Your Tenants’ Data Is Part of Your Portfolio: Why REITs Need a Privacy Program

Real estate investment trusts are experts at managing assets. Every building in a portfolio has a maintenance plan, an insurance policy, a capital budget, and a team accountable for its performance. Informed leaders should know what they own, what it’s worth, and what could go wrong.

But another asset inside every building rarely gets the same attention: the personal information of the people who live, work, and shop there.

Tenant applications, credit checks, payment records, access fobs, security cameras, license plate readers, smart thermostats, and building Wi-Fi all generate personal data. Most REITs hold far more of it than they realize, and much of it sits with property managers and technology vendors rather than inside the REIT itself.

That data carries real value, and real risk. With a new federal privacy bill before Parliament (Bill C-36), Quebec’s Law 25 already in force, and regulators publicly scrutinizing the real estate sector, privacy is no longer just a back-office compliance issue. It’s a governance issue that belongs on the board’s agenda.

This blog illustrates why REITs need to pay attention now, where they are most exposed, and what a practical privacy program looks like.

What personal data does a REIT hold?

Licence plate reader technology is relatively straightforward. Cameras capture licence plate information and compare it against approved databases to identify vehicles associated with specific law enforcement or public safety purposes. Depending on the configuration, these systems may also collect information about vehicle location, date, time, movement patterns and distinguishing vehicle details.

The privacy risk is often not the technology itself.

The risk emerges when organizations fail to clearly answer fundamental questions:

Why is the information being collected?
Is the collection necessary and proportionate?
How long will information be retained?
Who will have access to the data?
Will the information be shared with other organizations?
What safeguards are in place to prevent misuse?

Without clear answers, public trust can quickly erode, regardless of the program’s intended benefits.

Transparency Is No Longer Optional

When it comes to personal information, REIT’s hold much more than just “tenant contact details.” While it varies by asset class, REIT’s hold a significant amount of personal information

Asset class	Personal information commonly collected
Residential	Rental applications, government ID, credit and background checks, income and employment verification, banking and payment details, emergency contacts, information about occupants and children, maintenance requests that reveal health or accessibility needs
Office and industrial	Access card and fob logs, visitor registration, tenant employee contact lists, parking and license plate records, CCTV footage
Retail	Security cameras, Wi-Fi and foot-traffic analytics, loyalty and marketing data, digital directories and kiosks
Across the portfolio	Employee and contractor records, unitholder and investor information, smart-building and IoT sensor data, data held by property managers and service providers

Some of this information is highly sensitive. Credit histories, government ID numbers, banking details, biometric data, and information about children carry a higher risk of harm if lost, misused, or accessed without authorization.

The challenge is that this data rarely lives in one place. It is spread across leasing platforms, property management software, security systems, building automation tools, and third-party vendor systems. You cannot protect data that you don’t know you have. This is why data mapping is the starting point of every effective privacy program.

Why REITs need to act now

1. Federal privacy law is about to get some teeth

In June 2026, the federal government introduced Bill C-36. It would enact the Protecting Privacy and Consumer Data Act and replace PIPEDA. As currently drafted, it would allow administrative penalties of up to the greater of $10 million or 3% of gross global revenue. Certain contraventions could lead to fines of up to $25 million or 5% of gross global revenue.

The bill is still before Parliament, but the direction is clear: organizations will be expected to show documented accountability, assess the risk of their de-identified data, and complete privacy impact assessments for transfers outside Canada. A REIT that waits for the law to pass will be building its privacy program under pressure.

2. Quebec’s Law 25 is already in force

For REITs with properties or tenants in Quebec, stricter rules are not a future concern. Since 2023, Quebec’s privacy regulator has had the ability to impose administrative penalties of up to $10 million or 2% of worldwide turnover. Courts can also impose penal fines of up to $25 million or 4% of worldwide turnover, whichever is greater.

3. Real estate is already on the radar of regulators.

Privacy regulators have made it clear that landlords and the companies they hire are not exempt.

Tenant screening. In June 2024, the Privacy Commissioner of Canada and British Columbia’s Information and Privacy Commissioner opened a joint investigation into Certn, a tenant-screening company used by landlords across Canada. The investigation is examining consent, accuracy, and whether the purposes for collecting information are appropriate. As the federal Commissioner put it: “Landlords, and the services that they employ, must comply with Canadian privacy laws.”
Building technology. In October 2020, the federal, Alberta, and British Columbia commissioners found that Cadillac Fairview used cameras hidden in digital directory kiosks at 12 shopping malls to collect about 5 million images of shoppers and used facial recognition software to estimate age and gender. The commissioners found the company “contravened privacy laws by failing to obtain meaningful consent,” and that decals on mall doors pointing to a privacy policy were not enough.

These cases show a pattern that matters for REITs: regulators are scrutinizing both property owners and their vendors. In the Cadillac Fairview case, the company said it was unaware that a third party was storing biometric data from its kiosks, yet it still broke privacy law. Not knowing what your vendors are doing is not a defense.

