Tenant privacy notice template. What UK GDPR says a tenant must be told.

A landlord holds a lot about a tenant: their name and contact details, the Right to Rent check, references, bank details for the rent, the deposit and every message about a repair. UK GDPR makes the landlord the controller of that information, and Article 13 says what a tenant must be told when their details are collected: who holds them and how to reach that person, why each piece is used and on what lawful basis, who it goes to, whether it leaves the UK, how long it is kept, the tenant’s rights, and how to complain. Article 14 adds where any of it came from, when it came from someone else such as a referee or a credit reference agency.

Two things changed in 2026. Since 19 June a tenant can complain to the landlord, who must acknowledge the complaint within 30 days, look into it and give the outcome (Data Protection Act 2018 s.164A), and Article 13 now asks for that right to be stated. Since 30 September the regulator has been the Information Commission, a board that took over from the single commissioner (SI 2026/1015); it still calls itself the ICO, and Article 13 names “the Commission”. A notice written before June is missing a line, and one written before October names a regulator that has gone.

The lawful basis is rarely consent. Running the tenancy rests on the contract (Article 6(1)(b)); the Right to Rent check, protecting the deposit and keeping tax records are legal obligations (Article 6(1)(c)); chasing arrears and defending a deposit dispute rest on legitimate interests (Article 6(1)(f)), which the notice has to name. Consent fits only what a tenant can refuse without losing the home. The guide to GDPR for landlords covers the bases, subject access requests and the data protection fee.

How long information is kept is the landlord’s decision, but the notice must give the period or the criteria for it. Copies of Right to Rent documents are kept for the tenancy and one year after, as GOV.UK says. For the rest, six years after the tenancy ends is a common choice, because a claim on a contract must be brought within six years (Limitation Act 1980 s.5). Rent records have their own rule, and six years after the tenancy can fall short of it: a landlord taxed as an individual keeps tax records until at least five years after the 31 January filing deadline for the tax year (Taxes Management Act 1970 s.12B), and a company for at least six years after the end of the accounting period. The form asks for your number of years, and the notice states the tax rule on its own line.

A notice counts only once it is given. Hand it over at the time the details are collected: with the application form if there is one, otherwise when the tenancy starts. Keep a dated copy, and update it before anything new begins: a letting agent, landlord software, a camera. The optional receipt at its foot lets a tenant sign for it, though a signature is not needed for the notice to apply. The guide to tenant privacy notices sets out how it differs from the tenancy agreement.

In LetCompliance the notice is built in Documents from your details on every plan, and sent to a tenant from their property with the date it went recorded. The move-in pack then sends the notice you last sent to each new tenant with the agreement, the certificates and the Prescribed Information; Right to Rent copies are flagged for deletion one year after each tenancy ends; and each tenant’s portal shows their own tenancy and nothing else.