GDPR for landlords
Data protection sounds like a corporate problem and lands on landlords as four concrete jobs: pay the ICO fee, give tenants a privacy notice, don't keep data forever, and answer a request within a month. None of them is difficult. Skipping them tends to surface at the worst possible time — during a dispute.
Not sure where you stand? Take the free check
The landlord GDPR check walks the ICO's own questions about how you let — agent or self-managed, referencing, CCTV, what you hold — and tells you whether the fee is payable, which tier you are in, and what else you owe. It then generates a privacy notice you can send. Free, about a minute.
The four duties
- Pay the ICO data protection fee unless you are genuinely exempt. Producing tenancy agreements, running credit checks or taking references all make it payable, so most landlords owe it. £52 a year, £47 by direct debit, deductible.
- Give a privacy notice to tenants and applicants when you collect their data — at application or referencing, not on move-in day.
- Keep data only as long as you need it. Roughly six years for financial records, one year past the tenancy for Right to Rent copies, and far less for applicants who never moved in.
- Answer a subject access request within one month, free of charge, including the emails and messages you have written about the tenant.
Each one in depth
Do I need to register with the ICO?
Usually yes — £52, or £47 by direct debit. When a fully managing agent exempts you, and the ordinary thing that cancels that exemption.
Privacy notice for tenants
What it must contain, why it belongs at application rather than move-in, and why consent is the wrong lawful basis.
How long to keep tenant data
A retention schedule: six years for financial records, one year after the tenancy for Right to Rent copies, months not years for failed applicants.
A tenant has asked for their data
One month to respond, free of charge — and it covers your messages about them, not just the tenancy file.
CCTV at a rental property
Cameras are the fastest way for a landlord to acquire data protection obligations they weren't expecting. Recording images of identifiable people is processing personal data, and doing it for crime prevention when crime prevention isn't your business makes the ICO fee payable on its own — even for a landlord who would otherwise be exempt.
In communal entrances, car parks or the exterior of a block it can be legitimate, with the usual conditions: a real reason, clear signage so people know they are being recorded, capturing no more than you need, and not keeping footage indefinitely. Pointing a camera across a boundary into a neighbour's garden or window causes problems you do not want.
Inside a tenanted property is a different question entirely. That is somebody's home, and monitoring inside it is extremely difficult to justify. If you let a property with cameras already installed, disable them and say so in writing. Doorbell cameras left in place by a departing landlord are a recurring version of this.
Where landlords actually come unstuck
Not the paperwork. The three recurring ones are failed applicants' referencing packs sitting in an inbox for years with no purpose, unguarded messages about a tenant that later have to be disclosed in a subject access request, and copies everywhere — a passport scan in email, on a phone, in a chat thread and in a spreadsheet, so that deleting the file deletes nothing.
All three are storage problems rather than legal ones, which is why keeping tenancy documents and correspondence in one place — filed against the tenancy, with retention applied — removes most of the exposure without anyone having to think about GDPR at all. That is the approach RentFig takes: the document store and communication hub keep it together, and the Article 13 privacy notice is generated and sent from the same record.
FAQ
Does GDPR apply to private landlords?
Yes. If you hold information about identifiable people — tenants, applicants, guarantors, referees — on any system, UK GDPR applies to you. Portfolio size makes no difference, and neither does letting to someone you know. The only landlords outside it are those processing nothing electronically at all, which in practice is almost nobody.
What are a landlord's main GDPR duties?
Four things. Pay the ICO data protection fee if you are not exempt, which most landlords are not. Give tenants and applicants a privacy notice when you collect their data. Keep data no longer than you need it, working to the periods that tax and Right to Rent rules already set. And answer a subject access request within one month if a tenant asks what you hold.
How much does GDPR compliance cost a landlord?
The only unavoidable cash cost is the ICO fee — £52 a year, or £47 by direct debit, and it is a deductible expense. Everything else is process rather than spend: giving out a privacy notice, not hoarding old referencing packs, and being able to answer a request. There is no certification to buy and no audit to pass.
Can I put CCTV in or around a rental property?
In communal or external areas you may, but it makes the ICO fee payable and you take on real obligations: signage, a clear reason, and only capturing what you need. Cameras inside a let property are a different matter — the tenant's home is private, and monitoring inside it is very hard to justify. Never install or keep a camera that can see into the living space of a tenanted property.
What happens if a landlord breaches GDPR?
For not paying the fee, a penalty of up to £4,350. For wider breaches the ICO can investigate and take enforcement action, though for small landlords the realistic consequences are a complaint, an order to put something right, and the time and stress of dealing with it — usually in the middle of a dispute that is already going badly.
Do I need a GDPR policy document?
Not a formal one for a small portfolio. You do need a privacy notice for tenants, and you should be able to explain your retention periods if asked. Getting those two right covers most of what a landlord is realistically expected to have.
Disclaimer: This guide is general information for UK landlords, not legal or financial advice. Law and practice change — always confirm the current position, and take advice on anything that matters. This hub summarises UK GDPR, the Data Protection Act 2018 and ICO guidance as they apply to residential landlords in the UK. The ICO's self-assessment is the authoritative answer on whether you must pay the fee.