Could Your Landlord Records Stand Up To A Data Complaint?

What self-managing landlords need to know about the new data protection complaints rules

Self-managing a rental property involves far more than collecting the rent and arranging repairs.

Landlords routinely handle personal information belonging to tenants, applicants, guarantors and contractors. That may include identification documents, referencing information, bank details, tenancy records, emails, inspection notes and rent-payment histories.

Since 19 June 2026, organisations that use personal information must also follow new legal requirements when someone raises a data protection complaint.

For self-managing landlords, this is another area where having clear records and a proper process matters.

WHAT IS A DATA PROTECTION COMPLAINT?

A data protection complaint is a concern about how someone’s personal information has been collected, used, stored, shared or protected.

For example, a tenant might complain that:

• Their information was shared without a proper reason
• An email containing personal information was sent to the wrong person
• Their records are inaccurate
• Information has been retained for longer than necessary
• They have not been told clearly how their information is used
• Their request for access to information has not been handled correctly
• Documents or messages have not been stored securely

A complaint does not need to use legal language or mention data protection legislation.

A tenant who simply says, “Why have you shared my details?” or “I’m unhappy with how you have handled my information” may still be raising a data protection concern.

LANDLORDS HOLD MORE PERSONAL INFORMATION THAN THEY MAY REALISE

The Information Commissioner’s Office specifically recognises that landlords may use personal information to:

• Prepare tenancy agreements
• Obtain references or carry out credit checks
• Decide who can rent a property
• Manage repairs and property-related issues
• Communicate with tenants by email, WhatsApp or other messaging services
• Operate CCTV at a rental property

Even a landlord with one property may therefore be responsible for a considerable amount of personal information.

It is not enough to keep everything indefinitely in an email inbox, on a personal mobile phone or in an unstructured folder.

You should know:

• What personal information you hold
• Why you hold it
• Where it is stored
• Who it has been shared with
• How long you intend to retain it
• How you would locate it if someone raised a concern

WHAT HAS CHANGED?

Under the Data (Use and Access) Act 2025, organisations must now provide people with a clear way to make a data protection complaint.

When a complaint is received, the organisation must:

• Acknowledge it within 30 days
• Take appropriate steps to investigate it without undue delay
• Keep the complainant informed where appropriate
• Communicate the outcome without undue delay

This does not mean every complaint must be resolved within 30 days.

The 30-day requirement applies to acknowledging receipt. The investigation and outcome must then be handled without unjustifiable delay.

DO YOU HAVE A CLEAR WAY FOR TENANTS TO COMPLAIN?

A tenant should not have to search through old tenancy documents to work out how to raise a concern.

Your privacy information and complaints process should make it clear:

• How someone can contact you
• What information they should provide
• Who will review the complaint
• When they can expect an acknowledgement
• How you will investigate and communicate the outcome
• How they can contact the Information Commissioner’s Office if they remain dissatisfied

The process does not need to be complicated.

It does, however, need to exist.

A dedicated email address, online form or clearly explained written procedure may be appropriate, depending on how you manage your properties.

GOOD RECORDS MAKE COMPLAINTS EASIER TO HANDLE

When a complaint arrives, you need to establish what happened.

That becomes difficult when important decisions were made through telephone calls, messages have been deleted or documents are stored across several devices.

Good records may include:

• The privacy notice given to the tenant
• Referencing and application records
• The lawful reason for collecting and using information
• Consent records where consent was genuinely required
• Copies of information shared with third parties
• Emails and relevant messages
• Notes explaining important decisions
• Data-retention and deletion records
• A log of the complaint, investigation and outcome

Your records should be accurate, proportionate and securely stored.

Good record keeping does not mean retaining every piece of information forever. Data protection also requires organisations to avoid keeping personal information for longer than necessary.

A COMPLAINT IS NOT THE SAME AS A SUBJECT ACCESS REQUEST

A data protection complaint and a subject access request are different, although a tenant could make both at the same time.

A subject access request is a request for a copy of the personal information you hold about someone.

