Data protection and GDPR for landlords

Why it matters

A tenant data request or a lost laptop turns an ignored obligation into a reportable incident.

Legal requirements

• Most landlords processing tenant data must register with the Information Commissioner and pay the data protection fee.
• A lawful basis is required for each processing purpose, usually contract or legal obligation.
• Data must be kept no longer than necessary and held securely.
• Subject access requests must be answered within one month.

Common mistakes

• Keeping copies of passports indefinitely with no retention rule.
• Sending tenant details to contractors without limiting what is shared.
• Using personal email and phone storage with no backup or access control.
• Ignoring a data request because it arrived informally.

Practical guidance

• Register with the Information Commissioner if you have not already.
• Write a one page privacy notice and give it at the start of every tenancy.
• Set retention periods and delete on schedule after a tenancy ends.
• Store documents in a controlled system rather than a phone camera roll.

Retention in practice

Right to rent evidence is kept for a defined period after the tenancy ends. Tax records are kept for at least six years. Reference reports rarely need keeping beyond the end of the tenancy plus a short period. Write your periods down, then actually delete. Holding everything forever is the default failure mode and is exactly what regulators criticise.

Answering a subject access request

Acknowledge in writing, confirm identity, then search everything: emails, messaging apps, notes, systems and paper. Provide the personal data within one month, redacting third party information. Do not refuse because you are annoyed at the timing. A calm, complete response usually ends the matter, while a refusal invites a complaint to the regulator.