What Does UK GDPR Actually Mean for Letting Agents?

Every letting agency handles personal information – it comes with the job. From the moment a prospective tenant submits an enquiry, you’re collecting and processing data that belongs to a real person. That responsibility continues throughout the tenancy and, in some cases, even after it ends.

UK GDPR (the UK General Data Protection Regulation), together with the Data Protection Act 2018, sets the rules for how organisations collect, use, store and protect personal information. For letting agents, it’s not a separate task or an annual compliance exercise; it’s part of the everyday process of managing tenancies professionally.

Think about a typical tenancy journey. A prospective tenant books a viewing, submits an application, provides proof of identity, employment details, bank information and references. During the tenancy, your agency may also hold inspection reports, maintenance records, email conversations and Right to Rent documentation. Every stage involves personal data, which means every stage must be handled responsibly.

The key principle is straightforward: collect only the information you genuinely need, use it only for legitimate purposes, keep it secure and don’t retain it longer than necessary. These principles underpin UK GDPR and help agencies build trust while reducing the risk of data breaches or complaints.

The Information Commissioner’s Office (ICO), the UK’s independent authority for data protection, expects organisations to demonstrate accountability-not just by following the law, but by having clear processes in place to show that personal information is handled responsibly. For letting agents, good data protection isn’t about adding more paperwork; it’s about ensuring the systems and habits your team already relies on are working in the right way.

What Counts as Tenant Data?

When people hear the term “personal data,” they often think of obvious information like a tenant’s name or passport. In reality, UK GDPR defines personal data much more broadly.

If a piece of information can identify a person – either on its own or when combined with other information, it’s considered personal data and should be handled accordingly.

For letting agents, that means tenant data exists throughout the entire tenancy journey, not just during the application process.

‍

‍

The key point is simple: if the information relates to an identifiable tenant, applicant or guarantor, it’s likely to be protected under UK GDPR.

Collecting Tenant Information the Right Way

Every tenancy starts with collecting personal information. From identity documents and employment references to bank details and Right to Rent checks, much of this information is essential for carrying out your role as a letting agent.

UK GDPR doesn’t stop agencies from collecting this data. It simply expects you to have a clear reason for asking for it.

A good rule to follow is this: only ask for information that’s genuinely needed to progress the tenancy or meet a legal requirement. Collecting extra documents “just in case” or keeping information that no longer serves a purpose can create unnecessary compliance risks.

Before requesting any personal information, it’s worth asking yourself:

• Do we actually need this information?  

• Is there a clear reason for collecting it?  

• Would we be able to explain that reason if a tenant asked us?  

If the answer to those questions is yes, you’re already following one of the core principles of UK GDPR.

ICO Registration Requirements

Most landlords are required to register with the Information Commissioner’s Office (ICO) and pay an annual data protection fee. The fee is determined by your turnover and number of employees. For most individual landlords, the fee is £40 per year (Tier 1: organisations with turnover up to £632,000 and fewer than 10 employees). Larger operations pay £60 (Tier 2) or £2,900 (Tier 3).  

Registration is done through the ICO’s online portal and takes approximately 10 minutes. You will receive a registration number that is publicly listed on the ICO’s register. You must renew your registration annually.

Authoritative Guidance

1.Information Commissioner’s Office (ICO) – Lawful Basis for Processing

This guidance explains that organisations must have a lawful basis for processing personal data. For letting agents, this commonly includes processing data to fulfil a tenancy contract, comply with legal obligations (such as Right to Rent checks), or pursue legitimate business interests.

Official guidance:
https://ico.org.uk/for-organisations/uk-gdpr-guidance-and-resources/lawful-basis/

2. Information Commissioner’s Office (ICO) – Data Minimisation Principle

The ICO states that organisations should collect only the personal data they need and ensure it is adequate, relevant and limited to what is necessary for the purpose it is being processed.

Official guidance:
https://ico.org.uk/for-organisations/uk-gdpr-guidance-and-resources/data-protection-principles/a-guide-to-the-data-protection-principles/data-minimisation/

3. GOV.UK – Right to Rent Landlords’ Code of Practice

This guidance explains when landlords and letting agents are required to verify a tenant’s immigration status, making identity checks and related document collection a legal requirement in England.

