UK GDPR for letting agents
A letting agent operates in two distinct data protection roles — as a controller for its own operations and as a processor for landlord clients whose tenant data it manages. Most agencies do not have Data Processing Agreements with their landlord clients despite being legally required to. This guide explains what the obligations are in practice.
Controller and processor — both apply
A letting agent is a data controller for its own operational data — employee records, accounts, marketing lists, enquiries. It is a data processor for the personal data it handles on behalf of landlord clients — tenant applications, rent records, maintenance requests, and right-to-rent check documents processed under the landlord’s instructions. Both roles must be documented and governed separately.
A Data Processing Agreement compliant with Article 28(3) UK GDPR must be in place with each landlord client before any processing of tenant personal data begins. Most letting agency terms of business do not contain the mandatory Article 28(3) provisions. This is one of the most common data protection failures in the property sector.
Tenant referencing and credit checks
Tenant referencing involves processing significant personal data — employment history, financial information, credit history, and landlord references. Each processing activity requires a documented lawful basis, typically contract (information needed to assess the application) or legitimate interests. Where a third-party referencing agency is used, a DPA must be in place with that agency. The tenant must be informed of the referencing check in the privacy notice before it is conducted.
Right-to-rent checks
Right-to-rent checks under the Immigration Act 2014 require agents to process identity documents for all adult occupants. The lawful basis is legal obligation. Documents checked must be retained for the duration of the tenancy and for one year after it ends. The retention period and basis must be documented in the ROPA and reflected in the tenant privacy notice.
Marketing consent
Contact details collected from prospective tenants or landlords who do not proceed cannot be used for subsequent marketing without a valid separate consent or documented legitimate interests basis under UK GDPR and PECR. A prospect’s enquiry does not constitute consent to marketing.