EU reform deadline looming

easy. But if it’s a European’s data you’re going to need a contract with them or a legitimate reason to have it, otherwise you need consent.’’

The EU regulations reframed the rights regarding the data collection of ‘‘EU data citizens’’ from an opt-out model to an opt-in one. This requires companies to have the consent of individuals to contact them by email or phone before they do.

It also gives EU citizens the ‘‘right to be forgotten’’, meaning people have the right to be wiped from company databases.

Clark said if a commercial property company did not have a process in place to wipe someone’s information, it could quickly find itself referred to an authority.

But under New Zealand and European anti-money laundering and anti-terrorism financing laws, there are records that commercial property companies have a ‘‘genuine and legitimate reason’’ to keep.

Under EU law this means if anyone has leased, bought or sold property then the property companies must keep a record of who they are. For example, two forms of identification need to be submitted before a commercial sale can be completed, something property companies do not need consent for under the new regulations.

Clark said the PropTech software would still record that it had erased a person’s data, keeping their name in its systems.