GDPR for Landlords: Register with ICO

GDPR Day for data protection rules was almost six years ago, but thousands of landlords still need to take action to comply with the law.

The compliance decision is simple - anyone who holds or processes personal data for any reason other than private use must register with the Information Commissioner’s Office (ICO).

Data protection regulations apply to landlords renting out a single home as much as they do to rental giants with hundreds or thousands of rented homes.

Even a property investor with a single tenant is bound to hold some personal information.

Data protection registration will likely become part of the landlord property portal under the new Renters (Reform) Bill. Levelling-Up Secretary Michael Gove has already confirmed he has discussed the topic with ICO.

What is personal data?

Typical tenant information held by a landlord will cover the following:

• Names and addresses of tenants and possibly their guarantors
• Contact information, like email addresses and telephone numbers
• Dates of birth
• Bank account details
• Employment information
• Credit, personal and employment references

Even landlords sub-contracting much of this information gathering to a letting agent or tenant reference agency are likely to hold some of this personal data.

The General Data Protection Regulation (GDPR) was introduced in May 2018, but six years later, property investors are still determining how the rules impact their businesses.

Should I register for data protection?

ICO has a short registration self-assessment online, which should identify any property business that should register.

The questions ask if the business:

• Uses CCTV for crime prevention
• Processes personal data - which is any information that identifies a living individual
• Holds personal data electronically
• Decides how the information is processed
• Processes data for property management - including the sale or letting of homes

If the property business holds or processes data for any of these reasons, ICO says the business should register and pay an annual licence fee.

A property business with fewer than ten staff pays £40 a year.

The penalties for failing to register with the ICO range from a reprimand to fines of up to £4,000. Between May 2021 and January 2022, ICO issued 126 financial penalties to organisations that had not paid a data protection fee.

Landlord data protection FAQ

What is ICO?

ICO, or the Information Commissioner’s Office, is the government agency responsible for monitoring data protection regulations in the UK.

What is personal data?

Personal data is information about a living person that identifies them when used on its own or with other data. Personal data would include names, addresses, dates of birth, employment and financial information.

Do landlords have to register with ICO?

Landlords holding or processing personal data must register with ICO regardless of the number of tenants and properties they own, even if they are sole traders.

Do landlords need to register with ICO if they have an agent?

The issue differs from how the letting business is structured and whether the business processes personal data. The company must register with ICO if personal information about tenants is held.

How do landlords register with ICO?

Landlords can register for data protection online for the first time via the ICO website.

Can I check if someone is registered with ICO?

You can search the ICO register online with their registration number, name or address.

Should I register if I monitor rental properties with CCTV?

Any property business which uses CCTV for crime prevention must register with ICO.

I process tenant data manually - should I register with ICO?

Landlords processing tenant data by pen and paper are exempt from ICO registration, but even keeping data on a smartphone qualifies as electronic processing and requires registration.