A property feed can update Rightmove, Zoopla, OnTheMarket and specialist channels in minutes. It can also copy personal information much further than intended if the data leaving your CRM has not been checked. Feed GDPR compliance means treating every field, photo, document and portal connection as part of your data-protection process - without slowing down the advertising that wins instructions and lets homes.
For most agencies, the answer is not to stop automation. It is to make the source data cleaner, define what each destination needs and give staff a quick, simple process to follow. Done well, a feed reduces the risk of old details sitting on multiple portals while removing the daily chore of repeated manual updates.
Feed GDPR compliance starts at the source
Your CRM, property-management system or listing dashboard should be the source of truth. Before a feed imports or sends anything, decide which fields are genuinely needed to market a property. Portal advertising normally requires listing details such as price, tenure, room information, location, photos, floorplans and EPC information. It does not normally need a vendor's personal mobile number, a tenant's forwarding address, viewing notes or internal negotiation history.
This sounds obvious, but feed templates often grow over time. A field added for an internal report, a free-text description copied from old records, or a document attached by a negotiator can accidentally become available to an external channel. A regular field-by-field review is far easier than trying to remove information after it has been published, indexed or shared.
Property addresses need care too. An address is not automatically personal data in every situation, but it can become personal data when it identifies or can be linked to an owner, occupier, tenant or applicant. Consider the circumstances. A vacant new-build plot marketed by a developer is different from an occupied rental home where photographs reveal personal belongings, family names or security arrangements.
Descriptions and media deserve the same attention as structured fields. Ask staff not to include details such as a seller's reason for moving, a tenant's work pattern, alarm codes, key-safe numbers, health information or anything that identifies children. A quick description check before publication protects the client and prevents awkward amendments later.
Know who handles the data and why
An agency will commonly act as the controller for the personal data it collects from vendors, landlords, applicants and tenants. The CRM provider, feed provider and certain technology suppliers may process data on the agency's behalf, depending on the service and contract. Property portals may have their own controller responsibilities for the data they collect and use, particularly around portal accounts, enquiries, analytics and consumer services.
Do not rely on assumptions here. Review the terms, data-processing agreement and privacy information for each supplier and portal. You need to understand what data is transferred, where it is hosted, how long it is retained, which sub-processors are involved and what happens when you end the service. If personal data is transferred outside the UK, check that the appropriate safeguards and contractual arrangements are in place.
Lawful basis also matters. Marketing a client's property will often be necessary to deliver an agreed instruction, but the right basis depends on the relationship and the processing involved. A portal feed should not be used as a shortcut for adding applicants to unrelated marketing lists. Where you send direct marketing by email or text, consider the separate Privacy and Electronic Communications Regulations requirements as well as UK GDPR.
Your privacy notice should explain, in plain English, how property and contact data may be used, including advertising through property portals and other agreed channels. Keep it specific enough to be useful. Saying that data may be shared with `third parties` tells a client very little; explaining that listings can be distributed to named portal categories and overseas-property advertising channels is clearer.
Build a practical approval process
Compliance must work on a busy Saturday, not just in a policy document. Give negotiators and administrators a defined workflow for every new instruction. Confirm that the agency has authority to market the property, check the data and photos, choose the appropriate destinations, then publish from one managed source.
A central dashboard makes this easier because staff can see where a listing is being sent instead of logging in to a dozen websites. With a managed feed, an amendment or withdrawal made at the source can be distributed across connected portals quickly. That helps with accuracy, but it does not remove the agency's responsibility to check that the update has completed and that the listing is no longer visible where it should not be.
For multi-branch agencies, use permissions that reflect each person's job. A branch negotiator may need to edit listings for their office, while a central administrator controls feed settings, portal connections and user access. Avoid shared logins. They make it difficult to see who changed a record and leave access open when a staff member moves on.
A sensible operational checklist should cover the same essentials every time:
- Check that contact details, notes and attachments are marked as internal unless there is a clear reason to publish them.
- Review photographs, virtual tours and floorplans for names, paperwork, number plates, family images and security information.
- Confirm which portals and advertising channels the client has agreed to use, particularly for international exposure.
- Test that sold, let, withdrawn and price-change statuses reach every destination promptly.
- Remove former staff and suppliers from platform access as soon as their role ends.
These checks need not create a bottleneck. The aim is a short, repeatable publishing routine that catches high-risk mistakes before they spread.
Keep data accurate, secure and easy to remove
UK GDPR requires personal data to be accurate and kept no longer than necessary. For estate and letting agencies, this has a direct feed-management benefit: one clean record, updated once, is less likely to create contradictory listings across the market.
Set retention rules for applicant profiles, viewing records, landlord and vendor details, and withdrawn properties. The correct period depends on the records, legal obligations and potential claims, so take appropriate professional advice rather than choosing an arbitrary date. What matters operationally is that expired records do not remain live in your CRM or continue to feed outward by accident.
Security is equally practical. Use individual user accounts, strong passwords and multi-factor authentication where available. Limit exports, protect devices used for manual entry, and ensure staff understand that a spreadsheet containing applicant or tenant details is personal data, whether it is downloaded from a portal, received by email or copied from a feed error report.
Your suppliers should be able to explain their security controls, backup arrangements and incident process. If a feed import fails, you need responsive support and a clear record of what was received and published. If a breach is suspected, preserve the facts, contain the issue and follow your internal incident procedure promptly. Some breaches may need to be reported to the ICO, and affected individuals may need to be informed where there is a high risk to their rights and freedoms.
Plan for enquiries and deletion requests
People have rights over their personal data, including the right to access it, correct it and, in some circumstances, request erasure. A feed can complicate this because the same information may exist in the CRM, dashboard, portal account and archived export files.
Keep a simple data map showing where each category of information travels. It does not need to be a huge compliance project. Record the systems involved, the data they receive, the purpose, who has access and how changes or deletions are handled. This gives your team a workable route when a vendor asks for an address to be removed or an applicant requests a copy of their data.
Remember that deleting data from your own system does not always instantly remove it from a portal's search cache, historic records or systems where that portal acts independently. Your process should identify the destination, submit the appropriate request and keep a record of the action taken. Be honest with the individual about what can be removed immediately and what may be retained for legitimate legal or operational reasons.
Estate Agent Feeds supports this practical approach by centralising listing administration and distributing updates from one place, whether your data arrives through XML, BLM, API, Jupix, Vebra or manual entry. It is quicker to control exposure when your portfolio is not being maintained separately across every advertising account.
Good data protection should make advertising calmer, not more complicated. Start with the next listing: publish only what the market needs, keep the source record accurate and make sure every change has a clear route through your feeds. That is how your agency stays visible, responsive and in control.