GDPR isn't just for big businesses. If you hold personal data about tenants, applicants, or contractors — and every landlord and letting agent does — the UK GDPR applies to you. Most small agents and private landlords are unaware of their obligations, and many are non-compliant without knowing it.
This guide explains what you need to do, what you're probably doing wrong, and how to fix it.
Yes. The UK GDPR (which retained EU GDPR principles post-Brexit) applies to any individual or organisation that processes personal data about living people. As a landlord or letting agent, you process data about:
If you're a sole trader landlord with just one or two properties, you still process personal data and are still subject to UK GDPR — though some administrative obligations (like keeping a formal record of processing activities) apply mainly to larger organisations.
Most landlords and all letting agents need to pay the ICO data protection fee — currently £40/year for micro-organisations and £60/year for small businesses. Failure to register when required can result in a fine of up to £4,350.
Check your status: Use the ICO's self-assessment tool at ico.org.uk to confirm whether you need to register and which tier applies. Most letting agencies need to register; private landlords who use an agent to manage everything may be exempt.
Under UK GDPR, you must have a lawful basis for processing personal data. For landlords and agents, the most relevant bases are:
| Activity | Lawful Basis |
|---|---|
| Referencing a tenant applicant | Legitimate interests / Contract performance |
| Running a credit check | Legitimate interests (with notice to applicant) |
| Collecting rent and managing tenancy | Contract performance |
| Sending marketing emails to former tenants | Consent (must be explicit and opt-in) |
| Sharing tenant data with contractors | Legitimate interests (only what's necessary) |
You must provide a privacy notice to tenants (and applicants) explaining:
This can be a one-page document handed over at the start of a tenancy or included in your tenancy agreement pack. It doesn't need to be complex — but it does need to exist.
You can't keep data indefinitely. Common retention periods for letting agents:
Common mistake: Keeping scanned copies of passports and payslips from applicants who never moved in — indefinitely, in an unsecured email folder. This is a data breach waiting to happen. Set a calendar reminder to delete referencing documents for unsuccessful applicants after 6 months.
UK GDPR requires you to keep data secure using "appropriate technical and organisational measures." For a letting agent, that means:
Tenants have the right to:
Reputable property management software keeps tenant data in one secure, auditable system — rather than scattered across email inboxes, WhatsApp messages, and spreadsheets. It gives you a clear record of what data you hold, makes it easy to respond to access requests, and supports data deletion workflows when retention periods expire.
Propflow stores all tenant records in one encrypted platform — no more scattered spreadsheets and email chains holding personal data.
Start Your Free 14-Day Trial →Last updated August 2026. This article is for guidance only and does not constitute legal advice. Consult a qualified solicitor or the ICO for specific GDPR queries.