·5 min read
Do landlords need to register with the ICO?
Letted
Quick one, because this keeps coming up.
We were onboarding a landlord last week, seven properties, all self-managed, and somewhere in the conversation I asked if he was registered with the ICO. Blank look. Never heard of it. And to be fair to him, nobody had ever told him.
So here's the answer, and it's not the one most landlords want.
Yes, you almost certainly do
If you've got a tenant's number saved in your phone, you're processing personal data. If you've got a WhatsApp thread going about a dodgy boiler, same thing. Tenancy agreement sitting as a PDF in your inbox? That too.
Under UK data protection law, anyone who handles personal data electronically has to register with the Information Commissioner's Office and pay an annual fee. Personal data just means anything that identifies a real person: names, addresses, phone numbers, bank details, passport scans, the lot. And "electronically" means on a phone, laptop, tablet or anywhere in the cloud.
That's every landlord I've ever met.
The ICO's own guidance for property is pretty blunt about it. If you produce tenancy agreements, run credit checks, take up references, collect rent or deal with maintenance requests, you pay the fee. They've been writing to landlords directly to tell them so.
"But I'm not a business"
Heard this a lot, and I get it. Unfortunately the ICO doesn't see it that way.
The fee applies to sole traders, one-man bands, charities, everyone. It doesn't matter if you've got one flat you inherited from your nan and you've never once thought of yourself as a landlord. You're letting a property for money. That's a business activity, and the data you hold on your tenant comes with it.
The two exemptions (and why they probably aren't you)
There are two ways out, and neither is much use to most people reading this.
The first is if you've got a letting agent doing absolutely everything, and all you ever see is a monthly statement and the rent landing in your account. That's covered by the accounts and records exemption. Fine. But the second you pick which applicant gets the flat, or the agent emails you a copy of the agreement, or a tenant has your number and texts you about the shower, you're back in.
The second is if you only ever handle data on paper. Never emailed a tenant, never saved a number, never had a PDF. If that's you, fair play, but I've never met you.
If you self-manage, or you've got a mix of managed and self-managed, you need to register. Simple as that.
What it actually costs
£52 a year. £47 if you set up a direct debit. It went up from £40 in February 2025, first rise since 2018, so don't expect it to move again for a while.
Registering takes about ten minutes on the ICO website. Name, address, trading name if you've got one, how many staff (none), rough turnover. That's it. No inspection, no exam, nobody comes round.
What do they actually do with the £52? I haven't a clue. But if you don't pay it, they'll try and fine you, so it's cheaper to just get it done.
What happens if you don't
The ICO can fine you up to £4,000 for not paying. They've been chasing landlords for a few years now and the letters do go out.
But the fine isn't really the thing to worry about. The bigger risk is that if you're not registered, it's usually because nobody's ever told you any of this applies to you, and that's exactly what gets used against you when things go wrong. A tenancy goes sour and ends up at a tribunal. An ex-tenant asks what data you hold on them and you've got no idea where to start. Someone's passport scan is sitting in a WhatsApp chat on a phone that's just been nicked on the way home.
Registration is the easy bit. It's the rest that protects you.
The rest
Paying the fee doesn't make you compliant on its own. You also need a short privacy notice for tenants (what you collect, why, how long you keep it, who sees it). You need a reason for holding the data, which for landlords is nearly always "the tenancy contract", not consent. You need to keep it secure, so no forwarding passport scans to your plumber and put a passcode on your phone. You shouldn't keep it forever once a tenancy's over. And if a tenant asks what you hold on them, you've got a month to tell them.
None of that is hard. It's just a lot easier when everything's in one place rather than spread across three inboxes, two phones and a WhatsApp backup.
That's a big part of why we built Letted the way we did. When your tenant messages, documents and payments all sit in one system, most of this stuff just happens by default. The privacy notice is a template. A subject access request is an export, not an archaeology dig.
But, and I want to be clear on this, using Letted doesn't get you out of registering. You're still the data controller. You decide who lives in your property, so the data is yours. We just look after it for you.
So, do it today
If you're a UK landlord and you're not registered, you almost certainly should be. The ICO has a self-assessment tool on their site if you want to double-check, but I'd be surprised if it tells you anything different.
£52. Ten minutes. Get it done and forget about it for a year.
Not legal advice, just a summary of what the ICO says. If your situation's unusual, check their self-assessment tool or ask a solicitor.
