on it.

Article 49 derogations are a narrow last resort

Where neither adequacy nor an Article 46 tool is available, the GDPR offers limited derogations. The most discussed is the data subject's explicit, informed consent to the proposed transfer, given after they are told of the risks. Others cover contract performance at the subject's request, important reasons of public interest, legal claims, protection of vital interests, and a constrained legitimate-interests route for non-repetitive transfers.

Derogations are meant to be exceptional and are interpreted restrictively. Basing routine tenant onboarding, rent collection or CCTV processing on consent is fragile, because consent can be withdrawn and the balance of power between landlord and tenant is questionable. For recurring property operations you should build the Article 46 infrastructure (SCCs or BCRs) rather than design your business around derogations.

Governance: records, contracts and re-evaluation

Transfer compliance becomes auditable when it is documented. Keep a register of processing that records, for each flow, the recipient, the third country, the transfer mechanism, the completion of a transfer impact assessment and any supplementary measures. Data-protection impact assessments should cover CCTV and large-scale tenant or employee processing before high-risk projects go live.

Processor contracts must align with Article 28 and, where a sub-processor sits outside the EEA, flow the relevant Chapter V obligations downstream. Given that schedules change — new adequacy decisions, renewed SCCs, or shifts in a country's practice — transfer arrangements should be reviewed on a fixed cycle and after any material change in suppliers, systems or portfolio geography.