NVM files after the transaction: retention period and destruction
An estate agent file contains sensitive data: identification of buyer and seller, income statements for financing capacity, valuation reports, purchase deeds, correspondence, bank statements for Wwft. After the transaction, the notary and the cooling-off period the file continues to exist. But not forever. This article explains which periods are relevant for estate agents, which NVM code-of-conduct obligations come into play, and how destruction is organised in practice.
The NVM code of conduct as a starting point
NVM-registered estate agents are bound by the Honour Code and the rules of conduct of the trade association. These prescribe diligence and confidentiality both during and after service delivery. Specific retention periods are not always explicitly stated; they follow from the legal frameworks to which the NVM agent must adhere, in particular the Wwft, the GDPR and the tax retention obligation.
Wwft: 5 years after the end of the client relationship
Estate agents are subject to the Wwft when mediating in the purchase and sale of real estate. This means client due diligence, identification and a duty to report unusual transactions. All of that documentation (copy of ID, UBO check, transaction file) must be retained for at least five years after the end of the client relationship or after the transaction is completed. See also Wwft 5 years of client due diligence.
Tax retention: 7 years
Administrative records with tax relevance, such as invoices, commission notes, the general ledger and the office's cost statements, fall under seven years. This period mainly affects the office's administration. Data on the property itself (purchase and sale data relevant for transfer tax or WOZ) can remain relevant for longer, but that usually sits with the owner and the notary, not with the estate agent.
GDPR storage limitation
Article 5(1)(e) GDPR states that personal data may not be stored longer than necessary. Once the legal periods have passed, destruction is required unless another basis still applies (for example a pending disciplinary case or dispute). The "just in case" argument is not a valid basis under the GDPR.
An estate agent's office that keeps every file since its founding in the attic will at some point have ID copies from 2001 on the premises. That is a data breach waiting to happen.
A workable retention matrix for estate agents
- Wwft identification, UBO, transaction assessment: 5 years after end of service.
- Correspondence around the mediation: pragmatically 5 years.
- Valuation reports and bid documents: 5 years.
- Copy of purchase deed and transfer deed: originals sit with the notary; the agent's copy 5 years.
- Commission notes and office administration: 7 years for tax purposes.
- Copy of ID for non-clients (such as viewing forms): as short as practical, usually a maximum of 1 year.
Cleaning up after the period
Many offices work with an annual clean-up day. Files that are 5 years (or 7 years for the fiscal component) past completion go into destruction bags or containers. Separating Wwft material from tax documents saves work: you destroy what you may, you keep what you must.
Destruction standard
Estate agent files contain personal data, BSN numbers (on ID copies), financial data and sometimes special categories (medical data in valuations for divorce cases). The standard for confidential personal data is DIN 66399 P-5. A regular office shredder is not sufficient. Read the background in DIN 66399 explained P-5 P-6.
Mobile destruction at the office
For estate agencies in the Amsterdam-Noord region, DeSnipperaar comes to your office with a mobile shredder truck. The files do not leave the premises intact. You or your branch manager watches through the side window and signs the certificate afterwards. An annual round is enough for most offices; for high volumes or seasonal peaks (spring and autumn clean-ups), we advise additional rounds.
Annual clean-up of old purchase files?
We come to your office, destroy the expired files on the spot in line with DIN 66399 P-5 and deliver a certificate immediately. No contract, no minimum.
Request a quoteRecording in the processing register
Record in the GDPR processing register: which categories of files, which retention period, which destruction processor. Attach the certificate per clean-up round. In the event of a DPA inspection or disciplinary complaint, this is your proof that you structure the clean-up rather than leaving "everything in the attic".
Sector page
More about our approach for estate agents, valuers and property offices on Estate agents & valuers. Also read privacy of listing photos after the sale.
Ready to tackle the archive cabinet? Request a no-obligation quote. We think along about what does and does not need the strict standard.