If you let a property in the UK, data protection law applies to you. From the moment you take a tenant’s application you are handling their personal data, and you have legal duties over how you collect, store and share it. This guide explains what GDPR means for landlords in 2026, how to register with the ICO, what a landlord privacy notice should contain, and the answers to the questions landlords ask us most often.<\/p>\n
In short: GDPR for landlords means you must register with the ICO and pay the annual data protection fee (\u00a352 for a small landlord, or \u00a347 by direct debit), give every tenant a clear privacy notice, and keep tenant data secure and only use it for a proper reason.<\/strong><\/p>\n Since Brexit, the UK no longer follows the EU GDPR directly. Data protection is now governed by the UK GDPR<\/strong> and the Data Protection Act 2018<\/strong>. In 2025 the rules were updated by the Data (Use and Access) Act 2025<\/strong>, whose main data protection changes took effect on 5 February 2026. For landlords the core duties are unchanged: be clear about the data you hold, keep it secure, and only use it for a legitimate purpose. The 2025 Act mainly tidied up areas such as responding to information requests and gave people a new right to complain directly to the organisation that holds their data.<\/p>\n Renting out a property means handling a lot of personal information: names and contact details, references and credit checks, proof of identity and Right to Rent documents, bank details and sometimes guarantor details. Under data protection law, doing almost anything with this information counts as “processing”, including obtaining it, recording it, storing it, updating it, sharing it and deleting it. You need a lawful basis for each use, which for landlords is usually performing the tenancy contract, meeting a legal obligation, or your legitimate interests.<\/p>\n If you hold tenants’ details electronically, for example on a computer or phone, you almost certainly need to register with the Information Commissioner’s Office (ICO)<\/a> and pay the annual data protection fee. This applies even if you only let one property. Most individual landlords are in Tier 1, which costs \u00a352 a year<\/strong>, or \u00a347 if you pay by direct debit. Not paying when you should can lead to a fine of up to \u00a34,000<\/strong>, so it is worth running the ICO’s short self-assessment to confirm your position.<\/p>\n A privacy notice, sometimes called a privacy policy, is the document that tells tenants how you handle their data, and it is the simplest way to meet the law’s transparency requirement. A good landlord privacy notice sets out:<\/p>\n Give the notice to every new tenant at the start of the tenancy and keep a copy with your records. Our letting packages<\/a> include a compliant privacy notice within the tenancy agreement, and a fully managed service<\/a> can handle this and the rest of your compliance for you.<\/p>\n You must store tenant data securely and only keep it for as long as you need it. In practice that means protecting devices and accounts with strong passwords, not leaving paperwork where others can see it, and safely destroying records you no longer need. Tenants also have rights: they can ask to see the data you hold about them, have it corrected, or have it deleted when there is no longer a reason to keep it. Under the 2025 changes they can also complain directly to you, and you should acknowledge a complaint within 30 days. Much of this information comes from tenant referencing<\/a>, so handle those results with particular care.<\/p>\n In most cases, yes. If you hold tenants’ details electronically, for example on a computer or phone, you are processing personal data and usually need to register with the ICO and pay the annual data protection fee, even if you only let one property. Most individual landlords are in Tier 1, which is \u00a352 a year, or \u00a347 by direct debit, and not paying when you should can lead to a fine of up to \u00a34,000. Use the ICO’s self-assessment to check your position.<\/p>\n Possibly. If your agent fully manages the property and holds the tenants’ data, they are the data controller for that processing. But if you also keep tenant details yourself, in your own records or emails, you are a controller too and are likely to need to register. When in doubt, run the ICO self-assessment for your own situation rather than assuming the agent covers you.<\/p>\n No. Data protection law does not let an agent hide the landlord’s identity. Under section 1 of the Landlord and Tenant Act 1985, if a tenant asks in writing for the landlord’s name and address, the agent or the person who receives the rent must provide it within 21 days. Failing to do so without a reasonable excuse is a criminal offence.<\/p>\n Only if you have a lawful basis, which usually means the tenant’s consent. You can tell a utility provider that the tenancy is changing and give the outgoing tenant’s name so the account can be closed, if the tenant has agreed. You should not hand over an incoming tenant’s details without their consent, and it is often simpler for the utility company to contact the landlord or the new tenant directly. Reconnection clauses are generally lawful, but a tenant cannot be forced to breach data protection law, so agree in writing how the changeover will be handled.<\/p>\n Sometimes. Where a public body has a legal power to ask for the information, for example a local authority collecting council tax, you can rely on the ‘legal obligation’ lawful basis to provide it. If you are unsure, ask them to confirm the legal power they are relying on before you share anything.<\/p>\n Almost anything you do with someone’s personal data. Processing includes obtaining it, recording it, storing it, updating it, sharing it and deleting it. So keeping a tenant’s application form, referencing results or contact details on your phone or computer all count as processing.<\/p>\n A privacy notice tells tenants how you handle their data. It should set out who you are as the data controller, what personal data you collect, why you collect it and your lawful basis, who you share it with, how long you keep it, the tenant’s rights over their data, and how they can complain, both to you and to the ICO. Give it to every new tenant at the start of the tenancy and keep a copy with your records.<\/p>\nThe law: UK GDPR, the Data Protection Act 2018 and the 2025 update<\/h2>\n
What data do landlords handle?<\/h2>\n
Step 1: Register with the ICO and pay the data protection fee<\/h2>\n
Step 2: Give every tenant a privacy notice<\/h2>\n
\n
Keeping tenant data safe and respecting their rights<\/h2>\n
Frequently Asked Questions<\/h2>\n
Do landlords need to register with the ICO and pay the data protection fee?<\/h3>\n
Do I still need to register if I use a letting agent?<\/h3>\n
Can a letting agent withhold the landlord’s contact details under GDPR?<\/h3>\n
Can I share a tenant’s details with a utility or telephone company?<\/h3>\n
Does the council or another authority have the right to request tenant details?<\/h3>\n
What counts as ‘processing’ personal data?<\/h3>\n
What should a landlord privacy notice include?<\/h3>\n