Landlords Targeted In Data Security Crackdown

A data security crackdown has started on landlords who collect, store and use the personal information of tenants without registering with the data protection watchdog. Warning letters are winging their way to thousands of property letting businesses. 

The letters urge every property rental business processing personal information to pay a data protection fee unless exempt. Most businesses pay £55 a year discounted to £35 for landlords setting up a direct debit. 

The UK has an estimated 2.5 million landlords renting out 4.5 million homes. However, few are aware that they must register with the Information Commissioner's Office (ICO) even if the only data collected is CCTV for crime prevention.

Do you need to register for data protection?

The ICO letters encourage landlords holding, storing or processing tenant data to register with the watchdog. For example, landlords must pay a data protection fee if they process personal data to produce tenancy agreements or contracts, perform credit checks on prospective tenants or obtain references. If landlords do not register and pay the fee, they risk tenants complaining about the misuse of their data, resulting in an investigation and penalties from the ICO. 

Suppose a letting agent manages property for a landlord and carries out the data protection processing activities, like sending out a monthly statement and paying rent. In that case, the accounts and records exemption may apply. This exemption covers personal data processed in electronic formats to provide invoicing and accounts. 

Use this easy self-assessment link to find out if you need to register and find out your fee level with the ICO online calculator.

What is property business data?

Before deciding if you should pay the ICO fee, it’s a good idea to carry out a general data protection audit to clarify if you process any personal information when dealing with tenants. 

Asking for, storing and using information during trading as a landlord is processing data. Landlords need to register with ICO if they keep information about tenants like:

  • Names
  • Addresses
  • Birth dates and national insurance numbers
  • Passport, visa and driving licence details

A landlord must show one of three interests to process data lawfully:

  • Legitimate interest, like keeping records on a current tenant
  • Contractual interest, which is passing on a tenant’s name and telephone number to a tradesman
  • Legal interest, which is when a landlord must comply with a legal requirement, such as completing tenant information on filing a deposit for protection

Data protection exemptions

Landlords need not register with ICO if they process personal data for:

  • Staff administration
  • Marketing
  • Keeping accounts and business records
  • Not-for-profit organisations
  • Personal or family records
  • Processing data manually

Penalties for landlords ignoring the ICO warning

The ICO has sweeping powers to impose huge fines on businesses that fail to register and pay the yearly fee. The most ICO can fine an offending business is £17.5 million or 4 per cent of total annual global turnover. This penalty level is for the most severe data breaches and wrongdoing. 

A ‘standard maximum’ applies to less serious offences but still is a hefty £8.7 million maximum or 2 per cent of global turnover. Property rental businesses can expect much lower fines, but lawyers report ICO issuing fines to landlords of up to £4,350.

Landlords targeted in data security crackdown FAQ

How can I find out if I should register with ICO?

Landlords can confirm registering with ICO by following the online self-assessment pages.

What is ICO?

ICO stands for the Information Commissioner's Office, the British government agency tasked with regulating data protection.

Should sole trader landlords register with ICO?

Every landlord flagged as processing personal data should register with ICO regardless of their trading status. The law covers companies, charities, not-for-profits, partnerships, and sole traders.

I share managing property with an agent; do I need to register?

Whether you should register depends on who processes tenant data. Landlords simply receiving a monthly rental statement and payment from a letting agent do not need to register as the letting agent handles the data processing. If the letting agent only finds a tenant, the landlord should register if drafting a tenancy agreement and arranging deposit protection.

Should I only sign up if ICO asks me to register?

No. The responsibility to register for data protection lies with the landlord and not the ICO requesting a property business to sign up.

View Related Handbook Page

Record Keeping and Data Protection

It is essential that landlords have a good system of record keeping. A file should be kept for a property and then each time a new tenancy is given to a new tenant