Landlords and agents warned over new data protection obligations

Landlords and letting agents are being urged to remain compliant with new data protection requirements.

Under the Data (Use and Access) Act, those handling personal data must have a policy in place for dealing with complaints about the use of personal information.

While such complaints are rare in the private rented sector, landlords are being encouraged to be prepared.

Provide an email address to submit complaints

The National Residential Landlords Association (NRLA) reports on its website that, under the rules, it is mandatory to provide a way for people to make complaints about the use of their data and to investigate and address the complaint within a reasonable amount of time.

The NRLA says the easiest way is to provide an email address for people to submit complaints. Receipt of a complaint must be acknowledged within 30 days. However, there is no requirement to resolve the complaint within 30 days, only to confirm receipt.

The NRLA adds that complaints must then be investigated and addressed within a reasonable amount of time. However, the industry body says a reasonable timeframe will generally depend on the complexity of the complaint and the number of staff you need to speak to.

Must remain compliant

Nathan Emerson, CEO of Propertymark, told Property118 that for letting agents its important to meet data protection obligations.

He said: “Landlords and letting agents handle significant amounts of personal information and must remain compliant with their legal obligations.

“The Data (Use and Access) Act 2025 updates elements of the UK’s existing data protection framework. It reduces businesses’ obligations in responding to Data Subject Access Requests, introduces a new legitimate interest ground, makes international data transfers easier and includes a relaxation on automated decision making.

“A further change is that organisations will also need to do more to assist people who want to make a data protection complaint by setting up a formal process.

“For letting agents, a key area of focus is for staff to be aware of Data Subject Access Requests rules, for them to review and update privacy notices and have a clear process for dealing with data protection complaints, such as an online form so that responses can be made promptly.”

Complaints via social media

The NRLA adds that complaints made via social media must also be handled.

The industry body said on its website: “If you use social media and a person complains to you on there, then this will still count as a complaint, and you must acknowledge it.

“However, rather than responding on social media, it will usually be best to ask them to provide an alternative contact address (such as email) to allow you to get in contact with them privately.”

It also adds that small landlords will not need a written complaints policy, provided they offer clear contact details for complaints and acknowledge them promptly.

A spokesperson for the National Residential Landlords Association told Property118 that NRLA members can use their privacy notice template.

The spokesperson said: “The overwhelming majority of landlords take their legal responsibilities seriously, and the private rented sector has a strong track record on data protection.

“Nevertheless, it is important that landlords remain aware of changes to regulations to ensure complaints in this area remain rare.

“Landlords can comply with these obligations by including information about making a complaint in their privacy notice and ensuring they investigate promptly if they do receive a complaint.

“NRLA members using our privacy notice template will already be compliant with aspects of the new requirements as the document includes information on how to make a complaint to the landlord or the Information Commissioner’s Office.”