Issue 2
Data protection and the ICO: what landlords need to know
Why data protection matters for landlords
As landlords, we often underestimate how much sensitive information passes through our hands:
- Tenant names and addresses
- Dates of birth and ID documents
- Employment and financial details from references
- Bank information for rent payments
- Maintenance notes that might include health or wellbeing information
Under UK GDPR rules, all of this counts as personal data, and we're legally responsible for handling it properly. Keeping data safe isn't just about avoiding fines, it's about building trust.
ICO registration: what is it and who needs it?
The Information Commissioner's Office (ICO) is the UK regulator for data protection. Any landlord who processes tenant data (and that's pretty much all landlords) should register and pay a small annual fee.
It's quick, simple, and affordable:
- Go to ico.org.uk.
- Answer a few questions about your business.
- Pay the fee (usually £40 to £60 a year).
Once you're registered, you'll get a certificate confirming compliance, a small but important step in running your portfolio professionally.
How long should you keep tenant records?
It's tempting to keep everything "just in case," but holding onto personal data longer than necessary isn't compliant.
A good rule of thumb:
- During the tenancy, keep all relevant data securely.
- After tenancy ends, keep records for up to 6 years (to cover deposit disputes, legal or tax queries).
- Beyond 6 years, securely delete or shred anything no longer required.
COHO: our digital hub
At Arena Property, we use COHO to manage tenant data. It means that:
- Rent statements, tenancy agreements, and compliance certificates are stored securely in one place.
- Tenants can contact us through the platform rather than via endless email threads.
- We don't have to juggle paper copies or worry about lost documents.
This not only keeps us compliant with GDPR, but it also makes life easier for tenants and landlords alike.
Top tips for keeping tenant data safe
- Use strong passwords, ideally a password manager, not sticky notes.
- Separate work and personal devices, don't mix landlord files with family laptops or phones.
- Shred or securely delete, never put tenancy agreements or ID documents in normal recycling.
- Limit access, only share with referencing agencies, deposit schemes, or contractors where consent is given.
- Review regularly, once a year, audit what you hold and clear out expired files.
- Use secure platforms, cloud-based systems like COHO or Dropbox Business are safer than unencrypted USB sticks.
Common landlord data protection mistakes
- Keeping copies of old passports long after a tenancy ended.
- Emailing tenant details to contractors without consent.
- Storing sensitive documents in unlocked filing cabinets.
- Forgetting to register with the ICO because "it's only one property."
If a tenant left in 2018 and no disputes remain, you should no longer be holding onto their passport copy or rent statements in 2025.
Year in Review 2025, a look back at:
- The big compliance changes of the year
- Yorkshire rental trends
- The trades and partners who helped keep everything running smoothly