Data protection and accessibility for a luxury real estate agency website in Dublin: what to require (2026)

The verdict in three sentences

For a luxury estate agency in Dublin, valuation and viewing request forms are the real entry point for instructions, and they carry most of the site's GDPR risk. Require from your provider a cookie banner where rejecting is as easy as accepting, an Article 28 processor agreement, a written retention period for each form and a site that meets WCAG 2.1 AA with an accessibility statement. These requirements cost little when they are in the quote, and a lot when they are bolted on after launch.

Which framework applies in Dublin?

A few facts are enough to frame the brief. The GDPR applies, supplemented in Ireland by the Data Protection Act 2018, and the Data Protection Commission (DPC) is the supervisory authority. Its cookie guidance rules out pre-ticked boxes and expects rejecting to be as accessible as accepting, with no non-essential trackers firing before consent. A personal data breach that poses a risk must be notified to the DPC within 72 hours. On the professional side, property services providers must hold a licence from the Property Services Regulatory Authority (PSRA), and the licence details expected in advertising should be checked with the authority. Finally, the European Accessibility Act has applied since June 2025 to certain products and services, including e-commerce, with an exemption for microenterprises providing services; an agency brochure site is not necessarily in scope, but WCAG 2.1 AA remains the sensible benchmark. This is not legal advice.

What should you require from the provider, point by point?

Two points are specific to the luxury segment. Vendors of multi-million euro homes often ask for discretion: plan off-market listings without an exact address or identifiable interior shots. Virtual tours and videos need captions, and photo galleries must work with a keyboard, with alt text that describes the room without revealing security details.

What budget should you plan in Dublin?

The local ranges are a 2026 ballpark based on typical agency quotes and public agency rate pages in the area.

Kolonell packages include a project manager reachable on Dublin time, native English and French copywriting, delivery in 3 to 4 weeks and 3 months of support. We built the site of Orven Properties (orvenproperties.com), a real estate agency in Dubai. Details are on the international websites page.

Which questions should you ask before signing?

• Which cookies and third-party scripts load before consent?
• Where are valuation requests stored, and for how long?
• Who are your sub-processors (host, email delivery, maps)?
• How and how quickly will you tell us about a data breach?
• Which WCAG level do you commit to, and who carries out the audit?
• Who drafts the accessibility statement?

Mini case study

Illustrative example: Aoife, director of a four-negotiator luxury agency in Ranelagh, receives about 35 valuation requests a month. With 24 months of retention, her database permanently holds 35 × 24 = 840 records of private individuals. By cutting retention to 12 months for prospects who do not proceed, she drops to 420 records and halves her exposure in case of an incident. On budget, a local quote of EUR 22,000 plus a EUR 3,000 audit comes to EUR 25,000; the Growth package at EUR 4,500 plus a EUR 2,000 external audit comes to EUR 6,500, a gap of EUR 18,500.

FAQ

Is an accept-all cookie banner enough?

No, under DPC guidance rejecting must be as easy as accepting and boxes must not be pre-ticked. You can test it in 5 minutes by checking that no analytics cookie is set before a choice is made.

How long should we keep a valuation request?

The GDPR sets no fixed period, but requires one justified by the purpose. Many agencies keep prospects who do not proceed for 12 to 24 months, with automatic deletion.

Does the European Accessibility Act apply to our site?

It covers certain services such as e-commerce, with an exemption for microenterprises with fewer than 10 staff. Even out of scope, targeting WCAG 2.1 AA costs little at build time, versus EUR 1,500 to 5,000 for an audit and fixes afterwards.

Is the web provider a processor under the GDPR?

Yes, as soon as it hosts or can access form data. An Article 28 compliant agreement should then be signed before go-live, with its list of sub-processors.

What if the site suffers a data breach?

The breach must be notified to the DPC within 72 hours if it poses a risk to individuals. The contract should require the provider to alert you without delay, for example within 24 hours.

Let's scope your project. A luxury estate agency site with lean forms, a compliant cookie banner and WCAG 2.1 AA accessibility, from EUR 2,700 to 8,200, delivered in 3 to 4 weeks. See the international offer or request a free quote: detailed reply within 48 hours.