How should landlords deal with a tenant’s subject access request?

Tenants and former tenants can ask for a copy of the personal information you hold about them. This is called a subject access request, often shortened to SAR.

A request can feel threatening, particularly if there is already a dispute. However, the safest approach is to deal with it calmly, meet the applicable deadline and check carefully what should be disclosed.

What counts as a subject access request?

There is no prescribed wording or compulsory form. A request can be made verbally, by email, by letter or through social media. The tenant need not mention data protection legislation or use the words “subject access request”.

For example, “Please send me all the information you hold about me” is a SAR. You cannot insist that the tenant explains why they want it.

What should I do first?

Record when the request arrived, acknowledge it and note the response deadline. Keep a written note of any verbal request.

Check that you are dealing with the right person. Do not routinely demand a passport from a tenant whose identity you already know. If someone else is making the request, such as their solicitor, check that they have authority to act and receive the information.

If a claim is threatened or underway, send the request to your own solicitor promptly and agree who will prepare and send the response.

How long do I have?

Normally, you must respond without undue delay and within one calendar month of receiving the request.

An extension of up to two further months is available where necessary because the request is complex or the tenant has made several requests. You must notify the tenant within the initial month and explain why. Being busy is not enough.

If you reasonably need information to verify identity or a representative’s authority, the response period starts when you receive it. Ask promptly.

Can I ask the tenant to be more specific?

Yes, if clarification is reasonably needed to identify the information requested. The response clock pauses while you await that clarification.

You cannot force the tenant to reduce their request. If they confirm that they want everything, make reasonable searches for the information covered by their request. Do not use clarification simply to delay responding.

What does “personal information” mean?

It means information relating to an identifiable living person. It includes contact details, but also information about the tenant’s finances, actions and circumstances, and recorded comments or opinions about them.

Information can qualify even if the tenant is not named, provided you can identify them from the context.

For example, a text saying “I cannot pay this month’s rent because I have lost my job” contains personal information about the tenant. Giving them only the phone number attached to that message would not provide the other personal information it contains.

What exactly should I provide?

For a request for all the personal information you hold about the tenant, make reasonable and proportionate searches and provide the information you find, subject to the exemptions explained below. Relevant records may include:

You should not provide just a list of categories, such as “phone number, rent records and messages”. The tenant is entitled to a copy of the actual personal information covered by their request.

Copies or exports of relevant documents and messages are often the simplest way to respond. You can provide accurate extracts instead, but include enough context to make them understandable. A vague summary such as “we discussed rent arrears” is not a substitute for the information recorded in those discussions.

A document or message is not automatically all personal information about the tenant merely because they sent or received it. Unrelated material need not be included. However, do not remove relevant details simply because they are inconvenient or might help the tenant’s case.

If a telephone conversation was not recorded and you made no notes, you do not have to create a transcript from memory. If you retained notes or a recording, consider the personal information in those records.

Where should I search?

Make a reasonable and proportionate search of the places where relevant information is likely to be held. These may include your tenancy files, email accounts, property management software, texts and WhatsApp messages used for the letting.

Using a personal phone or email account for your letting business does not put those records outside the request.

Keep a note of where and how you searched. You must be able to justify any decision that a particular search would be unreasonable or disproportionate.

If an agent holds information on your behalf, arrange for their assistance. An agent may also have separate responsibilities for information they control themselves; do not assume that referring the tenant to the agent discharges your own duties.

What if the tenant is hostile or wants the information to sue me?

Hostility, allegations against you or an intention to bring a claim do not, by themselves, justify refusal. Even abusive wording does not automatically invalidate a request.

The same applies if proceedings have already begun. You must assess the SAR separately from the dispute and the court’s disclosure process.

Can I withhold correspondence with my solicitor?

Yes, information protected by legal professional privilege can be withheld. This commonly includes confidential communications between you and your solicitor seeking or giving legal advice. Certain material prepared for contemplated or ongoing litigation may also be protected.

However, sending an existing tenancy document to your solicitor does not automatically make it privileged. Nor does a dispute make your entire file exempt.

Ask your solicitor to check doubtful material before disclosure. Accidentally revealing privileged advice can damage your position.

There is also a limited exemption for records of your intentions in negotiations with the tenant, where disclosure would be likely to prejudice those negotiations. It is not a general exemption for all correspondence about settlement.

What about information concerning neighbours, other tenants or guarantors?

A tenant’s SAR does not give them unrestricted access to other people’s information.

Where a record contains information about both the tenant and someone else, consider whether you can disclose the tenant’s information while removing identifying details about the other person. This is called redaction.

If the other person remains identifiable, consider whether they consent or whether disclosure without consent is reasonable. Their refusal does not automatically settle the matter. Confidentiality and any risk arising from disclosure are relevant.

For example, a neighbour’s complaint may contain information about the tenant which should be disclosed, while the neighbour’s identity may need protection. Removing their name alone may not prevent identification.

Can I leave out information that makes me look bad?

No. Embarrassment or concern that information may help the tenant’s case is not an exemption.

Do not delete, alter or conceal information to prevent the tenant receiving information they are entitled to. Deliberately doing this can be a criminal offence. Preserve relevant records and take advice about any routine deletion scheduled while the request or dispute is being dealt with.

Can I refuse repeated requests or charge for my time?

Requests are normally free. You cannot routinely charge for the time spent searching and preparing the response.

You may refuse a request, wholly or partly, or charge a reasonable administrative fee if it is manifestly unfounded or excessive. There is a high threshold, and you need clear evidence.

A campaign of requests intended solely to cause disruption, or unreasonable repetition of a request already properly answered, may qualify. A large request or a difficult relationship is not enough by itself. Consider each request individually and obtain advice before relying on this ground.

What should my response include?

Provide the personal information covered by the request, subject to any valid exemptions, and the required accompanying information about how you use it.

This includes your purposes, the types of information held, who receives it, retention periods, its source where relevant, and the tenant’s data protection and complaint rights. Explain any relevant overseas transfers or automated decision-making. Your privacy notice may cover much of this, but check that it fully answers the request.

Explain any refusal or withholding as far as you lawfully can, without revealing protected information. Include how to complain to you and the ICO, and the right to seek a court remedy.

Send the response securely. For an electronic request, normally use a commonly used electronic format. Check the recipient and ensure that redactions cannot be undone: placing a black rectangle over text may leave the underlying words recoverable.

Keep a copy of the response and a record of your searches, redactions and reasons for withholding information.

What happens if I ignore the request?

The tenant may complain to the Information Commissioner’s Office (ICO) or apply for a court order requiring compliance. A data protection breach may also result in a compensation claim if it causes damage or distress.

An existing tenancy dispute is therefore a reason to handle the request carefully and obtain advice promptly.

Further guidance is available in the ICO’s guide to subject access.