Your duties
- Have a lawful basis for each use of personal data and tell people about it in a privacy notice.
- Collect only what you need. Referencing and Right to Rent evidence is sensitive — keep it to the minimum and restrict access.
- Keep it secure, and keep a record of your processing activities.
- Respond to subject access, correction and erasure requests within one month.
- Report a qualifying personal data breach to the ICO within 72 hours.
- Most landlords who hold tenant data electronically must pay the ICO data protection fee.
In LIS
The Privacy Centre handles export, correction and erasure requests, the compliance register holds your record of processing and breach log, and retention policies delete records automatically at the end of their retention period.