A tenant has asked for their data
You have one month to respond, it must be free of charge, and the request doesn't have to look like a legal letter to count. The part that surprises landlords: it covers your messages about the tenant, not just the tenancy file.
It includes what you said about them
A subject access request reaches personal data wherever you hold it — emails to your letting agent, WhatsApp messages, notes on the file, texts to a contractor. There is no exemption for remarks you would rather the tenant didn't read. The tenancy paperwork is almost never the problem; the messages are. Worth remembering before a dispute, because by the time a SAR arrives the messages already exist.
What counts as a request
More than landlords expect. A SAR can be made verbally or in writing, to anyone connected with your letting, and it does not have to use any particular wording. “Can you send me everything you've got on me?” in a text message is a valid request, and the one-month clock starts from when you receive it.
The tenant does not have to explain why they want it, and you cannot require a reason. You can ask for enough information to be satisfied who they are, which is sensible where you are not certain — but identity checks used as a stalling device are transparent and tend to make things worse.
The deadline
One month, without undue delay. You may extend by up to two further months where the request is genuinely complex or the tenant has made several — but you have to tell them within the first month and say why. An extension you never communicated is not an extension; it is a late response.
What you can hold back
Chiefly, other people's personal data. If a document identifies a neighbour who complained, another tenant, or a referee, you must not disclose their information unless they agree or it is reasonable to do so without consent. In practice that means redacting rather than withholding — remove the third-party details and disclose the rest, keeping a note of what you removed and why.
Blanket refusals are where landlords get into trouble. “That file is confidential” is not a reason; the tenant's own data is not confidential from them.
A workable process
- Date it. Write down when the request arrived — that date is the whole deadline.
- Confirm receipt in writing, and confirm identity if you have real doubt.
- Search everywhere, not just the tenancy folder: email, messages, accounting records, anything your agent holds for you.
- Redact third parties, keeping a note of each redaction.
- Send it with an explanation of what you have provided, what you have redacted and why, and their right to complain to the ICO.
Step three is the one that takes the time, and it is the argument for not spreading tenant information across four apps and an inbox in the first place. Keeping correspondence and documents against the tenancy — which is how RentFig's communication hub works — turns a week of searching into an afternoon of reviewing.
Related, and worth settling separately: how long you should be keeping tenant data in the first place. The less you hold past its purpose, the smaller every future request is.
FAQ
How long do I have to respond to a tenant's subject access request?
One month from receipt, and without undue delay. You can extend by a further two months if the request is genuinely complex or the tenant has made several, but you must tell them within that first month and explain why. Quietly taking longer is a breach in its own right, and it is the failure the ICO sees most often.
Can I charge for it?
No, not in the ordinary case. A SAR is free. You can charge a reasonable fee, or refuse, only where a request is manifestly unfounded or excessive — a deliberately high bar that does not cover a request you find inconvenient or that arrives in the middle of a dispute.
Does it have to be a formal letter?
No. A SAR can be made verbally or in writing, to anyone in your organisation, and it does not have to use the words 'subject access request'. A tenant saying 'send me everything you have about me' in a text message has made one, and the clock starts then. That is why the requests that go wrong are usually the ones nobody recognised as requests.
Do my emails and messages about the tenant count?
Yes. A SAR covers personal data about them wherever it lives, which includes your emails to a letting agent or contractor, WhatsApp messages, and notes on the file — not only the tenancy paperwork. Landlords are frequently caught out by this, because the tenancy file is usually fine and the messages are where the unguarded remarks are.
What can I withhold?
Information about other people. You must not disclose third-party personal data unless that person agrees or it is reasonable to do so without consent, so you may need to redact another tenant, a neighbour who complained, or a referee. Redact rather than withhold whole documents where you can, and keep a note of why. Certain other exemptions exist — legal privilege, for instance — but they are narrower than people hope.
Can I ask why they want it?
You can ask, but they do not have to tell you, and you cannot make an answer a condition of complying. You can ask for information to confirm their identity, and for clarification if you genuinely hold a large amount of data — but do not use either as a delaying tactic, because that is exactly how a routine request turns into a complaint.
What if I ignore it?
The tenant can complain to the ICO, which can require you to comply. In a live dispute, failing to answer a SAR also tends to become part of the story — it looks like concealment even when nothing is being concealed. Answering properly and on time is almost always less costly than the alternative.
Disclaimer: This guide is general information for UK landlords, not legal or financial advice. Law and practice change — always confirm the current position, and take advice on anything that matters. Subject access rights come from UK GDPR Article 15 and the Data Protection Act 2018. The ICO publishes detailed guidance on responding, including the exemptions — check it for anything unusual, and take advice where a request arrives inside a live dispute.