UK GDPR for Landlords: Handling Tenant Data Lawfully
Landlords are data controllers under UK GDPR. Here's what tenant data you can hold, how long for, and how to avoid an ICO fine.
On this page+
Introduction
Every UK landlord processes personal data — references, ID, bank details, repair photos. That makes you a data controller under UK GDPR, with the same legal duties as any business. The ICO has fined landlords for losing tenant files and for sharing data inappropriately. Here's a practical 2026 guide to staying compliant.
Do I need to register with the ICO?
Yes, unless you qualify for the very narrow not-for-profit exemption. Registration costs £40–£60 per year depending on size and is paid annually at ico.org.uk. Failure to register is itself a £4,000 fixed penalty.
Your lawful basis
For most tenant data the lawful basis is 'contract' (necessary for the tenancy) or 'legal obligation' (right-to-rent, deposit protection, tax). Marketing or sharing with third parties needs 'legitimate interests' or 'consent' and a documented assessment.
Privacy notice
Issue a written privacy notice before you start referencing. It must say who you are, what data you collect, why, how long you keep it, who you share it with (referencing agents, deposit scheme, HMRC) and the tenant's rights. Free templates available from NRLA and ICO.
Data minimisation
Collect only what you need. You do not need a tenant's full bank statements for referencing — affordability evidence is enough. You do not need NI numbers or sexual orientation. Stop and ask 'why am I asking for this?' before every field.
Retention periods
HMRC requires tax records for six years from the end of the relevant tax year. Right-to-rent evidence must be kept for the tenancy plus 12 months. Deposit scheme records: tenancy plus six years. Delete the rest as soon as the tenancy ends, including WhatsApp chats and old photos.
Breach reporting
If personal data is lost, accessed without authority or sent to the wrong person, assess the risk to the tenant. If there's a risk to rights or freedoms you must report to the ICO within 72 hours via ico.org.uk and notify affected tenants without undue delay.
Subject access requests
Tenants can ask for a copy of all data you hold. You have one calendar month to respond, free of charge. Use a redaction tool to remove third-party names. Failure to respond is a common cause of ICO action.
Final word
Smart Sleep Property handles the heavy lifting — referencing, compliance, deposits, repairs, and full tenancy management across Norwich and Norfolk. Get in touch if you'd like us to handle this for you.
Frequently asked questions
What is the key rule for uk gdpr landlords?+
Landlords are data controllers under UK GDPR and must register with the ICO (£40–£60/year), issue a privacy notice to every tenant, keep data only as long as legally required, and report personal data breaches within 72 hours. Retention is typically six years after tenancy end for financial records
Does this apply across England?+
Yes — this guide covers England. Scotland, Wales and Northern Ireland have separate but broadly similar regimes.
Where can I get help?+
Smart Sleep Property offers compliance support, document templates and full management for Norwich and Norfolk landlords.
Get the tools to handle this confidently
Our Membership gives self-managing landlords across the UK Renters' Rights Act–compliant tenancy templates, compliance reminders, document storage and member pricing on services — from just £9/month.