GDPR Compliant AI for Estate Agents: Their Data, Kept in the Branch
An estate agent is a data controller for thousands of people who are not its customers for long and never agreed to an AI provider. A machine in the branch means none of them need to.
£500 per month for the software and the hardware rental. You rent the machine — you don’t buy it.
GDPR compliant AI for estate agents means AI used in a way that meets the UK GDPR and Data Protection Act 2018 for the tenants’, landlords’ and buyers’ data a branch holds. A machine installed in the branch means no third-party AI processor and no restricted transfer for the AI step; lawful basis and retention remain the agency’s.
Bring your DPO to the call
A short call with the branch manager, director or compliance officer. We will walk through the data flow before any hardware is ordered.
Model, files and chat history on one machine in the branch. Tenants’, landlords’ and buyers’ data never leaves the office.
Cloud Agents for Enquiries, Local AI for the Paperwork
Viewing requests and valuation enquiries suit a hosted agent; tenancy files, AML records and vendor correspondence suit a machine in the branch. Most agencies run both.
- ☁ Cloud-based AI Receptionist
- ☁ Cloud-based Email Manager
- ☁ Cloud-based Leads Outreach
- 🏢 On-premise Local AI
The Questions Your DPO Asks About AI and GDPR Compliance
Most of the hard work in an AI GDPR assessment is about the processor and the transfer. Here is what each looks like for estate agents.
| The question | Cloud AI service | A machine in the branch |
|---|---|---|
| Who is the processor for the AI step? | The AI provider — appoint, assess, contract, review | Nobody — the model runs on your own machine |
| Is there a restricted transfer? | Often — IDTA or UK Addendum, plus a transfer risk assessment | No — the data never leaves the building |
| Is our data used to train models? | Depends on the plan, the settings and the small print | Never |
| What goes in the Article 30 record? | A new processor and, often, a new transfer | One fewer of each |
| Erasure requests | Your copy and theirs | Your copy only |
| Lawful basis, purpose, retention | Yours | Still yours |
Thousands of Data Subjects, None of Whom Agreed to a Chatbot
An estate agency is a data controller at scale. Every applicant who registered, every tenant who was referenced, every landlord whose bank details are on file, every vendor whose circumstances were noted and every buyer whose mortgage position was recorded is a data subject with rights — and most of them will have moved on within a year, leaving their data behind. Add the identity documents collected because HMRC supervises estate agents for anti-money-laundering, which must be kept for five years, and the branch holds a great deal of personal data it cannot casually hand to a processor.
A cloud AI tool is such a processor. Pasting a tenancy file into it discloses a tenant’s references and a landlord’s account details to a provider none of them agreed to, in a jurisdiction the agency has to name, with a transfer mechanism the agency has to justify. A machine in the branch does none of that. The model runs on the branch network; files, correspondence and chat history stay on it. No AI provider processes anyone’s data, so no processor for that step. Nothing leaves the building, so no transfer.
What stays with the agency is what was always its own: lawful basis for each purpose, retention — including the five-year AML retention and the deletion of everything else when it is no longer needed — and who in the branch can see which files, set through the Microsoft 365 or Google Workspace sign-in staff already use. A deletion is a deletion because no third-party copy exists. The AML assistant lists which documents a file is missing; it does not verify anyone or make the risk assessment, and the compliance officer stays the compliance officer.
We act as a processor only for the support access the agency grants us, under a data processing agreement, and we will help the compliance officer or whoever holds the data protection role word the entry. Bring them to the first call.
What Is Installed, and What the Paperwork Looks Like
The machine, the software on it, the sign-in and the support — and the two documents your advisers will ask for.
No third-party AI processor
The model runs on your own machine, so your documents are never sent to an AI provider. Nothing to appoint, assess or keep under review for the AI step.
No restricted transfers
Your data never leaves the UK. The IDTA, the UK Addendum and a transfer risk assessment simply do not arise for the processing it does.
A shorter Article 30 record
One fewer processor and one fewer transfer to describe, review and keep current — and one less thing to explain if the ICO ever asks.
| Document | What the branch asks for | What stays where |
|---|---|---|
| Viewing notes and photos | A listing draft in house style; material-information gaps listed | On the machine, in the branch |
| Tenancy agreements and renewals | What the tenancy says; a summary before renewal | On the machine, in the branch |
| Sales files and vendor correspondence | A summary; the answer to a buyer’s question, cited | On the machine, in the branch |
| AML customer due-diligence files | Which documents are present and missing, against your checklist | On the machine, in the branch |
| Landlord instructions and management agreements | What was agreed; the clause on repairs | On the machine, in the branch |
| CRM and portal listings | Not connected — a person pastes drafts back | Your existing systems |
From a Branch Manager’s Call to a Machine in the Back Office
Weeks, not months. Multi-branch agencies start with one branch and one job and widen from there.
