• news-banner

    Expert Insights

Residential Property: Top 5 Data Protection Tips

The top 5 data protection considerations for those involved in the residential property and housing market, including landlords and managing agents

1. Get the basics right – including privacy notices

  • Whether you are a landlord, a managing agent or another service provider, if you use, store or share personal data (including information relating to your tenants), you will very likely be subject to UK data protection law (primarily, the UK GDPR) as a data controller (for example, landlords in relation to tenant data they hold) or a data processor (for example, managing agents in relation to tenant data they hold on behalf of the landlord).
  • For example, a landlord or managing agent may hold image data collected by their CCTV systems, contact details and financial data of their tenants or potentially biometric data or marketing preferences if technology enabled entrance systems or property management apps are used.
  • Taking active steps to comply with the UK GDPR may be considered an expensive and daunting distraction. However, ignoring its requirements is a risky strategy.
  • At the very least, basic compliance and security measures should be taken. Addressing certain ‘easy-win’ public facing compliance measures can go a long way to stave off unwanted scrutiny.
  • Examples include: (a) ensuring that controllers have appropriate privacy notices drafted and made available and (b) ensuring that employees who have regular or permanent access to personal data are made aware of their responsibilities, including through appropriate training.

2. Use of CCTV

  • CCTV may capture personal data of tenants, people visiting a property or those who work there. The use of CCTV in communal areas and publicly accessible areas (inside or outside) will likely be subject to the UK GDPR.
  • As such, care should be taken to ensure that signs are clearly displayed to inform individuals that CCTV is in operation. Its use should then be explained in further detail in relevant privacy notices, including details of how the data will be recorded, used, stored and retained.

3. Subject access requests

  • Related to the above point, individuals who want to exercise their right to access and receive a copy of their personal data can make a data subject access request (DSAR). The UK’s privacy regulator, the
  • Information Commissioner’s Office (ICO) has published detailed guidance on the Right of access under Article 15 UK GDPR.
  • If you are a data controller, you must comply with a DSAR without undue delay and, at the latest, within one month of receiving the request.

4. Security and data breaches

  • If you are a data controller and discover a personal data breach, depending on the seriousness, you may be required to notify the ICO within 72 hours.
  • You must describe the nature of the breach and, where possible, the categories and approximate number of individuals affected as well as the name and contact details of the Data Protection Officer (DPO) or other contact point for more information, the likely consequences and the measure taken or proposed and any measures to mitigate its adverse effects.  

5. Data processing agreements

  • If you are a data controller (for example, a landlord) who engages a data processor (for example, a managing agent), you will need a written contract covering a number of specific issues, including that the data processor will take appropriate measures to ensure the security of the personal data and act only in accordance with the data controller’s instructions. This is a legal requirement under the UK GDPR.

For more information on the above please contact Marc-Us Ong or your usual Charles Russell Speechlys contact.

Our thinking

  • Radical reforms to fight economic crime: what should businesses do now?

    Rhys Novak


  • Q&A: Supreme Court finds for Danish tax authority

    Hugh Gunson


  • City AM quotes Eddie Richards on the logistical challenges of data centres

    Eddie Richards

    In the Press

  • What are the different ways to own a Hong Kong property? What is sole ownership and what are joint tenants and tenants-in-common?

    Ian Devereux


  • Claims for reasonable financial provision beyond the grave?

    Jennifer Doggett


  • Arbitration Rules – How Different Are They?

    Mazin Al Mardhi


  • What the cancellation of HS2 Phase 2 means for former landowners

    Richard Flenley


  • The status of transgender and intersex athletes in international sports federations

    Pierre Bydzovsky


  • Charles Russell Speechlys advises Development Partners International and Verod Capital Management on investment into Pan African Towers

    Adrian Mayer


  • Overview of the Leasehold and Freehold Reform Bill: What are the key provisions?

    Laura Bushaway


  • James Broadhurst writes for the Financial Times’ Your Questions column on business succession plans

    James Broadhurst

    In the Press

  • Talking Retail quotes Jamie Cartwright on the CMA's report on grocery price inflation

    Jamie Cartwright

    In the Press

  • Property Week quotes Claire Fallows on reforms to the planning system announced in the Autumn Statement

    Claire Fallows

    In the Press

  • Francesca Charlton and Kayleigh McKee write for People Management on the Worker Protection Act

    Francesca Charlton

    In the Press

  • Charles Russell Speechlys successfully advises the Joint Liquidators of LB GP No.1 Ltd in Lehman Brothers litigation before the High Court in London

    Daniel Moore


  • Q&A: Adverse possession

    Hope Barton


  • FT Wealth quotes Sarah Anticoni and Vanessa Duff on prenups to protect family wealth

    Sarah Anticoni

    In the Press

  • Caroline Swain writes for Startups Magazine on 'Green Claims'

    Caroline Swain

    In the Press

  • Briefing quotes Noni Garratt-Wall and Sarah Grant on Building our Brand

    In the Press

  • The i quotes Rose Carey on UK net migration figures

    Rose Carey

    In the Press

Back to top