Loading Guild Resources
Loading Guild Resources
Loading Guild Resources
Landlords and letting agents in England and Wales should check how they receive and deal with data protection complaints following changes now in force under the Data (Use and Access) Act 2025.
From 19 June 2026, controllers who receive certain data protection complaints must acknowledge them within the statutory 30-day period and respond without undue delay. For most landlords and agents, this means having a clear route for tenants, applicants, guarantors, and others to complain about how their personal data has been handled.
The change is not about ordinary tenancy complaints, such as repairs, rent disputes, or deposit deductions. It applies where a person complains that data protection law has been infringed in connection with their personal data.
Section 103 of the Data (Use and Access) Act 2025 added sections 164A and 164B to the Data Protection Act 2018. Section 164A gives an individual the right to complain directly to the controller about an alleged infringement of data protection law involving their personal data. In most lettings, the controller will be the landlord, the agent, or both.
The person might be a tenant, prospective tenant, guarantor, occupier, former tenant, contractor, or anyone else whose personal data is held or used. An authorised representative may complain on their behalf.
Controllers must make it reasonably easy to complain. They may provide an online form, but they should not rely on that alone if complaints can arrive by email, post, telephone, or another route.
Where a complaint is received, the controller must:
The 30-day period is for acknowledging the complaint, not completing the investigation. Acknowledge it promptly, investigate it properly, and do not let the matter drift. The law does not set a fixed final-response deadline, but the response, progress updates, and outcome must be provided without undue delay.
Section 103 and Schedule 10 came into force on 19 June 2026 under the Data (Use and Access) Act 2025 (Commencement No. 6 and Transitional and Saving Provisions) Regulations 2026.
Regulation 7 says the new acknowledgement and response duties apply to complaints received on or after that date. Complaints received earlier are not brought within these new handling duties, although existing data protection obligations may still apply.
The rules apply across England and Wales because data protection law is UK-wide.
The complaint must allege an infringement of the UK General Data Protection Regulation (UK GDPR) or Part 3 of the Data Protection Act 2018 involving the complainant's personal data. Part 3 mainly covers data used by competent authorities for law-enforcement purposes, so it will rarely apply to an ordinary private letting.
The person does not need to quote the law or prove their case before the complaint is accepted. Look at what they are saying, not the label they use.
Examples in a lettings context might include complaints that:
Separate rules also govern electronic marketing. A complaint that personal data was used for marketing without a lawful basis may fall within section 164A, but a complaint only about those separate marketing rules may not. The important step is to identify and investigate any data protection issues rather than dismissing the whole complaint.
A complaint that a boiler has not been repaired, a rent increase is unfair, or an agent has provided poor service will not normally fall within section 164A unless it also raises a data protection issue.
Guild members can read more in our guide on how to comply with GDPR and our article on the lawful bases of GDPR for lettings.
Download our editable Data Protection Complaint Form to receive, investigate, and record complaints.
Check that tenants, applicants, and others can easily find out where to send a data protection complaint. The route could appear in privacy information, application documents, an email footer, or a website contact page. An email address or online form is useful, but someone must check it. Postal complaints must also be picked up promptly.
Complaints received through other channels should still be accepted. If one reaches a branch inbox, maintenance portal, staff member, telephone line, or social-media account, keep the original receipt date and pass it quickly to the person dealing with data protection complaints. Do not insist that the complainant start again through a preferred route.
Update privacy information and standard templates used to answer data rights requests. They should explain how to complain to the landlord or agent and how to complain to the Information Commissioner's Office (ICO). This does not create a blanket duty to send an updated notice to every person whose data has been collected in the past. Members may also wish to review the Guild's handbook guidance for England and Wales.
Agents should make sure staff can recognise a data protection complaint. It may say, for example, “you have shared my personal information without permission” or “you are holding incorrect information about me”. It should not be treated only as an ordinary service complaint.
When a complaint arrives, save the original message and confirm what will be investigated. Gather the relevant records, such as emails, application forms, call notes, and system logs, and speak to any staff or suppliers involved. If the review takes time, tell the complainant what has been done and when they can expect another update. The outcome should answer the issues in plain English, explain the findings, and identify any corrections or other actions taken. If some information cannot be provided because it concerns another person, explain that limit without disclosing their personal data.
Where a landlord, agent, or supplier is involved, agree in advance who will receive complaints, investigate them, contact the complainant, and provide any evidence needed. The exact legal role may differ between activities, but the complainant should not be bounced between organisations. Each controller remains responsible for complaints about its own use of personal data.
Keep a short, secure record of when the complaint arrived, when it was acknowledged, what was checked, any updates, the outcome, and any action taken. Keep the record only for as long as there is a justified need.
Do not ignore a possible data protection complaint because it arrived through social media. Record the original date, acknowledge it, and move the conversation to a private, secure channel. Do not discuss tenancy details, addresses, arrears, or other personal data in a public reply, and do not reset the receipt date by asking the person to contact you elsewhere.
The Act does not expressly require every landlord to have a formal written complaints policy. It requires controllers to make complaints easy to submit, acknowledge them within the statutory period, respond without undue delay, make appropriate enquiries, provide progress updates, and give an outcome.
There is no exemption for a landlord with one property or a small portfolio. The process can be proportionate, but the duties still apply. A short written process is sensible. It should say where complaints go, who deals with them, and how acknowledgement, investigation, updates, and the outcome will be tracked.
Agents and landlords with staff or larger portfolios should make sure the process works across their usual contact routes. A simple periodic check that complaints have not been missed is enough for most organisations.
Section 164B allows the Secretary of State to make regulations requiring controllers to report the number of section 164A complaints to the Information Commissioner. No current reporting duty under this power was identified at the time of writing. Keep complaint records in a form that can be counted if regulations are introduced later.
Check complaint contact routes now, update privacy information and rights-response templates, brief anyone who receives messages, and keep a simple record of each complaint. A person may also complain to the Information Commissioner's Office without completing the controller's process first.