The New UK Data Protection Rules: What the Data (Use and Access) Act 2025 Means for Landlords, Tenants and Letting Agents

Data protection is an important part of running a professional letting and property management business. From handling tenant applications and landlord details to managing tenancy agreements, maintenance requests and rent payments, letting agents work with a considerable amount of personal information every day.

With changes introduced by the Data (Use and Access) Act 2025, it is important for letting agents, landlords and property managers to understand how the updated rules affect the way personal information is collected, stored, shared and protected.

The Act received Royal Assent on 19 June 2025 and introduces changes to the UK's existing data protection framework, including the UK General Data Protection Regulation (UK GDPR), the Data Protection Act 2018 and the Privacy and Electronic Communications Regulations (PECR). The changes have been introduced in stages, with the main data protection reforms taking effect on 5 February 2026 and the new requirements for handling data protection complaints coming into force on 19 June 2026. The wider Act has additional implementation dates.

For letting and property management agencies, these developments provide an important opportunity to review existing procedures, ensure personal information is handled responsibly and maintain the trust of landlords and tenants.

Why Is Data Protection So Important in the Property Industry?

Letting agents handle personal information throughout the rental process. This can begin when a prospective tenant makes an enquiry about a property and continue throughout the tenancy and beyond.

Information commonly handled by letting agents includes:

• Names, addresses, telephone numbers and email addresses.
• Tenant applications, referencing information and employment details.
• Financial information used for affordability assessments and rent payments.
• Landlord contact details and property ownership information.
• Tenancy agreements, correspondence and records of maintenance issues.
• Guarantor details and information supplied by contractors or other relevant parties.

Some of this information may be confidential or particularly sensitive. If it is disclosed to the wrong person, lost or used inappropriately, it can cause distress and potentially expose individuals to financial or other harm.

For this reason, letting agents should have clear procedures for handling personal information securely and sharing it only where there is an appropriate reason to do so.

Data protection is not simply about complying with legislation. It is also about providing a professional service, protecting the people you work with and demonstrating that their information is treated with care.

What Is the Data (Use and Access) Act 2025?

The Data (Use and Access) Act 2025 updates parts of the UK's existing data protection and privacy legislation. It does not replace the UK GDPR or the Data Protection Act 2018.

Instead, it introduces changes intended to clarify certain requirements, support responsible use of information and modernise aspects of the regulatory framework.

For letting agents, the most relevant areas include:

• How requests for personal information are handled.
• The introduction of formal data protection complaints procedures.
• The use of automated decision-making systems.
• Website cookies and electronic marketing.
• The secure and lawful handling of personal information.

The extent to which individual changes affect an agency will depend on how it operates, the systems it uses and the type of information it processes.

How Will the Changes Affect Letting and Property Management Agencies?

1. Protecting Landlord and Tenant Information

One of the most important responsibilities for any letting agent is ensuring that personal information is kept secure.

Landlords and tenants expect their information to be handled professionally, whether it is stored in a property management system, held in an email account or included in a tenancy file.

Agencies should regularly review who has access to personal information and ensure that appropriate security measures are in place.

This may include using secure software, strong passwords, multi-factor authentication where available, controlled access to files and suitable procedures for sharing documents.

Information should only be shared with landlords, tenants, contractors, referencing companies and other third parties where there is a lawful and appropriate reason.

For example, a contractor may need a tenant's contact details to arrange a repair, but would not ordinarily need access to the tenant's full referencing information or financial records.

Taking a proportionate approach to information sharing helps protect privacy while allowing the agency to provide an efficient property management service.

2. Understanding Subject Access Requests

Under data protection law, individuals can ask an organisation for access to their personal information. These requests are commonly known as subject access requests.

In the property industry, a request might come from a current tenant, a former tenant, a landlord or another individual whose information is held by the agency.

For example, a tenant may want to obtain copies of emails and records relating to a repair dispute, while a landlord may wish to access personal information held about them.

The Data (Use and Access) Act 2025 clarifies aspects of how these requests should be handled, including the need to carry out reasonable and proportionate searches and circumstances in which the response period may be paused while necessary information is obtained from the requester.

Letting agents should ensure that staff understand how to recognise these requests and know who is responsible for managing them.

It is also important to remember that a subject access request does not automatically entitle someone to receive every document in full. Information relating to other individuals and applicable exemptions may need to be considered before disclosure.

Having a clear process can help an agency respond appropriately, protect confidentiality and meet its legal obligations.

3. A Clearer Process for Data Protection Complaints

A significant change for organisations is the introduction of a formal requirement to facilitate and respond to data protection complaints.

These provisions came into force on 19 June 2026.

If an individual believes that their personal information has been handled in a way that breaches data protection law, they should have a clear and accessible way to raise the concern with the organisation.

For a letting agency, this could involve a complaint about information being sent to the wrong recipient, personal details being shared inappropriately or a concern about how records have been handled.

Under the new requirements, organisations must facilitate complaints, acknowledge receipt within 30 days, take appropriate steps to respond without undue delay and inform the complainant of the outcome.

Agencies should therefore ensure that their complaints procedures clearly explain how data protection concerns can be raised and how they will be investigated.

It is sensible to designate responsibility for handling these complaints, maintain appropriate records and ensure that staff know when an issue needs to be escalated.

A well-managed complaints process can help identify mistakes, improve internal procedures and reassure landlords and tenants that their concerns will be taken seriously.

4. Reviewing Website Cookies and Electronic Marketing

Many letting agencies rely on their websites to advertise available properties, attract new landlords and provide information to prospective tenants.

Websites may use cookies and similar technologies to remember preferences, analyse visitor activity or support marketing activities.

