Data Management — RICS APC Competency Revision Guide

The seven principles under UK GDPR are: lawfulness, fairness and transparency; purpose limitation; data minimisation; accuracy; storage limitation; integrity and confidentiality (security); and accountability. For the APC, you should be able to explain each principle and give a practical example of how it applies to surveying work — for instance, that data minimisation means only collecting the client information you actually need to deliver the service.

The RICS data management guidance note provides profession-specific guidance on collecting, storing, and using data in surveying practice. It covers data quality standards, governance frameworks, data security, and the professional obligations that arise from handling commercially sensitive or personal data. Candidates should understand its key themes and be able to reference it when explaining how their practice approaches data governance.

A personal data breach that is likely to result in a risk to individuals' rights and freedoms must be reported to the Information Commissioner's Office within 72 hours of becoming aware of it. Where the risk is high, affected individuals must also be notified. In practice, this means having an incident response procedure, documenting the breach, assessing the risk, and acting promptly. At Level 3, assessors may ask how you would balance the notification obligation against the reputational risk to your firm.

A data controller determines the purposes and means of processing personal data — typically the surveying firm acting on its own instructions. A data processor processes data on behalf of and under the instruction of a controller — for example, a cloud software provider hosting your practice management system. The distinction matters because controllers bear the primary legal responsibility under UK GDPR, whilst processors must operate under a written contract that specifies their obligations.

You explain to the client that UK GDPR's storage limitation principle requires that personal data is not kept longer than necessary for its original purpose. Retaining former tenants' personal data indefinitely has no lawful basis once the relevant limitation period for any dispute has passed. Your firm's seven-year schedule is likely set with this in mind. You can retain documents in redacted or anonymised form for longer if the client has a legitimate business reason, but you cannot override data protection law at a client's request. You document this advice in writing.