Landlords and letting agents are being warned that new data protection complaint rules now apply to organisations that handle personal information.
The change comes under the Data Use and Access Act and means that landlords, agents and other businesses must have a clear process for dealing with complaints about the way personal data is used. For many landlords this may sound remote from the day-to-day realities of managing a rental property, but the private rented sector involves a significant amount of personal information, from tenant applications and references through to guarantor details, employment records, bank information, right to rent checks, arrears records and correspondence.
That means data protection is not just an issue for large companies. It can affect individual landlords, portfolio landlords, letting agents and anyone else involved in managing rented property.
Why this matters now
The NRLA has warned that landlords and letting agents need to be aware of the new requirements because anyone handling tenant or applicant data may be expected to show that they have a proper way of dealing with concerns.
In practice, a tenant, prospective tenant, guarantor or former tenant may complain if they believe their personal information has been mishandled. This could include concerns about information being shared with the wrong person, held for too long, used for the wrong purpose, stored insecurely, or not dealt with properly when someone asks to see, correct or delete their information.
These complaints may be rare, but the new rules mean landlords and agents should not wait until a problem arises before thinking about how they would respond.
What landlords and agents may need to have in place
The key point is that landlords and letting agents should have a clear and practical complaints process for data protection issues.
This does not necessarily mean creating a complex system. For smaller landlords, it may be enough to have a simple written procedure explaining how a person can raise a data protection complaint, who will deal with it, how it will be recorded, how quickly it will be acknowledged and how the final response will be given.
Letting agents are likely to need something more formal, especially where they are handling large volumes of tenant, landlord and applicant information across multiple branches, staff members or systems.
A sensible process should cover:
- How a person can make a complaint about personal data.
- Who is responsible for receiving and investigating that complaint.
- How the complaint will be logged and tracked.
- How identity will be checked before personal information is discussed.
- How quickly the complaint will be acknowledged.
- How the outcome will be communicated.
- What records will be kept of the complaint and response.
- What should happen if the person remains unhappy and wants to escalate the matter.
The important point is that the process must be real and usable. It should not simply exist as a document that no one follows.
Why this is especially relevant to rental property
Landlords and agents routinely collect sensitive and financially important information. A tenancy application may include identity documents, salary details, employer information, bank statements, previous addresses, landlord references and guarantor details.
That information is valuable, personal and potentially damaging if mishandled.
The risk is not limited to cybercrime or major data breaches. Many data protection problems are much more ordinary. An email may be sent to the wrong address. A landlord may discuss a tenant’s arrears with someone who has no right to know. Old application forms may be kept indefinitely. Documents may be stored in an unsecured inbox or shared messaging app. A former tenant may ask what information is still being held and receive no proper response.
Under the new complaints rules, these types of concerns need to be handled in a structured way.
The impact on landlords
For individual landlords, the change adds another compliance responsibility at a time when the private rented sector is already dealing with major reform.
The Renters’ Rights Act, changes to possession rules, higher penalties, property standards, redress requirements and increased scrutiny of landlord behaviour all point in the same direction: landlords are expected to operate in a more professional and accountable way.
Data protection is part of that wider trend.
A landlord who only owns one or two properties may still hold a large amount of personal information. If they manage the property themselves, they need to think carefully about how that information is collected, stored, shared and deleted.
Landlords should consider whether they have:
- A privacy notice for tenants and applicants.
- A clear reason for collecting each piece of information.
- Secure storage for documents and correspondence.
- A process for deleting old applicant and tenant information when it is no longer needed.
- A record of who has access to personal data.
- A simple method for handling data protection complaints.
This does not need to be overcomplicated, but it does need to be thought through.
The impact on letting agents
For letting agents, the expectations are likely to be higher because agents usually handle data on behalf of many landlords and tenants.
Agents may receive and process tenant applications, reference checks, deposit details, rent records, maintenance reports, contractor communications and landlord instructions. They may also use third-party referencing companies, property management software, insurance providers, deposit schemes and maintenance platforms.
That creates more points at which personal information can be shared, transferred or mishandled.
Agents should therefore make sure staff know how to recognise a data protection complaint. A complaint does not need to use legal language. If someone says they are unhappy about how their personal information has been used, shared, stored or disclosed, it may need to be treated as a data protection complaint.
Training, internal procedures and clear responsibility are important. Frontline staff should know where to send the complaint and managers should know how to respond.
Why complaints handling can reduce risk
A clear complaints process is not just about ticking a compliance box. It can help prevent a small issue becoming a larger dispute.
If a tenant believes their information has been mishandled and receives no response, or a confused response, they may be more likely to escalate the matter. If the landlord or agent responds quickly, explains what has happened, corrects any mistake and records the action taken, the issue may be resolved before it becomes more serious.
Good complaints handling also helps demonstrate that the landlord or agent takes data protection seriously. In a sector where trust and communication matter, that can be important.
Practical steps landlords and agents should take
Landlords and letting agents should review how they currently handle personal information and make sure they have a simple data protection complaints process in place.
This should include checking tenancy application forms, privacy notices, email systems, filing arrangements, staff access, old records and third-party suppliers.
It is also sensible to review what information is collected at the start of a tenancy. Landlords should avoid collecting more information than they need and should avoid keeping information indefinitely simply because it is easier than deleting it.
Where an agent manages the property, landlords should also understand who is responsible for what. The agent may handle day-to-day data processing, but landlords should not assume that all responsibility automatically disappears simply because an agent is involved.
Another sign of a more regulated rental sector
The new data complaint rules are part of a wider shift in the private rented sector. Landlords and agents are increasingly expected to keep proper records, follow formal processes and show that they have acted responsibly.
For good landlords and professional agents, this should be manageable. The main risk is for those who treat data protection as an afterthought or who continue to rely on informal arrangements.
As the rules around renting become more complex, landlords should make sure their paperwork, processes and property management arrangements are keeping pace.
Conclusion
The new data protection complaints requirement may not attract the same attention as major rental reforms, but it is still important.
Landlords and letting agents handle personal information every day. Tenant applications, references, identity documents, rent records and correspondence all need to be managed carefully. If someone complains about how that information has been used, the landlord or agent should have a clear way to deal with it.
The message is simple: data protection is now another area where landlords and agents need to be organised, professional and prepared.
NetRent does not provide legal advice. This article reflects our understanding of current rental property and data protection developments at the time of writing. Landlords and letting agents should seek professional advice where they are unsure about their own obligations.
Telephone: 01352 721300
Email: support@netrent.co.uk