Data Sharing & Confidentiality

Understand how GRESB manages and protects participant member data.

Access to Submitted Data

Who can see my assessment response?

Data is submitted to GRESB through a secure online platform. It can only be seen by current GRESB staff and, to a more limited extent, authorized personnel from GRESB’s third-party validation provider, Sustainability Assurance Services (SAS).

Access to Assessment Results

Who can see my assessment results?

GRESB Scores are not made public. Results and data output of the GRESB Infrastructure Assessments are only disclosed to the participants themselves and their investors:

• Non-listed entities: GRESB Investor Members associated with the company/fund must request access to a non-listed participant’s Benchmark Report results. This gives the participant control over accepting or denying this request.

• Listed entities: All GRESB Investor Members are granted automatic access to the Benchmark Report results of listed entities.

Access to Uploaded Evidence

Entities can disclose or withhold any documentation provided as evidence from GRESB Infrastructure Investor Members. Each uploaded document has a checkbox, with the default set to ‘not available’. When opted into by the participant, this makes the evidence available to all investors with access to that entity. If the entity chooses to share its evidence with investors, it will appear in the Benchmark Report.

Note that it is impossible to share documents with investors on a case-by-case basis.

Access to Open Text Boxes

The open text boxes are included in the GRESB Benchmark Report.

Can I hide my GRESB results (Grace Period)?

First-year participants can submit the assessment without allowing GRESB Investor Members to request access to their results. This is referred to as a “Grace Period.” The Grace Period allows participants a year to familiarize themselves with the GRESB reporting and assessment process. First-year participants who wish to report under the Grace Period can select this option on an entity-by-entity basis from the settings section in the Assessment Portal. After receiving their preliminary results during the Review Period, participants can still choose to disable the Grace Period.

Once final results are released on October 1, participants can still opt in or out of the Grace Period to restrict investor access to their results through the portal. However, any changes made after the final results are released will not hide the GRESB Score in the Benchmark Report. This is because the Benchmark Report is static and hard-coded, meaning the participant's score will remain visible in the report's Scorecard. While investors will not be able to access the participant's results through the portal, the historical scores from the current year will still appear in the following year’s Benchmark Report.

The Grace Period is not available in the second year of participation, regardless of whether it was used in the first year or not.

GRESB still discloses the entity/fund’s participation status during its Grace Period (see Disclosure of GRESB Participant Members section).

Participant Disclosure & Visibility

Who can see my participation status?

GRESB does not disclose a participant’s data to other participants as a default.

An entity’s participation status is disclosed in the GRESB Participant Directory

• Funds: GRESB displays the fund manager name for listed and non-listed entities.

• Assets: GRESB displays the asset name for listed and non-listed entities.

Can I see other participants' scores?

Before the start of the Infrastructure Assessments, GRESB provides an opt-in option in the portal that will disclose the entity’s name, as well as the scores for the different components, to other participants in the GRESB Model of the Benchmark Report who also opted to disclose their name and component scores.

Data Protection & Security

GDPR Compliance

GRESB is fully compliant with GDPR. The GRESB Privacy Statement can be found here. We also have specific internal policies, such as our Data Breach Policy and our Data Protection Policy, related to GDPR that we cannot share externally for security reasons. Please note that asset-level data does not fall under the incidence of GDPR because it does not contain any personal data.