Anyone who asks an AI today about the value of their property, a rental yield, or a tax question often reveals more than they think: location details, purchase prices, sometimes even names and contact details. Most widely used AI chatbots process these requests on servers outside the EU – a legal difference that can quickly become a problem for sensitive real estate and financial data, as our overview of AI models compared also shows.
Why GDPR is no fine print when it comes to AI tools
The General Data Protection Regulation (GDPR) has, since 2018, regulated EU-wide how personal data may be handled. For a chatbot, that concerns not only name and email address, but any information that can be linked to a person – and that is almost always the case with real estate and tax questions.
Address or parcel number of a property
Purchase price or rental income of a specific property
Names of tenants, buyers or heirs
Income or asset details for tax questions
Contact details in uploaded documents
The GDPR requires three things that are hard to verify with many AI services: an adequate level of protection at the place of processing, transparency about what happens to the data, and a clear legal basis for any disclosure to third parties.
Rule of thumb: the question itself is not the problem – the problem is where the answer is computed, and what happens to the input afterward.
Where does the data end up? Server locations at a glance
Depending on which AI is used, data processing is subject to completely different legal systems. For real estate topics, with their inherently personal details, it’s worth taking a close look before uploading sensitive documents.
Provider type
Typical server location
GDPR situation
US providers (e.g. ChatGPT, Gemini, Claude, Copilot)
USA, EU data centers sometimes available as an add-on
Use is usually only legally sound with additional agreements
Chinese providers (e.g. DeepSeek, Kimi)
China
no EU adequacy decision, possible state right of access
EU providers (e.g. Mistral AI, Lukinski AI)
France / Germany
directly bound by the GDPR, no third-country review needed
More on the individual providers and their respective data protection assessment can be found in the detailed articles on Mistral AI and DeepSeek.
Important here: the pure server location is only one building block. Even with an EU server, a US corporation could stand behind it in the background as the parent company, through which US authorities could theoretically still demand access under certain laws. A company with headquarters, legal jurisdiction and data center entirely within the EU – as is the case with Mistral AI or Lukinski AI – most reliably rules out this risk.
What this concretely means for real estate and tax questions
Especially with real estate topics – purchase prices, standard land values, tenancy relationships, tax questions surrounding sale or rental – the details can often be clearly linked to a specific person or property. Anyone who regularly works professionally with an AI should ask themselves three questions before every input.
Where does this data technically end up?
Is it stored or resold?
Does it feed into the training of other models?
Professions with particular risk
Property management companies with tenant data
Real estate agents with listing exposé and buyer data
Tax advisors with client data
Property developers with project and contract data
Landlords with private leases
Documents requiring particular caution
Leases with names and bank details
Purchase agreements with notary details
Land register extracts
Proof of income for financing
Tax assessments and receipts
The AI Act: the second important EU rule alongside the GDPR
Alongside the GDPR, the EU AI Act has been gradually taking effect since 2024. While the GDPR regulates how personal data is handled, the AI Act regulates how the AI systems themselves may function and be classified. For real estate and tax questions, one classification matters most: AI systems that help decide on creditworthiness or financing approvals are considered so-called high-risk systems and are subject to considerably stricter review obligations than a simple chatbot for general questions.
For most use cases covered in this article – research, summaries, initial orientation on tax questions – these stricter obligations do not apply. However, anyone integrating AI into an automated lending or creditworthiness process should keep the AI Act classification in mind in addition to the GDPR review.
The data processing agreement: why it’s mandatory for business use
As soon as a company – even a small property management company or a single real estate agent – has an AI process third parties’ personal data, the provider’s private use license is not legally sufficient. What’s needed is a so-called data processing agreement (DPA), which precisely regulates what the AI provider may and may not use the data for.
Many free or purely privately oriented AI chatbots don’t offer such an agreement at all, or only for expensive enterprise customers. Anyone who, as a case worker, real estate agent or tax advisor, enters tenant or client data into an AI without a valid DPA is thereby acting in a legal gray area – regardless of how good the AI’s result ends up looking.
Rule of thumb: a good AI result does not undo a missing legal basis – the DPA must be in place before the first input, not checked afterward.
Checklist: how to recognize a GDPR-compliant AI
Not every provider makes its data protection information easy to find. These five points can usually be checked within a few minutes in a provider’s terms of use or privacy policy, before entering sensitive real estate or tax data.
