Privacy notice for a letting agent

A letting agent holds data about applicants it references, tenants it manages, guarantors it checks and landlords it acts for, shares that data with referencing agencies, deposit schemes, contractors, utilities and the landlord, and carries out checks the law requires. The privacy notice has to address each group, explain the referencing and the right to rent checks, describe the sharing and who is the controller after it, state the bases (which are mostly contract and legal obligation), and set the retention that the tenancy, the deposit and the law require. Drafting for the business, I deliver the privacy notice, the cookie notice and guidance on consent in five working days for a fixed £595.

Who this is for

Letting agents, managing agents, build-to-rent operators and landlords with their own lettings function in England and Wales, from a single-office agency to a portfolio manager.

What matters in a letting agent privacy notice

Tenants, landlords, guarantors and applicants as separate groups

The business, as controller, owes a duty under Article 13 of the UK GDPR to tell each person whose data it holds what it does with it, and a letting agent's notice should address applicants (viewing requests, application forms, referencing), tenants (the tenancy, rent, repairs, inspections, communications, deposit), guarantors (their own referencing and liability), landlords (identity, ownership, bank details, tax status, the mortgage lender's consent), and the contacts at suppliers and contractors; the notice should say that the agent acts for the landlord under the agency agreement, which decides whether the agent is the landlord's processor for some purposes or a controller in its own right, and the agent is usually both.

Referencing, credit checks and the right to rent

The notice should explain the referencing the agent carries out (identity, employment and income, previous landlord references, credit checks through a referencing agency that acts as a separate controller and leaves a footprint), the lawful basis (the steps at the applicant's request before the tenancy under Article 6(1)(b) and legitimate interests under Article 6(1)(f)), the right to rent checks the Immigration Act 2014 requires before a tenancy in England (with the documents or the online share code seen and recorded, the records kept for the period the scheme requires, and the data used for nothing else), and the position where the applicant is refused (the data kept for a stated period for the agent's protection and then deleted).

The data shared with landlords, contractors, deposit schemes and utilities

The agent shares tenant data with the landlord (as a separate controller, who needs their own notice where they manage any part of the relationship), with the deposit protection scheme the Housing Act 2004 requires, with contractors who attend the property (name, contact and access arrangements only), with utility companies and the council at the start and end of the tenancy, with inventory clerks and referencing agencies, with the agent's property management software and payment providers as processors, and with the authorities where the law requires (the council's licensing and enforcement, the police), and the notice should list each sharing, its purpose and the recipient's role.

The lawful bases and the law that requires most of the processing

Most of a letting agent's processing rests on the tenancy and agency contracts under Article 6(1)(b) of the UK GDPR and on legal obligation under Article 6(1)(c): the right to rent checks, deposit protection, the prescribed information, gas and electrical safety records, the licensing regimes under the Housing Act 2004, client money protection and the redress scheme membership the law requires of agents, anti-money laundering checks on landlords where the agent is supervised, and the obligations the Renters' Rights Act 2025 adds as its provisions come into force; legitimate interests covers the rest, and consent is reserved for marketing, which regulation 22 of the Privacy and Electronic Communications (EC Directive) Regulations 2003 governs for emails and texts to individuals.

Retention after the tenancy and the records the law requires

The notice should state the retention: tenancy files for the period after the tenancy ends that limitation periods for claims and the deposit scheme's rules justify, right to rent records for the period the scheme requires after the tenancy, safety certificates for the periods the regulations set, financial records for the period tax law requires, unsuccessful applicants for a short stated period, and landlord records for the duration of the agency and the period after; a letting agent's filing cabinet of every tenancy since the office opened is the retention failure the regulator finds, and the notice should commit the agent to the periods it states.

The portals, the property management software and the agency's own marketing

The notice should describe the property portals (which receive the agent's listings and pass enquiries to it, acting as controllers for the enquirer's data until it reaches the agent), the property management and CRM software, the e-signature and referencing tools, and the payment and client account providers as processors, with any international transfers under Article 46 of the UK GDPR, the agent's own marketing to landlords and applicants, the website's cookies under regulation 6 of the Privacy and Electronic Communications (EC Directive) Regulations 2003 with the consent mechanism the pack provides guidance on, each right the individual can exercise (access, correction, erasure, restriction, portability, objection), how, within what time (a month), and the right to complain to the Information Commissioner's Office; the business's registration with the Information Commissioner's Office, under the Data Protection (Charges and Information) Regulations 2018, belongs in the notice.

What it costs

Website privacy and cookies pack, £595. Privacy notice, cookie notice and consent guidance. Five working days.

DPA and privacy terms, £795. Data processing agreement plus privacy notice. Five working days.

Buying online forms the engagement on payment. The scope is what the data protection agreements and privacy terms page describes, you accept the Terms of Service at checkout, and I email you within four working hours to get started. If you would rather ask something first, email me.

What you get

• A data processing agreement that meets the statutory requirements and can be used as a schedule to your main contract
• A privacy notice written for people to read rather than to be scrolled past
• Clear allocation of controller and processor roles, which is where most confusion starts
• International transfer provisions where you use overseas suppliers
• Sub-processor and security provisions proportionate to what you do
• A note on the operational steps the documents assume you are taking

What is not included

• Full compliance audits and data mapping exercises
• ICO registration, which you do yourself
• Breach response and regulatory correspondence
• Cyber security certification such as Cyber Essentials
• Advice on data protection law outside the UK and EU

Questions I am often asked

Do landlords we act for need their own privacy notice?

Where they manage any part of the relationship with the tenant, yes, as separate controllers. The agent's notice explains that it acts for the landlord and what the landlord receives.

How long do we keep right to rent documents?

For the period the scheme requires after the tenancy ends, and used for nothing else. The notice states it alongside the other retention periods.

Can we email applicants about other properties?

With consent or the soft opt-in, implemented at the point of enquiry with an opt-out in every message. The notice states the basis; the enquiry form implements it.

Related guidance and services

• Data protection agreements and privacy terms, £595, the service this page describes
• Terms and conditions drafting, £995
• SaaS and technology contracts, £995
• Terms of business for a letting agent
• Privacy notice for a hotel or holiday let

This page is general guidance for businesses in England and Wales, not advice on your own circumstances. Last reviewed: October 2026. Email geoffrey@caesar.co.uk.