Data management questions
Data management now runs from how you name a file to what you do when client information leaves the building. Panels ask it because surveyors handle commercially sensitive figures and personal data as a matter of routine, and because the consequences of getting it wrong land on the client.
Data management
Manage, secure and apply data and information appropriately: sources, storage, retrieval, and the legislation covering data management and access (incl. GDPR). Mandatory to Level 1.
What the assessor is listening for
- That you distinguish personal data from commercially confidential information, and treat both correctly for the right reasons.
- That you can describe a control you personally operate, not the policy your IT department wrote.
- That you know the first hour of a suspected breach matters most, and who you tell in it.
- Judgement about what should be shared, with whom, and in what form.
Level 1
Knowledge & understanding - you can explain the principle.
- What kinds of data do you handle, and which of it is personal data?A strong answer covers: The split between personal data and commercially sensitive information, with real examples from your own work, and why the two attract different obligations.
- What are the main principles of data protection law as it applies to you?A strong answer covers: The principles in your own words, particularly minimisation, purpose limitation and retention. Then the one that most changes how you work.
Level 2
Application - you have done it yourself and can describe how.
- How do you keep a client's commercially sensitive information secure day to day?A strong answer covers: Concrete controls you operate: access restrictions on the project folder, what you do and do not put in an email, how tender information is issued and returned, and what happens to it at the end of the job.
- You are working for two clients bidding for the same scheme. What are your data obligations?A strong answer covers: Information barriers, who is inside and outside them, what you personally cannot carry between teams, and the fact that this is a conflict question as much as a data one.
- How long do you keep project records, and who decides?A strong answer covers: That there is a retention policy, what drives its periods (limitation, insurance, the appointment), and what happens at the end of it. Say what your firm's actually is rather than what it should be.
Level 3
Reasoned advice & depth of judgement - you have advised others and can justify decisions and trade-offs.
- You send a cost report to the wrong distribution list. Walk me through the next hour.A strong answer covers: Containment first (recall, ask for deletion, confirm what was in it), then notification internally to the person who owns breaches, the assessment of whether personal data was involved and whether it is reportable, and the record you make.
- How would you advise a client on sharing cost data with their supply chain?A strong answer covers: What can be shared and in what form (benchmarks and rates versus a live tender return), the confidentiality obligations already in the contract, the commercial exposure of over-sharing, and the recommendation.
- What are the risks of putting project data into an external tool, and how would you manage them?A strong answer covers: Where the data goes, what the terms allow the provider to do with it, whether it contains personal or client-confidential material, redaction as the practical control, and the approval you would seek before using it at all.
How candidates lose this one
Answering with an acronym and stopping. Naming the regulation is Level 1; the panel is looking for what it changed in your working week.
Assuming this is somebody else's job. The candidate who says the IT team handles it has answered the question with an admission.
More RICS APC questions
Interboard is independent practice software and is not affiliated with or endorsed by RICS, IChemE, or any awarding body. It does not provide accreditation and does not guarantee any assessment outcome.
Now answer them out loud
Run a full RICS APC mock interview against a live panel that reads your own submission and follows up on what you say.
Not ready? Take the 2-minute demo tour first - no sign-up.