The ICO’s small-organisation guidance provides routes for lawful processing, privacy information, retention, individual rights and the data-protection fee. Decide who needs access before sharing references, identity documents or tenant information with a contractor.
Know what information you hold and why
List application, tenancy, payment, repair and correspondence records, including information held by agents and contractors.
- Identify the purpose and lawful basis for each use. Collect information needed for that purpose rather than every document an applicant can supply.
- Give an appropriate privacy notice explaining uses, recipients, retention and rights. Keep it consistent with the actual process.
- Restrict health, identity and financial information to people who need it. A contractor usually needs access and repair details, not a full tenant file.
Share and store carefully
Use secure accounts and a clear process for access, exports and deletion.
- Check agent and supplier arrangements, including their role and security. Remove access when the appointment ends.
- Verify recipients before sending documents and avoid group messages that reveal another tenant's contact details.
- Protect exported spreadsheets and photographs as well as the main system. Check what personal details an inspection image accidentally captures.
Handle requests and incidents
Recognise a data-rights request even when it does not use legal language.
- Record the request date and route it for a timely response under current ICO guidance. Search relevant emails and agent records as well as database fields.
- Review third-party information and applicable exemptions before disclosure. Do not refuse a request merely because there is a rent dispute.
- If information is lost or sent to the wrong person, contain the incident, assess the risk and follow the applicable breach-reporting process.
Example: a contractor needs to arrange access
A fictional plumber needs a tenant's contact details and a description of the leak. Share only what is necessary for that job through an appropriate route. The plumber does not need the tenant's passport, benefits statement or unrelated complaint history.
What to do
- Explain the use of personal information in a suitable privacy notice.
- Restrict access and set justified retention periods.
- Use the ICO tools to check your obligations and respond to requests.
Evidence to keep
- Privacy notice and retention decisions
- Access controls and relevant sharing records
Sources and guidance
- Data protection advice for small organisationsInformation Commissioner’s Office · checked 20 October 2026