Profile information Account settings
Sign up Log in

Data protection for private landlords

When you take on a new tenant you will be collecting, storing and using their personal information. As a landlord, it is your responsibility to comply with data protection laws in relation to your tenant’s personal data. Read our guide to find out what your obligations are.

To comply with UK GDPR, one of the first steps for landlords is to identify what tenant personal data they will be processing. 

Personal data is information that can make your tenant identifiable and includes:

  • names

  • addresses

  • dates of birth

  • email addresses

  • passport numbers 

Processing is any use of personal data (other than for personal reasons) and includes storing, recording and obtaining. For more information, read Processing personal data.

Landlords should ensure that they conduct an audit to assess their data processing activities to establish the data they hold, who it is shared with and how long it is stored.

Landlords must have a ‘lawful basis’ to process (eg store or collect) personal data. Personal data can only be processed where at least one ground has been met. 

While there are a variety of lawful grounds for the processing of personal data, the main purpose for a landlord to process a tenant’s data includes having a:

  • legitimate interest - where there is a compelling reason to have and process personal data, including commercial interests such as the existence of a tenancy agreement

  • contractual interest - where processing is necessary for the performance of a contract (eg using a tenant’s data to fulfil a contractual obligation, such as passing their details for the purpose of a repair)

  • legal interest - where data is processed in order to comply with a legal obligation (eg landlords must take tenant’s data for deposit schemes)

Landlords who are holding, storing or processing their tenant’s data, need to register with the Information Commissioner Office (ICO), paying any necessary fees. For example, if you are processing personal data to produce tenancy agreements/contracts, perform credit checks on prospective tenants and obtain references, then this requires you to pay a data protection fee. 

If landlords do not register and pay the fee, they can be at risk of tenants complaining to the ICO about alleged misuse of their data and this may offset an investigation and penalties from the ICO.

If your letting agent manages your property for you and carries out the data protection processing activities, and you as the landlord receive a monthly statement and rent, then you may fall into the accounts and records exemption and may not be required to pay the ICO registration fee. This exemption covers personal data that is processed in electronic formats to provide invoicing and accounts. 

If you are unsure if you need to register with the ICO, you can use their online webtool to find out more.