What information would I be processing?
To comply with UK General Ddata Protection Regulation (GDPR) and the Data Protection Act 2018, one of the first steps for landlords is to identify what tenant personal data they will be processing.
Personal data is information that can make your tenant identifiable and includes:
-
names
-
addresses
-
dates of birth
-
email addresses
-
passport numbers
Processing is any use of personal data (other than for personal reasons) and includes storing, recording and obtaining. This includes providing information on a former tenant in a Landlord reference letter. For more information, read Processing personal data.
Landlords should ensure that they conduct an audit to assess their data processing activities to establish the data they hold, who it is shared with and how long it is stored.
What is a lawful basis for processing data?
Landlords must have a ‘lawful basis’ to process (eg store or collect) personal data. Personal data can only be processed where at least one ground has been met.
While there are a variety of lawful grounds for the processing of personal data, the main purpose for a landlord to process a tenant’s data includes having a:
-
legitimate interest - where there is a compelling reason to have and process personal data, including commercial interests such as the existence of a tenancy agreement
-
contractual interest - where processing is necessary for the performance of a contract (eg using a tenant’s data to fulfil a contractual obligation, such as passing their details for the purpose of a repair)
-
legal interest - where data is processed in order to comply with a legal obligation (eg landlords must take tenant’s data for deposit schemes)
Do I need to register with the ICO?
Landlords who are holding, storing or processing their tenant’s data, need to register with the Information Commissioner Office (ICO) and pay any necessary fees. For example, if you are processing personal data to produce tenancy agreements/contracts, perform credit checks on prospective tenants and obtain references, then this requires you to pay a data protection fee.
If landlords do not register and pay the fee, they can be at risk of tenants complaining to the ICO about the alleged misuse of their data and this may offset an investigation and penalties from the ICO.
If your letting agent manages your property for you and carries out the data protection processing activities, and you as the landlord receive a monthly statement and rent, then you may fall into the accounts and records exemption and may not be required to pay the ICO registration fee. This exemption covers personal data that is processed in electronic formats to provide invoicing and accounts.
If you are unsure if you need to register with the ICO, you can use their online webtool to find out more.