4. Investors and tenants expect more

Privacy is increasingly part of how investors judge governance, and how tenants decide whom to trust. A data breach involving tenants’ banking details or identity documentation is not only a regulatory problem. It is also a reputational risk that can affect occupancy, renewals, and unitholder confidence.

Where REITs are exposed?

Property managers and third-party vendors

Like most companies, REITs outsource day-to-day operations to property management companies, leasing platforms, tenant-screening services, security firms and technology providers. Each one collects or accesses personal information on the REIT’s behalf.

Under Canadian privacy law, an organization remains accountable for personal information it transfers to a third party for processing. That means a REIT needs to know which vendors handle personal data, what contracts govern them, and whether those vendors are meeting the same standards the REIT is accountable for. If you are a REIT, these are the questions you should be asking:

Do our property management and vendor contracts include clear privacy and security obligations?
Do our vendor contracts contain provisions to notify us promptly of a breach?
Do we know where vendors store our tenants’ data, and is the data stored outside Canada?
When did we last review a vendor’s privacy practices?

Smart buildings and surveillance technology

Smart-building technology promises efficiency, safety, and better tenant experiences. It also expands data collection, often quietly. Video analytics, license plate recognition, occupancy sensors, smart locks, and building apps all collect personal information. Some data collection, such as facial recognition, collects biometric data. Regulators treat this data as highly sensitive.

Before new technology goes live, a privacy impact assessment, a standard privacy risk management tool, can help answer the questions regulators will ask: Why do we need this data? Is there a less intrusive option? How will people be informed? How long will we keep the data? The Cadillac Fairview case shows how costly it is to answer those questions after the fact.

Acquisitions and dispositions

When a REIT acquires a property or portfolio, it often inherits tenant files, security footage, access logs, and vendor contracts. Privacy should be part of due diligence: what data comes with the asset, how it was collected, whether proper consent was obtained, and what must be securely transferred or destroyed at closing.

Retention and disposal

Data retention cannot be overlooked; keeping applications from people who never became tenants, or files from tenants who moved out years ago, creates extra risk for your organization. The more data you keep, the more you stand to lose in a breach. A clear retention schedule and securely disposing of data when it is no longer needed are simple ways to reduce risk.

Breach readiness

Under PIPEDA, organizations must report breaches that create a real risk of significant harm to the Privacy Commissioner, notify affected individuals, and keep records of all breaches. A REIT should be prepared to know who does what when an incident happens, including when the breach occurs at a property manager or vendor.

What your privacy program should look like

A privacy program isn’t a single policy on your website. It is a set of practical, repeatable controls that show who is accountable, what data you hold, and how you protect it across every property and partner.

To help organizations get started, Garabyte created the Privacy Readiness Workbook, a free resource for Canadian private-sector organizations. It covers eleven areas of a working privacy program, with checklists, practical guidance, and best-practice tips. Here is how its key areas apply to a REIT:

Program area	What it looks like for a REIT
Accountability	Name a privacy officer, set clear roles across head office, properties, and property managers, and report to the board on privacy risk.
Data inventory	Map the personal information collected at each property and asset class, where it is stored, and who can access it, including vendors.
Consent	Make sure tenant applications, screening, cameras, and building apps are backed by clear notices and meaningful consent, especially for sensitive data.
Security safeguards	Protect leasing, payment, and access-control systems with access controls, encryption, and monitoring proportionate to the sensitivity of the data.
Vendor risk	Build privacy and breach-notification terms into property management and technology contracts, and review vendors regularly.
Retention	Set retention periods for applications, tenant files, footage, and access logs, and securely destroy data when it is no longer needed.
Privacy impact assessments	Assess new uses of personal information and new technology, such as video analytics, license plate readers, or smart locks, before they go live.
Individual rights requests	Have a process to respond to tenants and others who ask to access or correct their information.
Training	Train head office staff, on-site teams, and leasing agents to handle personal information properly and spot incidents.
Regulatory change	Track developments such as Bill C-36 and update the program as requirements evolve.

You don’t need to do everything at once. Starting with these three steps can quickly reduce risk:

Map your data; start with your largest asset class or highest-risk systems.
Review your top vendors, especially property managers and tenant-screening providers.
Prepare for a breach, so everyone knows their role before an incident, not during one.

Protect the asset you can’t see

REITs already know how to protect a building’s value through inspection, maintenance, and insurance. Personal information deserves the same discipline.

The rules are about to get more onerous; regulators are watching the real estate sector, and tenants expect their information to be handled with care. A practical, well-documented privacy program reduces risk, builds trust, and positions your REIT to adapt as the law changes.

Start today. Download the Privacy Readiness Workbook. Use Garabyte’s free Privacy Readiness Workbook to assess where your privacy program stands today and identify your next steps. If you would like support building or maturing a privacy program for your REIT, contact the Garabyte team.