The Guild of Property Professionals is urging letting and estate agents to take a more proactive approach to Data Subject Access Requests (DSARs), as growing consumer awareness of personal data rights places more responsibility on agents to understand their legal obligations.
Under the UK General Data Protection Regulation (UK GDPR), individuals can ask an organisation for access to the personal data it holds about them. For letting and estate agents, a subject access request can cover emails, property records, viewing notes, correspondence and internal communications. Agents hold personal information on tenants, landlords, buyers and sellers, often involving sensitive circumstances, financial details and family situations.
A request can arise at any stage of a tenancy or sale, from a tenant, landlord, buyer, seller or anyone else whose data an agent processes. People can make requests verbally or in writing, and do not need to use the phrase ‘Data Subject Access Request’ for the request to be valid.
“Understanding DSARs is not simply a matter for compliance officers or senior management,” said Paul Offley, group compliance officer at The Guild of Property Professionals (pictured).
“Frontline staff, negotiators, property managers, administrators and branch managers all have a role to play in recognising requests and ensuring they are passed to the appropriate person.”
Offley receives numerous compliance questions from Guild members each month. Over the past month, he has seen more requests from individuals seeking access to their data, some of them complex, particularly where an agency has a long-standing relationship with the person concerned.
He is concerned that some agents still view a DSAR as an administrative inconvenience rather than a legal obligation that needs careful handling. A proper response involves more than forwarding emails or printing a customer record. Agents must identify relevant personal data, consider the rights of other individuals, apply exemptions where necessary and disclose information securely within the statutory timeframe.
The Guild warns that failing to recognise or manage a request properly can expose an agency to regulatory complaints, reputational damage, customer dissatisfaction and potential enforcement action. It argues that a well-managed process shows an agency understands its responsibilities and respects the people it serves.
According to Offley, agents should give data protection the same weight as the other legal and professional responsibilities they handle every day, including property transactions, client money, professional conduct and consumer protection.
“Estate and letting agencies should review their existing processes and ensure they have clear procedures in place for recognising, recording and responding to Data Subject Access Requests,” he added.
“This should be supported by appropriate staff training and a thorough understanding of what personal information may be held across the agency’s systems, records and communications.”
