Landlord GDPR & Data Protection UK 2026: Complete Guide

The moment you take a reference, copy a passport for a Right to Rent check, hold a tenant's bank details or keep an arrears history, you are handling personal data. That makes you a data controller, and the UK GDPR (as amended by the Data (Use and Access) Act 2025) and the Data Protection Act 2018 apply to you just as they do to any business.

Most landlords never think about it, and the Information Commissioner's Office (ICO) is not knocking on doors over a single buy-to-let. But data protection turns up at exactly the wrong moments. An unhappy ex-tenant asks for a copy of everything you hold on them (a subject access request), a referencing email goes to the wrong address, or a deposit dispute turns on records you should no longer have. This guide covers what you actually have to do.

Guidance, not legal advice. Fees and thresholds change, so confirm anything material on ICO.org.uk or GOV.UK before you rely on it.

Do I have to register with the ICO (and pay the fee)?

Probably yes. If you process tenant personal data electronically for your letting business, you generally must register with the ICO and pay the annual data protection fee. That includes keeping records on a computer or phone, using referencing or rent software, or receiving tenancy documents by email.

• The fee is tiered by size and turnover, currently ranging from about £52 to £3,763 a year. Almost every private landlord falls in the lowest tier (around £52), with a small discount for paying by direct debit.
• The narrow exemptions (for example processing done purely for your own household, or entirely on paper with no computerised records) rarely fit a landlord running a lettings business in 2026.
• Not paying the data protection fee when you should can lead to a fine, so it is a cheap thing to get wrong expensively.

Check the current fee and register on the ICO's own site; it takes a few minutes.

Registering is the easy part; knowing what you hold is harder. From £7.99 a month, LetCompliance keeps each tenant's application, referencing, Right to Rent check and signed agreement on the tenancy with their dates, rather than across inboxes and phones, so a subject access request starts from one record. Get started

Your lawful basis: pick the right one

UK GDPR says you need a lawful basis (a recognised legal reason) for each way you use personal data. For most of it, that reason is not "consent", and that is the biggest landlord misconception. The bases that actually fit letting are:

• Contract: processing needed to perform the tenancy: collecting rent, managing the tenancy, handling repairs. This covers most day-to-day data use once a tenant is in.
• Legitimate interests: referencing an applicant, chasing arrears, keeping records to defend a possession or deposit claim. This is the workhorse basis, but you must do and record a short Legitimate Interests Assessment (LIA): a purpose test, a necessity test, and a balancing test weighing the tenant's privacy against your interest.
• Legal obligation: Right to Rent checks (Immigration Act 2014), keeping gas/electrical safety records, and retaining tax records for HMRC. You are compelled by law, so this is your basis for those.
• Consent: reserve this for genuinely optional things, like marketing emails. Consent must be freely given and easy to withdraw, so it is the wrong basis for anything you actually need to run the tenancy.

Getting the basis right matters because it determines the tenant's rights and what you must say in your privacy notice.

The privacy notice

You must give every tenant (and ideally every applicant) a privacy notice at or before the point you collect their data. In plain English it tells them: who you are, what data you hold, your lawful basis, who you share it with (referencing agency, deposit scheme, contractors, the local council, HMRC), how long you keep it, and how to exercise their rights.

It is a one-off document you can reuse across tenancies, issued with a dated email so you can prove you provided it. If your notice relies on legitimate interests, it must say so and summarise your LIA. See the tenant privacy notice guide for a landlord-ready template and the exact fields to include.

How long should you keep tenant data?

The UK GDPR sets no fixed retention period: the principle is that you keep data only as long as you have a reason to. In practice:

• During the tenancy plus about six years afterwards is the widely accepted default, because the limitation period for most contract claims is six years and HMRC expects tax records to be kept for around six years too. That window lets you defend a deposit dispute, an arrears claim or a tax enquiry.
• Right to Rent copies should be kept for the duration of the tenancy and for one year after it ends, then securely deleted. Holding immigration documents indefinitely breaches the rule that you keep only what you need (data minimisation).
• Unsuccessful applicants: delete their referencing data promptly (a few months at most). There is no reason to hold the bank statements of someone you did not let to.

"Keep everything forever" is not caution, it is a liability. Set a retention point and stick to it.

Subject Access Requests (SARs)

A tenant (or ex-tenant, or even a failed applicant) can ask for a copy of all the personal data you hold about them. This is a subject access request, and you must:

• Respond within one calendar month (extendable by up to two further months for complex requests, if you tell them within the month).
• Provide it free of charge in most cases. You can only charge for manifestly excessive or repeated requests.
• Include the data itself plus supplementary information (why you hold it, who you share it with, how long you keep it).

SARs spike during disputes: an arrears case or a deposit row often triggers one. The landlords who handle them calmly are the ones whose records are organised, dated and defensible in the first place. You can redact third parties' personal data, but you cannot withhold a tenant's own data because the relationship soured.

Right to Rent and special-category data

Right to Rent checks make you copy identity and, in effect, immigration-status documents. That is some of the most sensitive data you will ever hold. Store copies securely (encrypted or locked away, not in an open shared drive), restrict who can see them, and delete them on the retention timetable above. Collect only what the check requires; do not keep a tenant's full immigration history "just in case".

CCTV at the property

If you install CCTV covering the communal areas of an HMO or a block, GDPR applies to the footage. You need a lawful basis, clear signage telling people they are being recorded and why, a sensible retention period (often around 30 days). And you must not point cameras into anyone's private space: a tenant's room, or through a window. For anything beyond a modest communal camera, a short Data Protection Impact Assessment (DPIA) is expected. Covert recording of tenants is almost never lawful.

Data breaches: the 72-hour rule

A data breach is not just a hack. It includes emailing a rent statement to the wrong tenant, losing a laptop with tenancy files, or a referencing document going astray. If a breach is likely to risk people's rights and freedoms, you must report it to the ICO within 72 hours of becoming aware of it, and tell the affected people if the risk is high. Keep a short internal log of every breach, even the ones you decide are low-risk and do not report. The ICO expects you to be able to show your reasoning.

The common mistakes

• Relying on "consent" for everything: most letting data runs on contract or legitimate interests; consent you cannot evidence is worse than the right basis.
• No privacy notice: the cheapest fix on this list, and the first thing asked for in a complaint.
• Hoarding data: old applicants' bank statements, ex-tenants' ID copies kept for years. Data you should have deleted is pure downside.
• Not registering with the ICO: a separate, avoidable penalty.
• Panicking at a SAR: treat it as routine records retrieval, not an attack.

Retention is the part nobody actually does. In LetCompliance the application, the referencing, the Right to Rent evidence and the signed agreement sit against the tenancy with their own dates, alongside the rent ledger and the certificates. When a tenancy ends you can see what you hold and when it started, so deleting on schedule is something you can actually do rather than something the privacy notice promises. Get started: one property, no card needed.