Data Protection Documents for Commercial Landlords
The UK's data protection legislation (consisting primarily of the UK GDPR and the Data Protection Act 2018), gives tenants significant control over how their personal data is used.
Landlords are “data controllers” under data protection law and tenants are “data subjects”. Landlords are therefore subject to certain obligations and tenants can exercise certain rights.
Our Data Protection Guidance Notes for Commercial Landlords explain the workings of the data protection legislation in more detail. The Data Audit template can be used to assess how data is collected and used. The outcome of the Data Audit will help landlords to prepare a Privacy Notice using our template. This needs to be given to all new and existing tenants and guarantors whose data the landlord holds. Data protection documents for residential landlords are available in the following subfolder. Data protection documents for residential lettings agencies are available here.
Data Protection Documents for Commercial Landlords is part of Property. Just £38.50 + VAT provides unlimited downloads from Property for 1 year.
Frequently Asked Questions
As a commercial landlord, do data protection laws actually apply to me? +
Yes. When you hold information about identifiable individuals, for example sole trader tenants, guarantors or a company's named contacts, you are a data controller under the UK GDPR and the Data Protection Act 2018. You must handle that data lawfully, fairly and transparently. Most controllers must also pay the ICO data protection fee. This sub-folder explains your duties.
What is a privacy notice and do I have to give one to my tenants? +
A privacy notice tells people what personal data you hold, why, your lawful basis, how long you keep it and their rights. Under the UK GDPR you must give this information when you collect data, so yes, provide a notice to new and existing tenants and guarantors. This sub-folder has a privacy notice template you can adapt.
A tenant has asked for a copy of all the information I hold on them. What must I do? +
That is a subject access request. You must respond, usually free, within one month, giving a copy of their personal data and supplementary information about how you use it. You can extend by two months for complex requests and must not disclose other people's data. This sub-folder's guidance helps you handle requests correctly.
How do I know what tenant data I hold and whether I am handling it properly? +
Carry out a data audit. Map what personal data you collect, where it comes from, why you hold it, who you share it with and how long you keep it. The audit supports your accountability duty and feeds straight into your privacy notice. This sub-folder has a data audit template for commercial landlords.
Can I share a tenant's details with debt collectors or a buyer of my building? +
Only where it is lawful and fair. You need a lawful basis, usually legitimate interests, the sharing must be proportionate and your privacy notice should say it may happen. Share the minimum necessary and keep it secure. This sub-folder's guidance helps you decide before disclosing personal data to third parties.