Server location clearly stated, ideally the EU
Data processing agreement available for business customers
Deletion periods for chat histories specified
No automatic use for model training without consent
German-language, findable privacy policy
Your rights as a data subject under the GDPR
Right
Meaning in plain terms
Right of access (Art. 15)
You may find out what data is stored about you
Right to erasure (Art. 17)
You can request the deletion of your data
Right to object (Art. 21)
You can object to the processing of your data
Right to data portability (Art. 20)
You can request your data in a common format
With providers outside the EU, these rights are considerably harder to enforce in practice, since neither the responsible supervisory authority nor the place of jurisdiction is in Germany. This is one of the main reasons why, for business real estate and tax questions, it’s worth looking at where an AI provider is headquartered.
Our approach: Lukinski AI
This is exactly why we built Lukinski AI so that these questions never remain open in the first place:
Servers in Germany instead of with a US provider
No disclosure to third parties – chat histories are not sold or used to train third-party AI
No tracking, no cookies – history stays local in the browser
Official data basis – standard land values from genuine sources of the valuation committees
Payments only via Stripe as the payment service provider, more on this in the privacy policy
Two specialized areas instead of a jack-of-all-trades chatbot
Real estate: standard land values, rental yield, purchase-related ancillary costs
Both areas can be used for free (with a fair message limit); for more intensive use, there is a Pro version with more simultaneous chats and an optional memory feature that only remembers explicitly stated details – never records automatically. It remains important: even a German, GDPR-compliant AI does not replace legally binding tax advice, but provides a well-grounded initial orientation.
Practical examples from everyday life
Example 1: A property management company reviews a lease
A property management company wants to have the utility cost clauses in twenty leases checked at once. With a US chatbot, a third-country review including a DPA would have to be carried out beforehand. With a German AI solution, this step is unnecessary, because the data never leaves its own legal jurisdiction.
Example 2: A real estate agent calculates purchase-related ancillary costs
A real estate agent has the real estate transfer tax, notary and land registry costs calculated for a property in Munich for a client. Since no name is mentioned here, only a purchase price and a federal state, the risk is low – but it’s still a good habit to generally enter as few personal details as possible.
Example 3: A landlord asks about the speculation period
A private landlord asks whether a sale within the ten-year speculation period would be subject to tax. Even without naming a person, a specific individual can often be inferred from the purchase date, address and sale price – a reason to prefer a European AI with a clear data protection situation for such questions.
Example 4: A property developer compares AI providers for internal project documents
A property developer wants an AI to summarize construction descriptions, calculations and floor plans for several projects. Because these documents often also contain buyer and financing data, the company deliberately chooses a provider with an EU server location and a valid data processing agreement, instead of relying solely on the cheapest or fastest chatbot.
Frequently asked questions about AI and GDPR for real estate and tax questions
Am I even allowed to enter private leases into an AI?
Yes, in principle, if the AI used offers an adequate legal basis and adequate data protection. For business use involving third parties’ tenant data, a data processing agreement is additionally required.
Is ChatGPT or Gemini banned for real estate data?
There is no general ban, but users should check whether an additional agreement for business data is in place and whether personal data belonging to third parties should even be entered at all.
What happens if I accidentally entered sensitive data?
Many providers allow deleting individual conversations in the account area. Legally, it’s also advisable to notify the provider via the contact form to request deletion under Article 17 GDPR.
Why is a German AI advantageous for real estate questions?
Because server location, contract law and data protection oversight are all in Germany, the elaborate review of a third-country transfer that would be necessary with US or Chinese providers becomes unnecessary.
For which professions is this topic especially important?
It is especially relevant for property management companies, real estate agents, tax advisors, property developers and landlords who regularly work with third parties’ personal data.
Do I have to inform my clients if I use AI for their real estate data?
Yes. Under the GDPR’s transparency principle, tenants, buyers or clients should generally know when their data is passed on to an AI for processing, for example through an appropriate notice in the lease or in the company’s privacy policy.
A complete comparison of all major AI providers and their respective data protection assessment is available on the overview page AI models compared.
https://lukinski.com/wp-content/uploads/2026/07/datenschutz-dsgvo-ki-immobilien-server-deutschland-sicherheit-buero-lukinski.webp6721200/wp-content/uploads/2024/04/lukinski-logo-real-estate-investment-germany-house-villa-off-market-clean.svg2026-07-28 20:44:042026-08-11 22:14:14AI and GDPR in Germany: Why Data Protection Matters for Real Estate and Tax Questions