Official guidance:
https://www.gov.uk/government/publications/right-to-rent-landlords-code-of-practice

Why a Privacy Notice Matters

A Privacy Notice is a document that explains to tenants how their personal information will be collected, used, stored and shared. Under the UK GDPR, it should be provided when personal data is first collected – such as during a tenancy application or before a tenancy agreement is signed.

A clear Privacy Notice should tell tenants:

• Who is collecting their data.  

• What information is being collected and why.  

• Who it may be shared with, where applicable.  

• How long it will be kept.  

• What rights they have under UK GDPR, including the right to access or correct their personal information and how to contact the ICO if they have concerns.  

Being transparent from the outset not only supports compliance but also helps build trust with prospective tenants.

Subject Access Requests (SARs)

Under Article 15 of the UK GDPR, tenants have the right to request a copy of the personal information you hold about them. This is known as a Subject Access Request (SAR). In most cases, you must respond within one calendar month and free of charge.

When responding, provide the requested personal data along with information about how it’s used, who it’s shared with and how long it’s retained. If documents contain another person’s personal information, that information should be redacted where appropriate.

Good practice: Have a simple internal process for logging and responding to SARs so requests can be handled within the legal deadline.

Using CCTV at Rental Properties? Here’s What You Need to Know

If your agency or landlord clients use CCTV or smart doorbells, the footage may be classed as personal data under UK GDPR.

Cameras should only be used for legitimate purposes, such as security, and must not be installed in areas where tenants have a reasonable expectation of privacy, including bedrooms or bathrooms. Clear signage should also inform people that CCTV is in operation.

As a general rule, CCTV footage should only be kept for as long as necessary, with many organisations following a 30-day retention period unless an incident requires it to be retained for longer.

What Should You Do If a Data Breach Occurs?

A data breach isn’t limited to cyberattacks. It can include emailing tenant information to the wrong person, losing documents or allowing unauthorised access to personal data.

If a breach is likely to pose a risk to individuals’ rights and freedoms, it must be reported to the ICO within 72 hours of becoming aware of it. Agencies should also keep an internal record of every breach, even if it doesn’t need to be reported.

Acting quickly and having a documented response process can significantly reduce the impact of a breach.

Understanding the Consequences of Non-Compliance

The ICO has the power to issue warnings, enforcement notices and financial penalties where organisations fail to meet their data protection responsibilities. For the most serious breaches, fines can reach £17.5 million or 4% of annual worldwide turnover, whichever is higher.

For most letting agencies, however, the biggest risk isn’t the fine itself – it’s the loss of tenant trust, reputational damage and the time spent dealing with complaints and investigations. Strong data protection practices help protect both your tenants and your business.

A Simple GDPR Checklist for Every Letting Agency

You don’t need dozens of policies or a dedicated compliance team to build good data protection practices. In most cases, having a few clear processes in place can make a significant difference.

Here’s a practical checklist every letting agency should review:

✔ Have a clear Privacy Notice

Tenants should understand what information you collect, why you collect it and how it will be used.

✔ Store personal information securely

Whether documents are stored digitally or on paper, they should only be accessible to authorised staff.

✔ Review who has access to tenant data

Regularly check user permissions across your CRM, property management software and shared folders.

✔ Keep a data retention policy

Know what information needs to be kept, what can be archived and when records should be securely deleted.

✔ Have a process for reporting data breaches

Everyone in the business should know what to do if personal information is accidentally lost, shared or accessed by the wrong person.

✔ Keep your team informed

Data protection isn’t a one-time exercise. Regular reminders and basic staff training help ensure everyone follows the same good practices.

Final Thought

Good data protection isn’t about creating more administration. It’s about putting simple, consistent processes in place so your team can handle tenant information confidently and responsibly every day.

About Eumentis AI

At Eumentis AI, we help real estate businesses streamline customer communication with AI-powered voice agents that answer enquiries, qualify leads, schedule appointments and handle routine conversations 24/7. By automating repetitive tasks, agencies can respond faster, improve the customer experience and free their teams to focus on higher-value work.

‍