How Many of You Hold an ICO Registration?

Are you registered with the Information Commissioner’s Office (ICO)?

You probably should be…

ICO Registration – What Landlords Need to Know

If you are collecting, storing, or using personal information relating to tenants or landlords, there is a strong likelihood that you are legally required to register with the ICO.

What Is the ICO?

The Information Commissioner’s Office (ICO) is the UK’s independent authority responsible for upholding information rights and enforcing data protection law.

Under the Data Protection Act 2018 and UK GDPR, most organisations that process personal data, including landlords, must:

• Register with the ICO

• Pay an annual data protection fee

• Comply with data protection regulations regarding how personal information is stored, used, and protected

Registration confirms that you are operating lawfully as a data controller and that you recognise your obligations when handling personal data.

It is also important to understand that just because Rental Asset Management holds its own ICO registration does not mean that landlords are covered under that registration. Our registration applies only to the data that we process as an agency. Landlords remain separate data controllers for their own use of personal information, and where personal data is accessed, viewed, or retained, landlords will generally still be required to maintain their own ICO registration.

Why This Applies to Landlords

If you own or manage rental property, you will often be handling personal data such as:

• Tenant identification documents (passports or Right to Rent documents)

• Bank details

• Employment and referencing information

• Contact details held in Tenancy Agreements

• Financial records relating to rent payments

The moment you collect, store, or retain this information, even if it is simply held in an email inbox, spreadsheet, or digital folder, you are considered to be processing personal data.

In most circumstances, this means you are acting as a data controller, and ICO registration will be required.

Even where your property is fully managed by an agent, if you request or retain copies of documents such as:

• the tenancy agreement

• deposit protection certificates

• referencing reports

• tenant contact information

you are still technically handling personal data, and registration with the ICO is usually still required.

Access to Tenant Documents Through a Managing Agent

A question we are often asked is whether ICO registration is still required where a property is fully managed by an agent and the landlord only has access to documents through the agency’s system.

This situation can become slightly more nuanced.

Under UK data protection law, the definition of “processing” personal data is quite broad. It includes:

• collecting

• storing

• viewing

• accessing

• sharing

• using personal data

This means that even simply having access to view tenant information can technically count as processing personal data.

However, in practice where a landlord appoints a fully managing agent, the position can be slightly different.

In most managed arrangements:

• the agent acts as the main data controller for tenancy administration

• the landlord may simply be a recipient of information

• the landlord may not store the information themselves

• the landlord may not use the information for their own processing purposes

Where landlords rely entirely on the managing agent and do not maintain their own records or communicate directly with tenants, the argument can sometimes be made that they are not actively processing personal data themselves.

However, the ICO generally expects most landlords who receive tenant information to still pay the data protection fee, even where the property is fully managed.

There are limited circumstances where a landlord may fall within an exemption, for example where:

• the managing agent handles all personal data

• the landlord does not store the data themselves

• the landlord only receives very limited information for contractual purposes, such as a copy of the tenancy agreement. However a copy of the agreement means you can still view tenant data.

Because this is often a grey area, many letting agents advise landlords to maintain ICO registration regardless, as:

• the annual fee is relatively small

• it removes any uncertainty about compliance.

Providing access to documents through an agency portal does not automatically remove the landlord’s ICO obligations, because simply viewing personal data may still be considered processing.

If a landlord genuinely:

• does not store tenant information

• does not communicate directly with tenants

• and relies entirely on the managing agent

• Receives no documentation and does not access the agents portal to view such documentation

then there may be an argument that an exemption could apply, but this will depend on the specific circumstances of each case.

What Happens If You Are Not Registered?

Financial Penalties

Failure to register and pay the data protection fee where required can result in:

• Civil penalties of up to £4,000

• Further enforcement action if wider data protection breaches occur

The ICO does actively pursue organisations that fail to register.

Legal Non-Compliance

Operating without ICO registration where it is required means you are not compliant with data protection legislation.

This is not simply best practice, it is a legal obligation.

Greater Risk if a Data Breach Occurs

If an incident were to occur such as:

• a cyber breach

• loss of tenant documentation

• personal data being sent to the wrong recipient

• hacking of your systems

and you were not registered, the ICO may view your position as non-compliant from the outset, which could increase the likelihood of:

• regulatory enforcement

• financial penalties

• reputational damage

The Cost vs the Risk

For most landlords, the ICO registration fee is relatively modest, typically:

• £52 per year (or slightly less if paid by direct debit £47.00), depending on the size of the organisation.

Compared with the potential consequences , including regulatory penalties and reputational damage, this is a small cost for essential compliance.

Final Thought

With increasing regulation across the private rental sector, landlords are increasingly being treated more like regulated businesses rather than passive investors. Data protection forms an important part of operating responsibly and legally.

If you are unsure whether you are required to register, now is a good time to review your position.

It is also worth noting that ICO registration is a public register. This means that if an authority or regulator becomes aware that you own a rental property, it is very straightforward for them to check whether an active ICO registration is in place.

If you would like guidance on how to check or register, please feel free to get in touch.

Information Commissioners Office WebsiteAre you registered with the ICO?

If you’re unsure whether you need to be, now is the time to check - Information Commissioners Office Website