Data Management (Checked)

Question 1

How is Lendlease compliant with UK GDPR?

Answer 1

Lendlease has a ‘Data Governance Forum’ whereby members take leadership for data sets which are high value e.g.

• Privacy Council manage personal data
• Verification Committee ensure what is communicated externally is accurate, they ‘fact check’

We undertake training on:
- Storing data - who can access this data? Is this a LL or third party store? Is there disaster recovery?
- Processing data - only process data in ways that are consistent with the purpose it was obtained for / how the accuracy of data / access control during processing
- Sharing data - do you know the rights we have for sharing the data? Is it on a need to know basis? Has it been validated if going public?
- Destroying data - Only keep for as long as needed / can personal data be de-identified / security and protection of records and archives

Question 2

What data do you use in your role?

Answer 2

A range of data for different purposes:

• Budgets
• Development appraisals
• Info from architects (drawings / models / schedules)
• Comparable evidence / market evidence (Molior - reliant on developers uploading)
• Agents (reports - pretty reliable)

Question 3

What is a useful trigger for important data collection dates?

Answer 3

Diaries

• Rent collection
• Rent review notices
• Insurance renewals
• Regular inspections
• Repairing obligations
• Break clauses
• Planning obligations

Question 4

What is triangulation?

Answer 4

Verifying data against an alternative source

Question 5

What do data security technologies include?

Answer 5

• Disk encryption
• Regular backups off site
• Cloud storage
• Password protection
• Anti-virus protection
• Firewalls
• Disaster recovery

Question 6

What is copyright?

Answer 6

• Set of exclusive rights granted to the author / creator of original work, including right to copy
• Rights can be licensed, assigned or transferred
• Form of intellectual property
• Crown copyright (all material prepared by Gov like laws, public records, press releases, OS mapping)
• Must acknowledge copyright in your work

Question 7

What is the key legislation regarding data protection in the UK?

Answer 7

Data Protection Act (2018)
UK General Data Protection Regulation and the Data Protection Act (2018)

Question 8

What is the purpose of UK GDPR?

Answer 8

• Single data protection regime
• Affects businesses, with the goal to empower individuals to control how their data is used by third parties
• Right to be informed how data is used

Question 9

What are the requirements of UK GDPR?

Answer 9

• Data protection impact assessment for high risk holding of data
• Rights for individuals to have access to personal info held and have it erased
• Data controller decides how and why data is processed and responsible
• ‘Data accountability’ ensures firms can prove to the ICO (Information Commissioner’s Office) how they comply with regs)

Question 10

What is the penalty for security breaches?

Answer 10

• Breaches must be reported to ICO within 72 hours where there is a loss of personal data and risk of harm
• Fine of 4% turnover, or £17.5 million (whatever is greater)

Question 11

Who polices UK GDPR?

Answer 11

Information Commissioner’s Officer

Question 12

What are the principles of UK GDPR?

Answer 12

Article 51:

• Process lawfully and transparently
• Collect for specified and legit reasons
• Limited to what is necessary
• Accurate and kept updated
• Kept in a form which permits identification

Question 13

What are the 8 individual rights under UK GDPR?

Answer 13

• Right to be informed
• Right to access
• Right to rectification
• Right to erasure
• Right to restrict processing
• Right to data portability (to use for their own purposes)
• Right to object
• Rights to automated decision making and profiling (as undertaken by insurance companies)

Question 14

What legislation gives individuals right of access to information held by public bodies?

Answer 14

Freedom of Information Act (2000)

Question 15

What does the Freedom of Information Act (2000) set out?

Answer 15

• Public body must tell any individual requesting the info if it holds it
• Required to supply info in 20 days
• It can charge

Exemption: If it would prejudice a criminal matter under investigation, or a persons/firms commercial interest

Question 16

Is there anything emerging on cybercrime?

Answer 16

Proposed RICS Professional Standard on Data Handling and Prevention of Cybercrime

• Best practise
• Mandatory obligations
• How surveyors must capture, store and share data appropriately

Question 17

What is an NDA?

Answer 17

• Legally enforceable contract between a person with sensitive information and a person with access to that information
• If breached, take legal action and seek damages for losses incurred

Question 18

When do you use data management in your role?

Answer 18

ACC - Store and share the most recent information between the design team. Have to be given special permission by LL to access it.

Contractor records
Contract records
Photos
Health records

Question 19

What data do you need? What do you need the data for? What is the data source? What format is the data? Can you verify the data is accurate?

Answer 19

Design info from consultants
Market info from agents / Molior

Question 20

What are you going to do with the data? Method of analysis / methodology?

Answer 20

Submit it for planning
Use it to inform further design
Use it to position products

Question 21

How will you present data?

Answer 21

Baked into design
Presented in a presentation / report

Question 22

What is Lendlease’s policy on data storing / how long can you store it for before it has to be erased?

Answer 22

Only as long as necessary under GDPR

Question 23

What is key legislation?

Answer 23

Data Protection Act (2018)

• Controls how your data is used by organisations and the government
• UK’s implementation of GDPR (EU initative that was readopted after Brexit into the Data Protection Act). Under GDPR, implemented by the Data Protection Act (2018):
• Data protection principles (used fairly, lawfully, transparently, adequate, relevant and limited, specified purposes, up to date, kept no longer than necessary, stored properly)
• Strong data protection on genetics, religion, health, sexual orientation, criminal conviction
• You have right to see how data is being used (informed, access, corrected, erased, object, up to date)

Question 24

What is BIM?

Answer 24

Building Information Modelling

To plan, design, construct and manage buildings

Levels 0-3 (public sector has to reach 2)

Question 25

What is a federated BIM model?

Answer 25

- BIM model compiled from several different BIM models from different disciplines into one - Controlled by BIM coordinator (often architect) and laid out BEP (BIM Execution Plan)

Question 26

What is a common data environment?

Answer 26

Single source of information for the project, used to collect and manage documentation, graphical model and non-graphical data for the whole project team. E.g. SharePoint

Question 27

What is the key difference between the Data Protection Act (2018) and the General Data Protection Regulations (2018)?

Answer 27

Data Protection Act (2018) is a complete data protection system (governs GDPR, general data, legal enforcement, and national security data)

Question 28

Are you aware of any emerging guidance on data management?

Answer 28

The RICS launched a consultation in March 2025 on new professional standard for responsible AI use. - Provide guidance on the ethical and practical considerations of AI in the natural and built environment.