Passports, identity records and financial documents can cause harm if misdirected. Decide what evidence is needed and how it will be protected before asking an applicant to send it.
Collect only what is needed
- Distinguish identity verification, affordability and the English right-to-rent check.
- Use the evidence appropriate to the lawful checking route rather than demanding every identity document available.
- Explain who will receive the information and how long it is expected to be kept.
Protect the copies
- Use controlled storage and secure sharing, with access limited to the people doing the check.
- Avoid leaving copies in personal downloads, open email groups or contractor folders.
- Verify an agent or reference provider's identity and role before transferring documents.
Retain and dispose properly
- Apply a documented period based on the purpose and legal requirements, including unsuccessful applications.
- Delete duplicate working copies when no longer needed and remove access when staff or agents leave.
- If a document is misdirected, contain the incident and assess the reporting duties promptly.
Example: an identity scan is attached to a repair email
A fictional manager accidentally includes an applicant's passport in a contractor message. Stop further sharing, seek secure deletion and assess the incident under the data-breach process. Do not treat it as harmless merely because the recipient is a known contractor.
What to do
- Explain the purpose and secure submission route.
- Limit access and verify recipients before sharing.
- Apply the correct retention and deletion rules.
Evidence to keep
- Privacy information, reason for collection and relevant check record.
- Access, sharing and deletion arrangements.
Sources and guidance
- Data protection advice for small organisationsInformation Commissioner’s Office · checked 20 October 2026
- Checking a tenant’s right to rentHome Office · checked 20 October 2026