Tenant privacy notice

What you need to know

The plain-English guidance that comes with this document.

• Landlords are data controllers — even a one-property landlord. You hold identity documents, references, credit checks and tenancy records — all personal data, and the Right to Rent and referencing information is sensitive. UK GDPR requires you to tell tenants, in plain language, what you hold and why. Give this at the start of the tenancy.
• You must have this even as an individual landlord. Being small or letting a single property doesn't exempt you. If you use a letting agent, be clear who's the controller (often you) and who's the processor (the agent).
• Right to Rent and reference data are sensitive — lock them down. Copies of passports, visas and credit checks are exactly the data that causes harm if leaked. Store them securely, share only with those who need them, and don't keep them longer than necessary.
• The PRS database changes the sharing picture. Under the 2026 reforms, landlord and property information goes onto a private rented sector database. Mention data-sharing honestly, and check what the database requires you to provide.
• Don't over-keep, and don't misuse it. Dispose of unsuccessful applicants' data promptly, and never use tenant contact details for unrelated marketing. Referencing data has a purpose — that purpose only.
• Applies UK-wide. UK GDPR applies across the whole UK. The ICO has free guidance for landlords if you want to go further.