A call with the branch or director
Sales, lettings or both, how many staff, which paperwork goes first. We specify the machine from that.
Install and import
The machine goes on the branch network. Sign-in connects to your Microsoft 365 or Google Workspace. Files, templates and correspondence for the first team are imported into spaces.
Train the team, then support
We train negotiators and managers on what it does and what it is not for. Updates, model upgrades and support follow, from the people who installed it.
Where Local AI Is the Wrong Answer
We would rather lose the enquiry than the trust. Three things we tell every prospect before they sign anything.
It is not a compliance certificate
No product can make estate agents UK GDPR-compliant on their own. A machine in the building removes the processor and transfer questions for the AI step. Purpose, lawful basis, retention and staff conduct remain yours, and we will not tell you otherwise.
It is slower than the big cloud models
Open-weight models on a single machine are capable for summarising, drafting and answering questions about your own documents. For frontier reasoning on hard, novel problems, the largest cloud models are still ahead. That is the trade.
It is a weeks-long install, not a sign-up
A cloud agent is live in days. Local AI needs the machine specified, delivered, installed on your network and your documents imported. Weeks, not months — but not tomorrow.
Built With the Regulator in Mind
Data never leaves the building
Open-weight model, documents and chat history on one machine in the branch. The only outside connection is your own sign-in.
Never used for training
Your content is not used to train or improve any model. The models arrive trained and stay that way unless you ask.
One DPA, for one thing
We are a processor only for the support access you grant, and the agreement says so in plain terms.
Honest about the trade
Local models are capable and somewhat slower than the largest cloud services. We say so before you sign anything.
Which Page Answers Your Agency’s Question
| If your question is… | The short answer | Read more |
|---|---|---|
| The general GDPR picture for AI | The processor and transfer questions, in full | GDPR compliant AI |
| We want the Local AI overview for estate agents | The head page for agencies | Local AI for estate agents |
| What exactly is installed in the branch? | One machine in the back office, supported | On-Premises AI for estate agents |
| We want a private ChatGPT for negotiators | That is the private chat assistant | Private AI for estate agents |
| The enquiries inbox is the real problem | Hosted inbox automation | Email Manager |
| We are in Manchester | The same questions, Greater Manchester | GDPR Compliant AI Manchester |
| Why on-premises at all? | The case for Local AI, in full | Local AI product page |
AI and GDPR Compliance for Estate and Letting Agents: Common Questions
Is there such a thing as GDPR compliant AI?
Not as a product label. Compliance is a property of how estate agents use a tool, not of the tool. What a product can do is make the assessment easier: a machine in the branch removes the processor and transfer questions for the AI step entirely.
Do we need a DPIA for AI?
Often, yes, and we would rather you did one. A machine in the building makes it shorter: the questions about the processor, the transfer mechanism and the training use of your data have plain answers. Purpose, lawful basis, retention and access are still yours to answer.
Does the AML retention rule change with a machine in the branch?
No — customer due-diligence records are kept for the period HMRC requires under the Money Laundering Regulations, on your systems, under your policy. What changes is that no AI provider ever holds a copy, so retention and deletion are decided once, by you.
Can a tenant or landlord ask what AI did with their data?
Yes, and the answer is short: it was processed on a machine in the branch, never sent to an AI provider, never used to train a model, and deleted under the agency’s existing policy. We will help you word the privacy notice line.
Does it connect to our CRM or the portals?
No. Rightmove, Zoopla, OnTheMarket and your CRM stay exactly as they are. Documents and correspondence are exported into spaces on the machine; what the assistant drafts is pasted back by a person.
Can it help with AML files?
As an assistant, yes. A custom assistant can go through a customer due-diligence file and list which documents are present and which are absent against your own checklist. It does not verify identity and it does not make the risk assessment; a person does.
How much does Local AI cost?
£500 per month for the software and the hardware rental. The dedicated machine is rented to your business, not sold: you never buy the hardware. It is installed in your building and runs the private chat, document spaces and assistants. Local AI is for business customers only.
Bring the Hard Questions to the First Call
Tell us whether you are sales, lettings or both, and what is blocking AI sign-off. We will walk through the data flow with your compliance officer.
Prefer email? sghaith@businessaiagents.co.uk