How long should landlords keep tenant data?
UK GDPR gives you no fixed period — only a test: don't keep personal data longer than you need it. The workable answer comes from the rules that do specify periods. For anything financial that means six years; for Right to Rent copies, one year after the tenancy ends.
The one most landlords get wrong: failed applicants
The tenants who didn't get the property are the biggest over-retention problem in the sector. Their referencing packs — payslips, bank statements, credit results, employer references — sit in an inbox for years. Once the property is let and any dispute window has closed, there is no purpose left, and a purpose is what retention requires. It is also the most sensitive data you hold about people you have no relationship with.
A retention schedule you can actually use
| What | How long | Why |
|---|---|---|
| Rent records, invoices, expenses | ~6 years | HMRC: 5 years after the 31 January deadline |
| Tenancy agreement, deposit paperwork | ~6 years after it ends | Contract claim window; deposit disputes |
| Right to Rent document copies | Tenancy + 1 year | Home Office guidance — then destroy securely |
| Referencing pack — tenant who moved in | Tenancy + a short period | Purpose ends once the let is established |
| Referencing pack — failed applicant | Months, not years | No ongoing purpose once let |
| Compliance certificates | Per the regime | Gas records 2 years; keep others while relevant |
Treat the schedule as a default you can depart from with a reason, not a rule. If a deposit dispute or a court claim is live, keep what relates to it until it is resolved — that is a purpose, and it is a good one.
Where the six years actually comes from
HMRC's rule for business records is five years after the 31 January submission deadline for the relevant tax year. Because that deadline falls ten months after the tax year ends, five years from it is closer to six years from the income itself — which is why “keep it six years” is the shorthand you will hear, and why it is a safe default rather than a precise quotation of the rule.
One figure to be careful with: search results for this question often return 22 months. That is the retention period for people who are not in business. Letting property puts you on the business rule, so 22 months is the wrong answer for a landlord and a meaningful under-retention if you act on it.
Deleting means deleting the copies too
Retention is usually lost in the copies rather than the original. A tenancy file gets tidied up properly while the same passport scan sits in a sent-items folder, a phone camera roll, a WhatsApp thread and a spreadsheet on a laptop nobody uses. If you can't say where the copies are, you can't say the data is gone.
The practical fix is not discipline, it is not making the copies in the first place — keeping documents in one system rather than scattering them through email. Which is a large part of what a document store attached to the tenancy is for.
How RentFig helps
RentFig keeps tenancy documents filed against the tenancy rather than in an inbox, so there is one place to look when something should be removed, and applies retention rules to communications instead of holding message history indefinitely. Your privacy notice — which has to state your retention periods — is generated from the tenancy record, so the promise you make to the tenant and the schedule you actually keep to are the same document.
If you are not sure whether you also need to pay the ICO's fee, that is a separate question with a mostly-yes answer: do landlords need to register with the ICO?
FAQ
How long should a landlord keep tenant records?
There is no single answer, because UK GDPR does not set a period — it says you must not keep personal data longer than you need it. What fixes the practical answer is tax: HMRC requires business records to be kept for five years after the 31 January submission deadline for the relevant tax year, which is why most landlords work to a six-year rule for anything financial. Documents that are not financial should generally go sooner.
How long do I keep Right to Rent copies?
For the duration of the tenancy and one year after it ends, then destroy them securely. This one has a definite end date, and it is the clearest example of a retention rule that requires you to actually delete something rather than just keep it safe. Copies of passports and immigration documents are exactly the data you least want sitting in an old email account.
What about applicants who didn't get the property?
This is where most landlords are over-retaining without realising. Once you have let the property and any short window for a dispute about the decision has passed, you no longer have a reason to hold a failed applicant's referencing pack — bank statements, payslips, credit search results, employer references. A few months is generally defensible. Several years is not, and it is a large amount of sensitive data to be holding for no purpose.
Does UK GDPR give a maximum retention period?
No. The storage limitation principle requires that personal data is kept in a form allowing identification for no longer than is necessary for the purposes it was collected for. It is a judgement, not a number. That is why the practical approach is to borrow the periods from the rules that do specify one — tax, Right to Rent, deposit protection — and set your own for everything else.
Do I need a written retention policy?
You are expected to be able to explain your retention periods, and a privacy notice has to tell tenants how long you keep their data or how you decide. For a small portfolio that can be a short schedule rather than a formal document. What matters is that it exists, that it is honest about what you actually do, and that you follow it.
Can I just keep everything in case of a dispute?
Not indefinitely. 'We might need it one day' is not a purpose. You can absolutely keep tenancy records for the period a claim could realistically be brought, and for financial records tax rules already give you six years of cover. What you cannot do is treat a vague possibility of future usefulness as a reason to hold sensitive documents forever.
What's the safest way to delete tenant data?
Securely, and everywhere it exists. The failure mode is not the tenancy file you deliberately delete — it is the copies: the email attachments, the phone photos of a passport, the WhatsApp thread, the spreadsheet on an old laptop. If you cannot say where the copies are, you cannot honestly say you have deleted anything.
Disclaimer: This guide is general information for UK landlords, not legal or financial advice. Law and practice change — always confirm the current position, and take advice on anything that matters. Retention periods here are drawn from HMRC and Home Office guidance current at the date below. UK GDPR itself sets no fixed period — if a specific record matters, take advice rather than relying on a default.