A complaint is an expression of concern about how you have handled that information.

It is important to recognise both because different duties and timescales may apply.

Ignoring an informal message because it does not use the correct terminology could create a larger problem later.

WHAT SHOULD YOU DO WHEN A COMPLAINT ARRIVES?

A simple process might include the following steps.

1. RECORD THE COMPLAINT

Note when it was received, who raised it and what they are concerned about.

Keep the original email, letter or message.

2. ACKNOWLEDGE IT

Confirm within 30 days that the complaint has been received and will be reviewed.

Where possible, explain what will happen next.

3. GATHER THE EVIDENCE

Locate the relevant tenancy records, emails, messages, privacy information and notes.

Identify who had access to the information and whether it was shared.

4. INVESTIGATE FAIRLY

Consider what happened, why it happened and whether your process followed data protection requirements.

Do not approach the investigation simply to defend the original decision.

5. KEEP THE TENANT INFORMED

Where the investigation takes time, provide a sensible progress update rather than leaving the tenant without any communication.

6. EXPLAIN THE OUTCOME

Set out what you found, whether any action will be taken and what the tenant can do if they remain unhappy.

7. LEARN FROM THE COMPLAINT

Consider whether documents, privacy information, storage arrangements or working practices need to change.

COMMON WEAK POINTS FOR SELF-MANAGING LANDLORDS

Problems often arise because data protection has developed informally alongside the tenancy.

Potential weaknesses include:

• Keeping tenant documents on an unsecured personal device
• Sharing information with contractors without considering what they genuinely need
• Retaining unsuccessful applicant information indefinitely
• Using personal WhatsApp accounts without an organised record
• Failing to update inaccurate contact or tenancy information
• Having no written privacy notice
• Having no documented complaints process
• Allowing multiple family members or contractors unrestricted access to tenant information
• Deleting messages that may later be needed to explain a decision

None of this means landlords need an unnecessarily complicated corporate system.

It means they need a clear, proportionate and repeatable process.

Lisa Bailey at Personal Economy Lettings explains:

“Good data protection is not about creating paperwork for the sake of it. It is about knowing what information you hold, why you hold it and being able to respond properly when someone raises a concern.

“A landlord may feel they know their tenant well, but an informal relationship is not a substitute for accurate records and a clear process.”

CAN SELF-MANAGING LANDLORDS STILL DO THIS THEMSELVES?

Yes.

But self-managing does not remove the landlord’s responsibilities.

A landlord may be perfectly comfortable dealing with maintenance, communicating with tenants and making day-to-day decisions. The challenge is ensuring that the supporting compliance, record keeping and monitoring are equally well managed.

The real question is not whether you can do everything yourself.

It is whether you have the time, systems and knowledge to do every part consistently.

HOW PERSONAL ECONOMY LETTINGS CAN HELP

Our Lettings PA services are designed for landlords who want to retain control of their property and tenant relationship while receiving practical professional support.

Depending on the service selected, we can assist with areas including:

• Organised tenancy records
• Compliance monitoring
• Rent collection and monitoring
• Prompt rent-arrears follow-up
• Tenant communication records
• Inspection and property-management documentation
• Practical support when an issue develops

You remain the landlord.

We provide the structure and support around you.

DO YOUR LANDLORD RECORDS NEED A REVIEW?

A data complaint is much easier to manage when your records, privacy information and procedures are already in order.

Waiting until a tenant raises a concern is rarely the best time to discover that important information is missing or scattered across different devices.

If you are a self-managing landlord and would like practical support with your tenancy administration, compliance or record keeping, speak to Personal Economy Lettings.

Call 0117 985 6703

Visit personaleconomylettings.co.uk

Personal Economy Lettings - helping landlords stay confidently in control.

Information correct at August 2026. This article applies to England and is provided for general information only. It is not legal advice or specialist data protection advice. Landlords should obtain appropriate professional advice for their individual circumstances.

Sources: Information Commissioner’s Office – How to deal with data protection complaints; Data Use and Access Act 2025 guidance; data protection guidance for the real-estate sector.