Any individual or organisation that gathers and uses someone’s personal data has to follow the principles laid out in the Data Protection Act 2018 - the UK’s implementation of EU General Data Protection Regulation (GDPR). This includes ensuring the information is:
- Used for a specific purpose
- Used fairly, lawfully and transparently
- Kept for no longer than necessary
- Held securely
As a landlord, you will if you if you let directly, hold various pieces of information about your tenant, most of which will be gathered during the referencing process and in completion of the tenancy agreement, so you are legally required to be compliant with the data protection rules. If we are letting and managing the property for you, we will manage much of this work for you.
Here are 10 key things you need to know about your obligations:
- You must register with and pay a data protection fee to the Information Commissioner’s Office (ICO) - currently £35 a year if you pay by direct debit. This is the case even if you have a managing agent, because you also hold and use the tenant’s data.
- It is advisable to create a ‘privacy notice’ to inform tenants and applicants how you will use and keep their data – the ICO has a template you can follow for this, and it’s something we do at Reeds Rains as standard.
- Hard copies of data must be kept secure – e.g. in a locked cabinet – and there must be password protection for any data held online.
- Although ‘data subjects’ have the right to request at any time that their data is deleted, you don’t have to do so if there is a legitimate reason for holding on to the information.
Therefore, you can (and should) retain and use your tenant’s data if:
- There is a contract between you. In this case, you need your tenant’s personal details in order to manage the tenancy.
- You are required to hold the information by law. For instance, right to rent check information must be kept for a minimum of two years, and HMRC requires all financial information and records to be kept for at least seven years.
- You have a legitimate interest. For example, you may need to provide the tenant’s contact details to a contractor carrying out work at the property in accordance with your obligation to make repairs.
- If you fail to comply with the regulations, the ICO has the power to impose large fines.
- Your letting agent should be willing and able to share all the data they hold on your tenant. Some agents will cite ‘data protection’ as a reason for withholding information from landlords, but that can be just a ruse to hide the fact that they haven’t carried out proper referencing on tenants.
- There is currently a new Data Protection and Digital Information Bill making its way through Parliament that aims to make data protection compliance less onerous for businesses. We will update you with any relevant changes to the rules in due course.
As with so many areas of being a landlord, it is important to be able to show that you have taken every reasonable step to comply with the law, and to be able to defend yourself in court if someone tries to make a case against you. So, for example, if a tenancy ended badly and you suspect that the tenant might try to make a claim against you for harassment or an illegal eviction – which they are legally able to do up to six years after the tenancy has ended - it would be reasonable to hold on to all information relating to their tenancy for that amount of time, so you can prove you complied with your obligations and responsibilities and acted legally.
For more information and advice, visit the ICO’s dedicated page for small organisations, and if you have any other questions about how our landlord services could benefit you, take a look at our different service levels.
The Reeds Rains Content Marketing Team
