The Estate Agent's Guide to GDPR and Data Protection
Estate agents handle an enormous amount of personal data. Landlord bank details, tenant employment records, applicant references, identification documents, financial histories — the data flowing through a typical agency is both sensitive and voluminous. And whether you're managing it in spreadsheets, email, or a proper CRM, you need to understand your data protection obligations. This guide explains GDPR and the Data Protection Act 2018 as they apply to estate agencies, and provides practical, non-jargon guidance on how to implement them.
Data protection regulations aren't there to make your life harder. They exist because personal data is genuinely sensitive — a breached tenant's employment history or a landlord's bank account details can cause real harm. For estate agents, compliance isn't optional. Breaches can result in significant ICO fines, reputational damage, and the thing that actually matters: loss of client trust. Yet many agencies treat data protection as something to worry about only if something goes wrong, rather than something to build into how you actually work.
The good news: if you're already organised about which data you hold and why, you're most of the way there.
The core principles
Data protection regulations around the world share common principles. UK estate agents must comply with the UK GDPR and Data Protection Act 2018 as enforced by the ICO. Here are the seven principles that underpin everything:
Lawfulness, fairness, and transparency. You must have a legitimate reason for collecting personal data, use it fairly, and be transparent about how it's used. This isn't vague — it means you can articulate why you're holding something.
Purpose limitation. Data collected for one purpose shouldn't be repurposed without consent. If you collect a tenant's employment details for referencing, don't use those details for marketing without asking first.
Data minimisation. Only collect what you actually need. If you don't need a tenant's date of birth for your processes, don't collect it.
Accuracy. Keep your records accurate and up to date. If data is inaccurate, correct it or delete it.
Storage limitation. Don't keep personal data longer than necessary. A tenant who moved out three years ago? Delete their data unless there's a legal reason to keep it (there usually isn't).
Integrity and confidentiality. Protect personal data against unauthorised access, loss, or damage. This means encrypted storage, secure passwords (not "password123"), two-factor authentication, and backup procedures.
Accountability. You must be able to demonstrate compliance. It's not enough to follow the rules — you must prove that you follow them. This is where documentation matters.
What data you're actually holding
Understanding what personal data you hold is the first step towards managing it properly. A typical estate agency holds data about four groups: landlords (names, addresses, bank details, tax references, ID documents), tenants and applicants (contact details, employment records, income information, references, credit check results, deposit information), guarantors (names, contact details, financial information), and contractors (business details, insurance certificates, trade qualifications).
Some of this is particularly sensitive — financial information, identification documents, and credit checks all require careful handling. Your starting point should be knowing exactly what you hold and where.
If you're using a CRM rather than spreadsheets and email folders, you're already in a much stronger position. Centralised storage means you can see at a glance what data you hold about any individual, apply consistent access controls, and manage retention properly.
Lawful basis: why you're allowed to hold this data
You need a lawful basis for every type of personal data you process. The most common bases for estate agents are:
Contract. Processing is necessary to perform a contract — managing a property on behalf of a landlord, referencing a tenant, administering a tenancy. This is your most straightforward basis.
Legal obligation. Right to rent checks, anti-money laundering checks, and tax reporting all require processing personal data. You have no choice; regulation mandates it.
Legitimate interest. You have a business need that justifies processing data — for example, marketing to existing clients or using data to win more instructions. But you must balance your interest against the individual's reasonable expectation of privacy. If someone applied three years ago and never became a client, marketing to them is harder to justify.
Consent. The individual has given clear, informed consent for a specific purpose. This is typically required for marketing to people who aren't existing clients.
Document which lawful basis applies to each type of data processing. This documentation is part of your accountability obligation — your proof that you've thought this through.
Privacy notices and data security
You must inform people about how you use their data. This is done through privacy notices — clear, accessible documents that explain what data you collect, why, how you use it, who you share it with, how long you keep it, and what rights they have. Most agencies need three: one for landlords, one for tenants and applicants, and one for website visitors. Provide these at the point of data collection. Write them in plain language — "We share your data with the utility providers to set up your tenancy" is clearer than "We may disclose your personal information to third parties as permitted by applicable law."
Protecting personal data requires both technical and organisational measures. Technically, you need encrypted storage, strong passwords, two-factor authentication, regular software updates, and secure backup. Organisationally, you need access controls (ensuring only authorised staff can access sensitive data), training (so all staff understand their responsibilities), and clear procedures for handling breaches.
A CRM system provides a natural framework for this. Rather than sensitive data scattered across emails, spreadsheets, and paper files — where anyone with email access can see it — you centralise it in a system with built-in access controls and audit trails. You can see who accessed which data and when. That's compliance with teeth.
