Privacy notice for tenants
Every landlord who collects tenant data owes them a privacy notice — and it has to arrive when you collect the data, which means at application or referencing, not on move-in day. Most landlords give it late, if at all.
Don't write “consent” as your lawful basis
It is the most common error in landlord privacy notices, and it works against you. Consent can be withdrawn at any time — but you cannot abandon a Right to Rent check or stop keeping tax records because a tenant changed their mind. Nearly everything a landlord does rests on contract, legal obligation or legitimate interests instead. Keep consent for things that genuinely are optional, like marketing.
The timing landlords get wrong
The obligation bites at the point you obtain the data. For a letting that is the application form and the referencing pack — payslips, bank statements, employer details, credit checks — all of which you hold weeks before anyone signs anything.
Handing the notice over with the tenancy agreement therefore misses the entire period where the most sensitive processing happened, and misses every applicant who didn't get the property — whose data you also hold. Give it at application and both problems disappear.
What must be in it
- Who you are and how to contact you — the actual landlord entity, not just a first name.
- What you do with the data and your lawful basis for each purpose, and your legitimate interests where that is the basis you rely on.
- Who receives it — referencing provider, deposit scheme, letting agent, contractors, accountant. Naming the categories honestly is the part templates skip.
- How long you keep it, or the criteria you use to decide.
- Their rights — access, rectification, erasure, restriction, objection, portability where it applies — and the right to complain to the ICO.
- Whether they have to provide it, and what happens if they don't.
- Any automated decision-making, which includes an automated referencing pass/fail if you rely on one without human review.
It should be written so a tenant can actually read it. A notice nobody can understand fails the transparency requirement even if every clause is technically present.
Picking the right basis
Most of a letting divides up cleanly. Performance of a contract covers running the tenancy — collecting rent, arranging repairs, corresponding about the property. Legal obligation covers the things you have no choice about: Right to Rent checks, deposit protection, tax records. Legitimate interests covers referencing an applicant and pursuing arrears, provided you have thought about their interests too.
That leaves consent for the genuinely optional, chiefly marketing — where it is the right basis, and where a withdrawal is something you can honour without breaking anything.
How RentFig helps
RentFig generates a UK GDPR Article 13 privacy notice from the tenancy details you have already entered — landlord entity, property, referencing provider, deposit scheme, retention periods — emails it to the tenant, and files it against the tenancy so there is a dated record that it was sent. That record is the part that matters if it is ever questioned: not having a notice is one problem, having one you cannot prove you sent is another.
You can also generate one now without an account. The free landlord GDPR check asks the ICO's own questions about how you let, then produces a pre-filled notice you can send.
FAQ
Do landlords have to give tenants a privacy notice?
Yes. If you collect personal data about a tenant or applicant — and you cannot let a property without doing so — UK GDPR requires you to tell them who you are, what you are doing with their data, what your lawful basis is, who you share it with, how long you keep it and what rights they have. That is a privacy notice, whatever you call it.
When should I give it?
At the point you obtain the data, which in practice means at application or referencing — not on move-in day and not bundled into the tenancy agreement signing. This is the most common mistake landlords make: by the time someone signs a tenancy you have usually held their payslips and bank statements for weeks, so the notice arrives long after the processing started.
Is consent the right lawful basis?
Usually not, and choosing it causes problems. Consent can be withdrawn at any time — but you cannot stop carrying out a Right to Rent check or keeping tax records because a tenant changed their mind. Most landlord processing rests on performance of a contract, compliance with a legal obligation, or legitimate interests. Save consent for the genuinely optional things, like marketing.
What has to be in it?
Who you are and how to contact you; what you are doing with the data and your lawful basis for each purpose; your legitimate interests where that is the basis; who you share it with, such as referencing providers, deposit schemes and contractors; how long you keep it or how you decide; the tenant's rights including access, rectification, erasure and objection; their right to complain to the ICO; whether providing the data is required by law or contract and what happens if they refuse; and any automated decision-making.
Can I just use a template I found online?
As a starting point, with care. Generic templates frequently name consent as the lawful basis for everything, which is wrong for landlords and creates a promise you cannot keep. They also tend to omit the specific recipients that matter in a letting — your referencing provider, the deposit scheme, your agent, contractors attending the property. A notice that does not name who actually receives the data is not doing its job.
Do I need one for a tenant who didn't get the property?
Yes — you processed their data too, often the most sensitive of it. Applicants are entitled to the same information about what you are doing with their payslips and credit results as the tenant who moved in. Give the notice at application and it covers everybody automatically, which is another argument for the earlier timing.
What if I use a letting agent?
Then work out who is deciding what happens to the data. If the agent fully manages and makes the decisions, they may be the controller for much of it; if you are choosing tenants and holding records, you are. Often both of you are, for different parts. The tenant needs a notice covering whoever is actually making decisions about their data — 'the agent handles that' is not automatically true.
Disclaimer: This guide is general information for UK landlords, not legal or financial advice. Law and practice change — always confirm the current position, and take advice on anything that matters. Privacy notice requirements come from UK GDPR Article 13. This guide describes what the notice must cover; it is not a substitute for one, and a complex letting arrangement — joint controllers, overseas landlords, automated referencing decisions — is worth specific advice.