Landlords and letting agents routinely collect a large amount of personal information.
Names, addresses, telephone numbers, email addresses, bank details, employment information, references, guarantor details and copies of identity documents can all form part of the letting process.
That means landlords are not simply property owners. In many cases, they are also responsible for handling personal data lawfully and securely.
What tenant data do landlords usually hold?
A typical tenancy file may contain:
- application forms;
- contact details;
- identification documents;
- employment and income information;
- credit and referencing results;
- previous landlord references;
- guarantor information;
- bank details;
- tenancy agreements;
- deposit records;
- repair correspondence;
- inspection notes; and
- emails or messages exchanged during the tenancy.
Some of that information can be highly sensitive from a privacy and security perspective.
Why a privacy notice matters
Tenants and applicants should understand what personal information is being collected and why.
A privacy notice should explain, in clear language:
- what information is collected;
- why it is needed;
- how it is used;
- who it may be shared with;
- how long it is kept; and
- what rights the individual has.
Landlords should not assume that simply adding a sentence to the tenancy agreement is enough.
Privacy information should be clear, accessible and appropriate to the way the landlord actually manages data.
References still need to be handled carefully
Referencing is a normal part of letting property, but landlords should only collect information that is genuinely relevant.
The fact that a reference provider can collect a particular piece of information does not automatically mean the landlord needs to retain it indefinitely.
Landlords should also be clear about who carries out referencing and what data is shared with:
- letting agents;
- referencing companies;
- insurers;
- mortgage providers;
- contractors; or
- other third parties.
Using an agent does not mean the landlord can ignore data-protection responsibilities altogether.
Guarantor data needs protection too
Guarantors can provide even more personal information than tenants.
A guarantor file may include:
- home address;
- employment information;
- income evidence;
- contact details;
- financial information; and
- identification documents.
That information should be stored securely and only retained for as long as there is a proper reason to keep it.
Do not keep everything forever
A common mistake is to retain every application, email and copy document indefinitely.
Landlords should have a sensible retention policy.
Different documents may need to be kept for different periods because of:
- legal obligations;
- potential disputes;
- tax requirements;
- insurance claims; or
- contractual issues.
The important principle is that personal information should not be kept longer than necessary simply because storage is cheap or convenient.
Landlords should periodically review old tenant and applicant files and securely dispose of information that is no longer needed.
Be particularly careful with unsuccessful applicants
Applicants who did not obtain the tenancy may still have supplied substantial amounts of personal information.
There may be a legitimate reason to retain some information for a limited period, for example in case a decision is challenged.
But unsuccessful application files should not simply sit indefinitely in an inbox, filing cabinet or property-management system.
Secure storage matters
Good data handling is not only about paperwork.
Landlords should think about where information is stored and who can access it.
Practical steps can include:
- strong passwords;
- secure cloud storage;
- restricted access;
- encrypted devices where appropriate;
- locked filing cabinets;
- careful handling of email attachments; and
- secure disposal of paper records.
Avoid storing copies of passports, bank statements or other sensitive documents casually on shared devices.
What if there is a data breach?
A lost laptop, hacked email account, incorrectly addressed message or misplaced file can all create a data breach.
Landlords should have a basic process for identifying what happened, what information was affected and whether further action is required.
The more sensitive the information, the more serious the consequences can be.
Keeping unnecessary personal information also increases the impact of any breach.
Agents and landlords should agree responsibilities
Where a letting agent is involved, both parties should understand who is responsible for what.
The management agreement and privacy documentation should reflect the actual arrangement.
Landlords should ask:
- who collects the information;
- who stores it;
- who can access it;
- who responds to data requests; and
- what happens when the tenancy ends.
Do not assume that appointing an agent automatically transfers every responsibility.
How does the position differ across the UK?
Data-protection law applies across the UK, but tenancy systems differ.
England now operates under the Renters’ Rights reforms.
Wales uses occupation contracts.
Scotland uses Private Residential Tenancies.
Northern Ireland has its own private-tenancy framework.
The type of tenancy document may differ, but the need to handle personal information properly remains.
Treat tenant data as seriously as rent and repairs
Landlords often spend considerable time thinking about rent, maintenance and compliance certificates.
Personal information deserves the same level of care.
A good data audit should answer four simple questions:
- What information do we hold?
- Why do we hold it?
- Who can access it?
- When should it be deleted?
If those answers are unclear, the system needs reviewing.
NetRent’s Landlord Legal Updates will continue to explain important issues affecting landlords, letting agents and tenants across the UK.
NetRent also supports landlords with landlord insurance, mortgages and property sales.
Telephone: 01352 721300
Email: support@netrent.co.uk
Important information
NetRent does not provide legal advice. The articles represent our understanding of rental property law and are for general information only.