Using an AI chatbot to communicate with tenants involves collecting and processing personal data — names, contact details, financial information, and conversation content. Under the EU General Data Protection Regulation (GDPR), property agencies must handle this data according to specific rules. Non-compliance can result in fines of up to €20 million or 4% of annual global turnover.
What Data Do AI Rental Chatbots Collect?
When a tenant sends a message to your AI chatbot, the system typically collects:
- Contact information — phone number (from WhatsApp), name if provided
- Conversation content — the full text of every message exchanged
- Qualification data — income, employment status, household size, move-in date
- Behavioral data — response times, properties viewed, booking history
All of this falls under GDPR's definition of "personal data" and must be handled lawfully.
What GDPR Requires for AI Chatbots
Lawful Basis for Processing
You must have a valid legal reason to process tenant data. For rental agencies, the most applicable bases are:
- Legitimate interest — processing contact details to respond to an inquiry is generally considered a legitimate interest
- Contractual necessity — once a tenant applies, processing their data to execute a lease is lawful
- Consent — required for marketing communications (e.g., follow-up emails about new listings)
Key point: Most AI chatbot conversations during the inquiry stage fall under legitimate interest. However, if you intend to use tenant data for marketing purposes after the conversation ends, you need explicit consent.
Transparency and Privacy Notice
Tenants must be informed that their data is being processed. For chatbot interactions, this means:
- Display a short privacy notice at the start of each conversation: "By continuing this conversation, you agree to our [Privacy Policy link]. We process your data to help with your property inquiry."
- Your full privacy policy must be accessible and clearly explain what data is collected, how it's used, and how long it's retained
- Identify the data controller (your agency) and any data processors (the chatbot platform)
Data Retention Limits
You cannot keep personal data indefinitely. Define and enforce retention periods:
| Data Type | Recommended Retention Period |
|---|---|
| Inquiry conversations (no application) | 90 days after last message |
| Qualified lead data | 6 months if no lease signed |
| Tenant application data | Duration of tenancy + 3 years |
| Marketing consent records | Until consent is withdrawn |
Automate deletion where possible — most chatbot platforms offer configurable data retention policies.
Right to Erasure (Right to Be Forgotten)
Tenants can request that you delete their personal data. Your process must:
- Accept the request (via email or a form on your website)
- Delete the data from the chatbot platform, your CRM, and any backups
- Confirm deletion in writing within 30 days
Ensure your chatbot provider supports data deletion requests at the tenant level.
Data Processor Agreements
If you use a third-party AI chatbot platform (which most agencies do), that platform is a "data processor" under GDPR. You must have a Data Processing Agreement (DPA) in place with them.
The DPA must specify:
- What data the processor handles
- How it's protected
- Where it's stored (EU servers or adequacy decision countries)
- Sub-processors used (e.g., the underlying AI model provider)
Reputable chatbot platforms provide standard DPAs. Always request one before going live.
Special Considerations for WhatsApp
WhatsApp is operated by Meta (US-based), which raises data transfer questions under GDPR. Key points:
- Meta is covered by the EU-US Data Privacy Framework (adopted in 2023), making data transfers to the US lawful for most use cases
- WhatsApp Business API data is processed by Meta's servers — ensure this is disclosed in your privacy policy
- Tenant phone numbers and message content are processed by Meta — your DPA with your chatbot provider should address this chain of processing
Checklist: GDPR Compliance for AI Rental Chatbots
Before going live, verify:
- Privacy notice displayed at the start of every chatbot conversation
- Full privacy policy accessible from your website and chatbot interface
- Data Processing Agreement signed with your chatbot provider
- Data retention periods configured and enforced
- Data deletion process documented and testable
- Consent mechanism in place for any marketing follow-ups
- EU-based data storage confirmed (or adequacy decision country)
- Record of Processing Activities (ROPA) updated to include chatbot data flows
What Happens if You Don't Comply?
GDPR enforcement in real estate has increased since 2022. Regulators have issued fines for:
- Storing tenant data without a defined retention period
- Sending marketing messages without consent
- Failing to respond to data deletion requests within 30 days
- Using US-based cloud services without appropriate safeguards
The risk is real — but compliance is straightforward with a well-configured chatbot platform and documented processes.
RentPilot Is Built for GDPR-Compliant Agencies
RentPilot stores all tenant data on EU servers, provides standard DPAs, and supports automated data retention and deletion. Join the waitlist to learn more about our compliance framework.