Aurelia & Vale is a fictional boutique property firm, but the question that opened its spring partner meeting is one real firms hear constantly: a co-listing agency had asked for “an anonymised” export of interested-buyer contacts, and Camille, who runs client operations, had promised an answer by Friday. Her honest first response was to ask what the sender thought anonymised meant — because the two agencies had very different definitions, and only one of them survives contact with a courtroom. What her team spent the quarter learning has a name, DataSecOps, and the story travels well beyond estate agency.
The partnership that raised the question
Co-listing agreements work on shared effort and shared files: photographs from one side, viewing schedules from the other, and interested-party lists from whoever took the enquiry. Aurelia & Vale had been sending those lists as spreadsheets with the names deleted — nothing more. Camille asked a colleague to open the last export and read out what remained per row:
- the postcode district, exact enough to cover a handful of streets;
- a budget band that matched one known bidder almost perfectly;
- viewing dates, including the second, unaccompanied visit;
- a free-text note about accessibility needs from the family;
- the outcome flag: “second call, offer expected”.
None of those cells contained a name. All of them together described a person. The remaining rows still carried postcode districts, budget bands, viewing dates and family notes from viewings (“needs ground-floor access — mother in residence”), which is precisely the combination that lets a patient reader reattach names, especially in a market where the same thirty buyers circle the same ten streets. Camille’s Friday question became a quarter-long project, and the firm is better for it; but the starting point was recognising that a deleted name column is a gesture, not a safeguard.
DataSecOps in plain estate-agent terms
The name her research kept returning to is young. It entered the vocabulary in August 2021 through a definition published by Satori Cyber’s Ben Herzberg, and it has stayed a vendor’s label — adopted by no standards body, with the practice’s established name remaining data security governance. What the label contributes is a working stance: guarding information while both the records and the people around them keep moving. the Atlas page introducing DataSecOps adds the detail that made it click for Camille — decisions bind at the smallest level available — one record, one field, or one lookup, which maps naturally onto property records: a buyer row, a budget column, a single viewing lookup. A spreadsheet is just a database wearing a nicer jacket. The practice’s territory, in her notes: find the records, label what is sensitive, guard the doors, put dates on access, watch files leaving, and audit the whole thing on a schedule. Privacy law and staff identities live in neighbouring disciplines, which mattered for the Friday answer — Camille could fix the firm’s own habits without waiting for anyone’s legal department.
The ruling that settled the anonymised debate
On the legal side, Europe’s top court had already done the homework. In case C-413/23 P (EDPS against SRB), decided on 4 September 2025, the court drew the line by capability: give pseudonymised records to someone who truly cannot rebuild identities, and the law no longer treats that copy as personal data — yet the version retained by the custodian of the mapping never loses that status. Applied to the co-listing request: if Aurelia & Vale strips names but keeps its own master list, what leaves the building is pseudonymised, not anonymised, and it still demands care. European data-protection advisors have said the same in so many words — treating pseudonymisation by itself as normally falling short of sufficient protection. The Friday answer, drafted accordingly: the agency could receive viewing-schedule data for active listings, scoped and logged, but broad buyer lists were off the table. Marketing teams on both sides grumbled for a week, then adapted, because the ruling cuts in their favour too — data shared under proper controls is data they can defend. The master list, meanwhile, gained its own guard: only two people can reach the mapping that connects stripped rows to names, and both know that holding the key means holding the personal data itself.
Access with an end date
The quarter’s practical work fixed how outsiders touch files at all. Property runs on temporary helpers — photographers, stagers, inspectors, drone pilots — and each of them had historically received “a link” that never died. The new arrangement made every request carry three things: the file, the reason, and the date the access ends. A typical request fits in one sentence — drone footage folder for the Hillcrest listing, marketing shoot on the 14th, access ending the 15th — and approvals land the same day for routine cases, while anything unusual needs a short written risk note attached. Owners approve requests the way editors approve changes, an automated pipeline implements whatever is approved, and the expiry does its own housekeeping. When the photographers’ contracts renewed in June, last season’s links were already gone — no awkward emails, no forgotten folders. A quarterly review then checks every remaining permission and removes what nobody used, which is the part most firms plan and then skip; the discipline is blunt about this: a review that revokes nothing was never a review. Aurelia & Vale’s first review deleted a third of its standing links, including a portal login from an agency partnership that had ended two years earlier — the kind of fossil every firm owns and none of them lists.
What DataSecOps changed for clients
Nothing visible — and that is the point. Viewings happen the same way; offers land the same way; the website looks untouched. What changed sits underneath: fewer copies of buyer lists, partners receiving scoped files rather than spreadsheets, and an office that can answer “who has seen my details?” with a log instead of a guess. Vendor due diligence got easier too — the security questionnaires that used to consume a week now draw straight from the quarterly review’s own notes. Clients of prime property already judge firms on discretion — it runs through the critical role of discretion in prime property, shapes a personalised luxury client experience, and underpins the way this firm approaches complex property decisions. DataSecOps, in the end, is discretion with receipts: the same promise Aurelia & Vale made at handshakes, now written where an auditor — or a client — can read it. Camille’s Friday answer took a quarter to arrive and one paragraph to state. The partner agency, to its credit, asked for the same treatment on its side the following month.
