📂 What data landlords hold

• Names, contact details and dates of birth
• Referencing and credit checks, including income and employment details
• Right to rent documents, such as passports and visas
• Bank details and rent payment history
• Guarantor details
• Correspondence, inspection reports and photos of the property

All of this is personal data under UK GDPR and the Data Protection Act 2018. As the person deciding why and how it’s used, you’re the data controller.

💷 Do landlords need to pay the ICO fee?

Most landlords who process tenants’ personal data need to pay an annual data protection fee to the Information Commissioner’s Office (ICO), unless an exemption applies. The ICO has a short online self-assessment to check. It’s a small cost, and not paying when you should can lead to a fine.

✅ The core rules in plain English

• Only collect what you need to let and manage the property.
• Tell tenants what you’re doing with it in a short privacy notice at the start of the tenancy.
• Keep it secure: password-protected systems, locked storage for paper files, and care with email attachments.
• Don’t share it without a good reason, for example with contractors who need a phone number to arrange a repair.
• Don’t keep it forever. Delete or destroy what you no longer need.

🗓️ How long should you keep tenant records?

Keep what you need for as long as you need it, and be able to justify it. Right to rent document copies must be kept for the length of the tenancy and for one year after it ends. Tenancy agreements, rent records and deposit paperwork are often kept for several years after a tenancy ends, in case of disputes or tax questions. Unsuccessful applicants’ details should be deleted much sooner.

📨 Subject access requests

Tenants can ask for a copy of the personal data you hold about them. You must normally respond within one month, free of charge. Good record-keeping makes this simple. Messy files make it painful.

🚨 If data is lost or stolen

A lost laptop, a hacked email account or documents sent to the wrong person are all data breaches. If there’s a risk to the people affected, you must report it to the ICO within 72 hours of finding out. Record what happened and what you did about it, either way.

🤝 Landlords and agents

If you use a letting agent, they’ll hold much of your tenants’ data and have their own data protection duties. Make sure your agreement covers how data is handled, and that the agent uses secure systems.

🏘️ A note for HMO landlords

The same rules apply, but with more tenants and more turnover, there’s more data to manage. Keep each tenant’s records separate, and don’t share one tenant’s details with housemates.

👋 How Portus handles it

On our full property management service, tenant data is held in secure property management systems, not inboxes and filing cabinets, and we handle referencing, right to rent checks and record-keeping for you. Get in touch or call us on 0151 329 3538.