The Data (Use and Access) Act 2025 introduces limited exemptions from consent requirements for certain types of storage and access technologies where the relevant legal conditions are satisfied. However, it does not remove the general need to comply with applicable cookie and privacy rules.

Agencies should review their website cookies, privacy notices and consent mechanisms to ensure they reflect the technologies being used.

Electronic marketing should also be reviewed. If your agency sends newsletters, landlord updates, property promotions or other marketing emails, it is important to ensure that the applicable PECR requirements are met.

This includes understanding when consent is required, whether a relevant exception applies and how recipients can opt out of marketing communications.

Clear, transparent communication helps protect individuals' privacy while allowing agencies to maintain appropriate relationships with their customers.

5. Using Technology and Automated Decision-Making Responsibly

Technology is becoming increasingly important in the property industry. Letting agents may use digital referencing platforms, automated affordability checks, customer management systems and other tools to help manage applications and assess information.

The Act changes the framework governing certain decisions made solely through automated processing, including decisions that have legal or similarly significant effects on individuals.

The rules depend on the circumstances and the type of personal information involved. Relevant safeguards can include providing information about significant decisions, allowing individuals to make representations or challenge decisions, and enabling meaningful human intervention.

For letting agents, this makes it important to understand how any automated systems used by the business operate.

If a system plays a role in assessing tenant applications or making significant decisions about prospective tenants, the agency should establish whether the automated decision-making provisions apply and ensure the required safeguards are in place.

Using technology can improve efficiency, but it should not come at the expense of fairness, transparency or appropriate human oversight.

6. Keeping Records and Reviewing Internal Procedures

Good record-keeping remains an important part of effective property management.

Letting agencies should understand what personal information they hold, why it is needed, where it is stored and who can access it.

They should also have appropriate retention policies so that personal information is not kept indefinitely without a valid reason.

For example, an agency may need to retain certain tenancy and financial records to meet legal or regulatory obligations. Other information may no longer be necessary once the relevant purpose has ended and applicable retention requirements have been satisfied.

Regular reviews can help identify outdated records, unnecessary copies of documents and information that should be securely deleted.

Agencies should also review staff training, data breach procedures and arrangements with third-party software providers and service suppliers.

These practical measures help demonstrate that personal information is being managed responsibly and in accordance with applicable requirements.

What Should Landlords and Tenants Expect From Their Letting Agent?

Landlords and tenants should be able to expect their letting agent to handle personal information carefully and transparently.

This includes explaining how information is used, taking reasonable steps to keep it secure, sharing it appropriately and providing a clear way to raise concerns.

Landlords may provide personal details when appointing an agent, receiving rental statements or arranging property repairs. Tenants may provide information during referencing, throughout their tenancy and when reporting maintenance issues.

In each case, the agency should collect information that is relevant to its work, explain its purposes and handle it in accordance with data protection requirements.

Individuals also have rights under data protection law, including the right to request access to their personal data and, where the relevant conditions are met, rights to rectification, erasure and objection.

The new complaints requirements provide another important route for individuals to raise concerns about the handling of their personal information.

By maintaining clear procedures and communicating openly, letting agents can help landlords and tenants feel more confident about the way their information is managed.

What Can Letting Agents Do to Prepare?

The changes provide a useful opportunity for property agencies to review their existing arrangements and identify any areas that need attention.

Practical steps include:

• Reviewing privacy notices: Ensure that your website and business documentation explain how personal information is collected, used, shared and retained.
• Checking data security: Review access permissions, passwords, software security and the way documents are sent and stored.
• Updating complaints procedures: Make sure individuals can raise data protection concerns easily and that complaints are acknowledged and handled within the applicable requirements.
• Reviewing subject access requests: Ensure that staff know how to identify requests and follow the correct process for searching, reviewing and disclosing information.
• Checking marketing and cookies: Review website tracking technologies, marketing emails and relevant consent or opt-out procedures.
• Training employees: Ensure that everyone who handles personal information understands their responsibilities and knows how to report a potential data breach.
• Reviewing third-party providers: Check that the arrangements with referencing companies, property management software providers and other service suppliers are appropriate for the information they handle.

Not every agency will need to make extensive changes. The important thing is to understand which requirements apply to your business and ensure that existing policies and procedures remain suitable.

Our Commitment to Responsible Property Management

As a letting and property management agency, we recognise the importance of handling personal information with care, professionalism and respect.

Our work involves building relationships with landlords, tenants and other professionals, and protecting the information entrusted to us is an important part of maintaining those relationships.

We believe that clear communication, appropriate security measures and well-managed procedures are essential to providing a reliable property management service.

The Data (Use and Access) Act 2025 is a timely reminder for businesses across the property sector to review their responsibilities and continue improving the way personal information is managed.

By keeping our procedures under review and paying attention to developments in data protection law, we aim to support a professional and transparent service for the people we work with.

Final Thoughts

The Data (Use and Access) Act 2025 introduces important changes to the UK's data protection framework, with practical implications for letting agents and property managers.

From protecting landlord and tenant information to handling subject access requests, reviewing marketing practices and introducing an appropriate data protection complaints process, there are several areas for agencies to consider.

Although these changes do not mean every letting agency must overhaul its entire business, they reinforce the importance of having clear, secure and effective procedures in place.

For landlords and tenants, knowing that their information is handled responsibly can provide additional reassurance when working with a property professional.

For letting agents, maintaining good data protection practices is an important part of running a responsible business and building lasting relationships based on trust.

If you are a landlord or tenant and have questions about how your personal information is handled, please contact our team, who will be happy to direct your enquiry appropriately.