Estate and letting agents are under growing pressure to improve their data protection procedures as more customers request access to the personal information agencies hold about them. The Guild of Property Professionals has reported an increase in Data Subject Access Requests (DSARs), warning that mishandling them could lead to regulatory complaints, reputational damage and potential enforcement action.
Rise in consumer awareness drives requests
Consumers are becoming increasingly aware of their rights under UK data protection legislation. Paul Offley, group compliance officer at The Guild of Property Professionals, said some requests have become particularly complex, especially where agencies have maintained relationships with customers over several years.
Under UK GDPR, buyers, sellers, landlords and tenants can request access to personal information held about them. This can include emails, viewing notes, property records, correspondence and internal communications containing their personal data.
Casual requests trigger legal obligations
One of the biggest risks for agencies is failing to recognise a valid request. Customers do not need to submit a formal letter or mention the words 'Data Subject Access Request'. Instead, they can make a request verbally, by email or through other communication channels. Consequently, a request made during a telephone conversation with a negotiator could trigger the same legal obligations as a formal written application.
Agencies generally have one month to respond, although the rules allow extensions in certain circumstances. However, responding involves more than simply handing over a customer file. Agents must identify the relevant personal data, consider whether disclosure would affect other individuals' rights and apply any appropriate exemptions. They must also ensure they share the information securely.
Reputational damage adds to compliance risks
The Guild warns that agencies which overlook requests or fail to respond properly risk more than regulatory scrutiny. Complaints, customer dissatisfaction and damage to an agency's reputation could follow.
Offley said agents should stop treating data access requests as routine administrative tasks. He commented: "Understanding DSARs is not simply a matter for compliance officers or senior management. Frontline staff, negotiators, property managers, administrators and branch managers all have a role to play in recognising requests and ensuring they are passed to the appropriate person."
The issue can become particularly complicated for agencies holding years of correspondence, tenancy records and property transaction information. As a result, agents need to understand where personal data sits across their systems and who is responsible for handling requests.
Staff training and clear procedures essential
The Guild is urging estate and letting agencies to review their existing procedures and ensure staff know how to identify and escalate requests. This includes requests made directly to negotiators, property managers or branch administrators rather than through a dedicated compliance contact.
Offley added: "Estate and letting agencies should review their existing processes and ensure they have clear procedures in place for recognising, recording and responding to Data Subject Access Requests. This should be supported by appropriate staff training and a thorough understanding of what personal information may be held across the agency's systems, records and communications."
The Guild says agencies should treat DSAR compliance as an operational responsibility across the business, rather than leaving it solely to senior management or compliance teams.
