What Is Changing?
From 19 June 2026, organisations that process personal data must have a formal process for handling data protection complaints.
The new rules form part of the Data (Use and Access) Act and are supported by guidance issued by the Information Commissioner’s Office (ICO).
For landlords and letting agents, this means individuals must be able to raise concerns directly with you about how their personal information has been collected, stored, used or shared before escalating the matter to the ICO.
Does This Apply To Landlords?
Yes.
If you collect and use personal information relating to:
- Tenants
- Prospective tenants
- Guarantors
- Contractors
- Employees
- Former tenants
you are likely to be acting as a data controller and these requirements will apply.
What Could A Complaint Be About?
Examples include:
- Delays responding to a Subject Access Request
- Incorrect personal information
- Information shared with third parties
- Data breaches
- Referencing information
- Retention of tenancy records
- CCTV footage
- Security of electronic or paper records
Importantly, a complaint does not need to refer to GDPR or data protection legislation to qualify.
Any expression of concern about how personal information has been handled may fall within scope.
What Must Landlords Do?
Landlords must have a process that:
1. Allows Complaints To Be Made
This could include:
- Written correspondence
- Existing complaints procedures
- Online forms (where applicable)
A separate system is not necessarily required. Existing complaint processes can often be adapted.
2. Acknowledge Complaints
Complaints must be acknowledged within 30 days of receipt.
3. Investigate Concerns
Reasonable enquiries should be made and complainants kept informed of progress.
4. Provide An Outcome
The outcome should be communicated clearly and without undue delay.
So What Should Landlords Do Next?
We recommend that landlords:
✓ Review privacy notices
✓ Update complaint procedures
✓ Create a simple complaint log
✓ Review data storage arrangements
✓ Train staff and property managers
✓ Retain records of complaints and responses
✓ Ensure Subject Access Request procedures are up to date
Simple Data Protection Complaint Checklist
Before 19 June 2026, ask yourself:
□ Can tenants easily raise a data protection concern?
□ Do I know who will handle complaints?
□ Do I have a process for acknowledging complaints?
□ Can I investigate and respond appropriately?
□ Are complaint records retained?
□ Are privacy notices up to date?
□ Is tenant information stored securely?
Key Takeaway
For most landlords, these changes are not about creating complex GDPR systems.
They are about demonstrating that concerns regarding personal information can be raised, investigated and resolved in a structured and transparent way.
Good record keeping, clear communication and sensible data management remain the best protection against complaints and regulatory action.