Do landlords need to register with the ICO?
Usually yes. If you keep tenant or applicant details on a computer, you must pay the ICO's data protection fee — £52 a year, or £47 by direct debit. The main exception is a landlord whose agent fully manages everything, and it is narrower than it sounds.
The detail that catches out landlords who use an agent
A fully managing agent usually puts you inside the “accounts and records” exemption — if all you get is a monthly statement and the rent. But the ICO says the exemption falls away if you keep a database of prospective tenants, have any say in which tenant is chosen, or simply receive electronic copies of the tenancy agreements. That last one is the trap. Being emailed a PDF of the signed tenancy is completely ordinary — and on the ICO's own wording, it is enough to make the fee payable.
When the fee is payable
The ICO publishes a landlord-specific answer, and it is refreshingly concrete. You have to pay if you are processing personal data in order to:
- produce tenancy agreements or contracts;
- run credit checks on prospective tenants through a credit reference agency; or
- obtain references.
Any one of those is enough. Between them they describe what letting a property to a stranger actually involves, which is why the honest summary for a self-managing landlord is simply: yes, you need to pay.
Two other situations pull you in regardless of how the letting is managed. CCTV at the property for crime prevention makes the fee payable. So does running a residents', flat or freehold management company that holds resident details, payments, maintenance requests or meeting notes.
The exemptions, and why most of them don't help
There is a published list of exempt purposes — staff administration, marketing, accounts and records, not-for-profit purposes, personal or household affairs, maintaining a public register, judicial functions, and processing without any automated system. Two of them get raised by landlords constantly, and both are narrower than people hope.
“It's a personal thing, not a business.” The ICO closes this off in as many words: renting out a property is like running a small business. One property does not change that, and neither does letting to a friend.
“I keep everything on paper.” Genuinely valid, and genuinely rare. A spreadsheet of tenants, a folder of scanned agreements, or a referencing provider's portal are all automated processing. If you have ever emailed a tenancy agreement, this is not you.
What it costs
There are three tiers, and the one you fall into depends on staff numbers and turnover:
| Tier | Who it covers | Fee |
|---|---|---|
| Tier 1 | 10 or fewer staff, or turnover up to £632,000 | £52 |
| Tier 2 | 250 or fewer staff, or turnover up to £36 million | £78 |
| Tier 3 | Everyone else | £3,763 |
Landlords are tier 1. You would need more than 250 staff or £36m of turnover to be anywhere else, and the tier does not move with the number of properties you own. Paying by direct debit takes £5 off automatically, so the realistic figure is £47 a year — and it renews itself, which matters more than the five pounds, because the fee is annual and lapsing is the common failure.
It is also a deductible business expense, so the real cost against rental profit is lower again.
What happens if you don't pay
You are breaking the law if you process personal data for a non-exempt purpose and have either not paid or paid the wrong fee. The maximum penalty is £4,350.
You will see £4,000 quoted in a lot of places. That is the top of the band the ICO typically works to, not the statutory ceiling — the ceiling is £4,350. Either way the arithmetic is not close: the fee is £47.
Worth knowing too that the register of fee payers is public and searchable, and so is the list of organisations penalised for not paying. This is not a filing that sits quietly in a drawer either way.
Paying the fee is not the same as complying
This is the part that gets skipped, and it is the part that actually generates disputes. The ICO is explicit: even if you are exempt from paying a fee, you still need to comply with your other data protection obligations. Registration is a charge, not a certification — nobody checks your practices when you pay it.
What you still owe your tenants, fee or no fee:
- A privacy notice telling them what you hold, why, who you share it with and how long you keep it — given at the point you collect their data, which in practice means at application or referencing, not after they move in.
- An answer to a subject access request within one month. Tenants increasingly make these during a dispute, and a request covers your emails and messages about them, not just the tenancy file.
- Not keeping data forever. Failed applicants are the usual problem — their referencing packs sit in an inbox for years with no reason to be there.
How RentFig helps
Paying the fee takes ten minutes on the ICO's site and we can't make it faster. The recurring part is what RentFig handles: it generates a UK GDPR Article 13 privacy notice from the tenancy details you have already entered, emails it to the tenant, and files it against the tenancy so there is a dated record that it was sent. It stores your ICO registration number and merges it into the documents that should carry it, tracks marketing consent on each contact, and applies retention rules to communications rather than leaving everything in an inbox forever.
Not sure which side of the line you fall on? Our free landlord GDPR check walks the ICO's own questions in about a minute and generates a privacy notice you can send. For the binding answer on the fee itself, use the ICO's self-assessment.
FAQ
Do landlords need to register with the ICO?
Usually yes. If you keep tenant or applicant details on a computer — drawing up tenancy agreements, running credit checks through a referencing provider, or taking up references — the ICO says you are processing personal data for a business purpose and must pay the data protection fee. For almost every private landlord that is £52 a year, or £47 if you pay by direct debit.
I use a letting agent. Do I still need to pay?
It depends on how much passes through your hands. If the agent fully manages the property and all you receive is a monthly statement and the rent, the ICO treats that as the 'accounts and records' exemption and you do not pay. But if you keep details of prospective tenants, have any say in which tenant is chosen, or simply receive electronic copies of the tenancy agreements, the exemption falls away and the fee is payable. That last one catches a lot of people, because being emailed a PDF of the tenancy is completely normal.
How much is the ICO fee for a landlord?
£52 for tier 1, which covers any organisation with 10 or fewer staff or turnover under £632,000 — so effectively every private landlord. Paying by direct debit takes £5 off automatically, making it £47. Tier 2 is £78 and tier 3 is £3,763, but you would need over 250 staff or £36m of turnover to reach tier 3.
What happens if I don't pay?
You are breaking the law if you process personal data for a non-exempt purpose and have either not paid or paid the wrong fee. The maximum penalty is £4,350. In practice the ICO issues penalties on a sliding scale starting a good deal lower, but it does issue them, and it publishes the list of who has been fined.
Can the ICO tell whether I've registered?
Yes, and so can anyone else. The register of fee payers is public and searchable by name, so registration is not something you can quietly assume nobody checks. It cuts both ways — it is also a cheap way to look like a professional operation to a prospective tenant or a lender.
I only have one property. Does that change anything?
No. The fee does not scale with portfolio size, and there is no small-landlord exemption. The ICO explicitly says renting out a property is like running a small business, which is why the 'personal, family or household affairs' exemption does not apply to landlords however few properties they hold.
What if I keep everything on paper?
Processing personal information without an automated system is one of the listed exemptions, so a genuinely paper-only landlord does not pay. In practice this is close to extinct: a spreadsheet of tenants, a folder of scanned agreements, or a referencing provider's online portal all count as automated processing. If you have ever emailed a tenancy agreement, you are not paper-only.
If I'm exempt from the fee, am I exempt from GDPR?
No, and this is the misunderstanding that causes the real problems. The ICO is explicit that even if you are exempt from paying a fee, you still have to comply with your other data protection obligations. You still owe tenants a privacy notice, you still have to answer a subject access request within a month, and you still have to keep data no longer than you need it. The fee is a registration charge, not the obligation itself.
Disclaimer: This guide is general information for UK landlords, not legal or financial advice. Law and practice change — always confirm the current position, and take advice on anything that matters. Fee tiers, exemptions and the penalty figure are taken from the ICO's published guidance and were checked on the date shown below. The ICO's self-assessment is the authoritative answer on whether you personally need to pay.