Who should own building data and control access to it?

The question is usually put to the test on a bad day. A managing agent leaves, a supplier's contract ends or the building is sold, and the owner finds that the administrator passwords, the controller programs and years of meter history sit with someone else. Raw measurements, asset records, system configurations, supplier analytics, tenant information and personal data carry different rights and obligations, so no single clause can settle them all.

What has to be settled is the rights and practical access the owner needs to operate the asset, meet its obligations and change suppliers. Those rights should be allocated by type of information, with the data protection and contract questions confirmed by your legal and privacy advisers, who own that analysis.

Different information, different rights

For each type, the arrangements should state who may access, use, share, retain and export it, and for what purpose.

Personal data: the roles follow the facts

Where the GDPR applies, controller and processor roles follow what each party actually does in the processing, as the European Data Protection Board's guidelines stress, not the labels in a contract or the ownership of the building. Map the processing first, for the access-control, visitor and occupancy systems in particular, and let your privacy advisers confirm the roles and contractual terms that follow.

What the Data Act adds

The EU Data Act (Regulation (EU) 2023/2854), which has applied since 12 September 2025, gives the user of a connected product or related service the right to access the data its use generates and to have that data shared with a third party. The European Commission's summary names building owners among those who can use this to choose their repair and maintenance providers. Connected products placed on the market after 12 September 2026 must also be designed so that their data is accessible to the user by default. The Regulation sets rules, too, for switching between cloud and other data processing services. In November 2025 the Commission proposed amendments to the Data Act as part of its Digital Omnibus package, so check which text is in force when you contract. These provisions can strengthen an owner's position, but how they apply to a particular installation, lease or service contract is a legal question.

From rights on paper to controls in practice

Those rights need technical controls to match:

• an individual, named account for every user, never a shared login;
• permissions that follow job needs, without unrestricted access to unrelated systems;
• access granted through an approval process and revoked promptly when people or suppliers leave;
• audit logs that someone reviews periodically;
• administrator credentials for every system held by the owner.

When the agent, supplier or owner changes

These arrangements are tested hardest at moments of transition.

Other handovers

The same planning applies when a supplier's contract ends or the building is sold: decide in advance which information transfers, how, and what must be retained or deleted.