Privacy by Design: Safeguarding Portfolio Data

As commercial real estate technology evolves—from smart building systems to tenant engagement platforms—so do the risks and responsibilities around data privacy. This session explores how regulations like GDPR and CCPA impact the way CRE firms collect, store, and manage personal data across their portfolios. Attendees will gain practical insights into compliance strategies, operational safeguards, and ethical considerations that go beyond checkboxes. Some key areas can include: exploring the core principles of GDPR and CCPA, and how they apply to CRE operations, identify common data collection touchpoints in CRE tech (e.g., access control, leasing platforms, IoT devices), teach the audience how to audit tech stack for compliance risks, explore case studies of CRE firms implementing privacy-first practices, and checklist of questions to ask vendors and partners about data handling and security as a handout.

Learning objectives—By the end of the sessio, participants will be able to:

Apply GDPR and CCPA principles to common commercial real estate (CRE) workflows by mapping regulatory requirements to real‑world data practices such as leasing, access control, and tenant engagement systems.
Identify high‑risk data touchpoints across CRE technologies—including IoT sensors, building management platforms, and tenant apps—and evaluate how personal data flows through each.
Conduct a privacy‑focused tech‑stack audit by assessing vendors, integrations, and internal processes for compliance gaps, security weaknesses, and data‑minimization opportunities.
Develop privacy‑first operational safeguards by analyzing case studies and creating a vendor‑question checklist that strengthens governance, transparency, and ethical data handling across CRE portfolios.

Sponsored by