Can a property manager put tenant files into ChatGPT? A checklist for property management
Forty applications for one flat. Someone at the agency pastes them into ChatGPT to rank the candidates: salaries, debt collection extracts, copies of ID, and a note that one rent is paid by social services. An hour saved. Where did those files go, and who decided who gets the flat?
The short answer: only what the rental needs, only to a provider under contract, only where the law lets it go, and with a person choosing the tenant: a fully automated decision gives applicants the right to be told and to ask for a person's review (art. 21). Tenant files are personal data, some of it sensitive, and the law asks you to collect only what the purpose needs and to keep it only as long as it does.
Checked against the law on 30 September 2026
Is it allowed?
- CHF 250'000
The highest fine under the Data Protection Act for handing data to a provider without meeting the conditions for processors, or sending it abroad without the required protection or an exception. It targets the person responsible, when the breach is intentional (art. 61 FADP).
- Decided by AI
If a decision rests on AI alone and significantly affects an applicant, you must tell them; on request they can state their view and have a person review it. Deliberately not telling them can be fined up to CHF 250,000 (arts. 21 and 60 FADP).
- Sensitive data
A rent paid by social services is data about social assistance: sensitive personal data under the law (art. 5 FADP).
The checklist
0 of 10 checked
Letting agents, accountants and caretakers included. Look at browser extensions, phone apps and expense claims: the tool you don't know about is the one you can't control.
Applications, debt collection extracts, copies of ID, payslips, tenant correspondence, arrears lists. All of it is personal data.
Data may be collected only for a purpose the person can recognise, and processing must be proportionate (art. 6 FADP). What you never ask for can never leak.
A free or personal account runs on consumer terms. A business plan comes with a different contract. Which one is each person really using?
Some consumer plans may use conversations to train their models, and keep them for a while, unless a setting is off. Read the terms of the plan in use, not the homepage.
A company that handles tenant data for you is what the law calls a processor. That's allowed with a contract, if it only does what you could do yourself and keeps the data secure (art. 9 FADP).
Many AI tools process data in the United States. Sending tenant data there needs a legal basis, for example Swiss-US Data Privacy Framework certification or standard data protection clauses (arts. 16 and 17 FADP).
An AI can sort, summarise and flag. The choice of tenant stays with a person, or the applicant must be told and can ask for a person to review it (art. 21 FADP).
Data must be destroyed or anonymised once the purpose no longer needs it (art. 6 FADP). The files of applicants you didn't choose usually have no purpose once the flat is let, including copies in AI tools.
When you collect data, you must tell people who you are, why you need it and who receives it, and which country if it goes abroad (art. 19 FADP). Then go through the rules with your team.
Ticked them all? Rules that exist only in your head don't stop anyone. The next step is to write them down: the kit has a one-page policy and an information notice for applicants to adapt. Get the kit
Which tasks can go where?
The kit sorts six everyday tasks in property management. Two of them:
- Writing a flat listing
- A public tool is fine.
- Drafting a general notice to all tenants
- A public tool is fine, without names.
- Ranking rental applications
- In the kit
- Answering a tenant's complaint
- In the kit
- Writing a reminder for rent arrears
- In the kit
- Summarising a building's repair history
- In the kit
Collect less, keep less
Personal data must be processed lawfully, in good faith and proportionately, collected only for a purpose the person can recognise, and destroyed or anonymised once that purpose no longer needs it (art. 6 FADP). The less a file holds, the less there is to protect in any tool.
Tell people what happens to their data
At collection, you must tell people at least who you are, why you need their data and who receives it; if it goes abroad, which country and on what basis (art. 19 FADP). Deliberately failing to inform can be fined up to CHF 250,000, on complaint (art. 60 FADP).
What works in practice
A common setup has three tiers: public AI tools for listings and general notices without names, nothing about a tenant in any tool your contracts don't cover, and a private AI run in Switzerland for applications, arrears and correspondence.
Where does your firm stand?
The self-check takes two minutes and says which first step fits. Or talk it through in a free 15-minute call.
Book a free 15‑minute call
Pick a time that suits you and confirm it from your inbox. If the time no longer works on our side, you hear from us the same working day.
What happens in 15 minutes
- 0–5 min
Your situation
What AI should do for you, and what it must never see.
- 5–10 min
What's possible
Which tasks can run privately, roughly what it costs, and what should stay human.
- 10–15 min
The next step
A test on your own documents, an assessment, or nothing yet.
Prefer to write? Send a message
Tell us what you'd like AI to do, and what it must never see. We'll tell you honestly what's possible, what it costs and what should stay human. No details yet? A hello is enough.