Retention, subject access requests, and breaches
Data retention is the most commonly overlooked aspect. Many agencies keep data indefinitely, reasoning it might be useful someday. Not compliant. You should have a data retention policy specifying how long you keep each type of data and what happens when the period expires. For tenants, six years after the end of tenancy aligns with the limitation period for most contractual claims. For applicants where no tenancy happened, six to twelve months is reasonable.
Individuals have the right to request a copy of the personal data you hold about them — a subject access request. You must respond within one month. A CRM makes this straightforward. You can locate all data associated with an individual quickly and export it in a structured format. Searching through emails and spreadsheets? That's a week of someone's time, and the risk of missing something goes up.
A data breach is any event resulting in unauthorised access, loss, or destruction of personal data — obvious things like a cyber attack, but also everyday mistakes like sending an email to the wrong recipient or leaving a paper file on a train. When a breach occurs, assess its severity. If it's likely to result in risk to individuals' rights and freedoms, you must report it to the ICO within the required timeframe. Serious breaches require notifying affected individuals as well.
Have a breach response plan documented and understood by all staff. When something goes wrong — and it will — you need to act quickly.
Practical compliance steps
Data protection compliance is an ongoing practice, not a one-time project. Here's what matters:
Audit your data. Understand what personal data you hold, where it's stored, and how it's used. This is your foundation.
Document lawful bases. For each type of data processing, know which lawful basis applies and document it.
Write clear privacy notices. Everyone whose data you collect deserves to know how it's used — in plain language.
Implement access controls. Sensitive data should only be accessible to people who actually need it.
Train your team. Data protection is everyone's responsibility. One staff member sending data to the wrong email address can cause a breach that affects your entire agency's reputation.
Review regularly. GDPR isn't static. Regulation changes, your business changes, your data handling evolves. Review practices annually. For automating routine admin tasks or setting up follow-ups and reminders properly, that requires documented processes as much as it requires software.
A CRM system supports all of this. Centralised storage, access controls, audit trails, and data management tools that make compliance easier rather than harder. You can onboard tenants through documented processes, track when data was accessed, and know exactly what you're holding and why.
The broader point: data protection isn't just a legal obligation. It's a marker of professionalism. Agencies that handle personal data with genuine care earn client trust — and that trust is one of your most valuable assets.
Frequently Asked Questions
Do I need a Data Protection Officer? Not necessarily. UK GDPR only requires a DPO if you're a large public body, a public authority, or an organisation whose core business involves large-scale, systematic monitoring of individuals. Most estate agencies don't meet this threshold. You do need to know who's responsible for data protection in your agency — even if it's "me and whoever else I ask."
How long should I keep applicant data? If the applicant became a tenant, keep their data for at least six years after the end of the tenancy (to cover the limitation period for contractual claims). If they applied but didn't become a tenant, six to twelve months is reasonable — unless there's a specific legal or business reason to keep it longer. Document your policy and stick to it.
What should I do if a client asks for a copy of their data? They have a legal right to it. Gather all personal data you hold about them — from your CRM, emails, spreadsheets, anywhere. Compile it in a commonly used format (PDF or CSV, typically) and provide it within one month along with information about how the data is used and who it's been shared with. If you're using a CRM with export functionality, this is straightforward. If you're not, this is painful — which is one reason many agencies move to a CRM.
What's the difference between GDPR and the Data Protection Act 2018? UK GDPR sets out the principles and individuals' rights. The Data Protection Act 2018 applies UK-specific rules — particularly around public authorities and exemptions. For estate agents, they work together. Follow GDPR, and you'll comply with the Data Protection Act as well.
Do I need consent for everything? No. Consent is required for some things (like marketing to non-clients), but your main basis will be contract (you need tenant data to manage the tenancy), legal obligation (right to rent checks), or legitimate interest (marketing to existing clients). Consent is actually the narrowest basis — use it where it applies, but don't assume you need it for everything.
What counts as a data breach? Anything that results in unauthorised access, loss, or destruction of personal data. A lost USB drive with tenant details is a breach. An email to the wrong recipient is a breach. A laptop stolen from a car is a breach. A cyber attack is obviously a breach. You must assess whether it's likely to result in risk to individuals' rights and freedoms, and report to the ICO if it is.
Can I use the data for training purposes or process improvement? Only if it's aligned with your lawful basis. If you're using tenant data to understand which applicants are most likely to hold tenancies — that's probably legitimate interest in improving your business. If you're using it to develop AI models that predict creditworthiness beyond what your referencing process already does — you need to think about whether that's justified and whether you need consent. Document your reasoning.
Do I need a contract with my CRM provider? Yes. If your CRM provider processes personal data on your behalf, you need a Data Processing Agreement (DPA) — a contract that sets out how they handle your data and confirms they meet appropriate security standards. Any reputable CRM provider will have a DPA ready to sign.