Tenant subject access requests: a letting agency workflow

A tenant does not need to write “subject access request” for their message to count as one. If they are asking for their personal information, route the request to a trained owner, record when it arrived and calculate the deadline. Confirm identity only as far as necessary, clarify the scope where that is reasonably required, search the places likely to hold the information, review third-party material and send the response securely.

The right of access applies across the United Kingdom under the UK GDPR and Data Protection Act 2018. It gives a person confirmation that their information is being processed, a copy of their personal information and specified supplementary information. This workflow turns those duties into an operational case for a letting agency. It is general information, not legal advice on a particular request.

Recognise a request wherever it arrives

A valid request can be verbal or written, including through social media, and it can reach any part of the organisation. The person does not need to cite article 15 or explain why they want the information. A message such as “send me the notes your team has made about my tenancy” may therefore be a subject access request even if it sits inside a complaint.ICO’s recognition guidance was last amended on 7 April 2026 and recommends training staff to identify and record requests.

Give reception, property management, maintenance, accounts and social-media staff one route for escalation. The central record should preserve the original wording, channel and time received. A standard form may help, but the agency cannot require the requester to use it. If a phone call contains a request, write down what was asked for and confirm the scope in a follow-up message.

Open a case and calculate the deadline

Assign an accountable case owner and log the request immediately. Under ICO’s detailed response guidance, the normal limit is without undue delay and no later than one month after receipt. The clock can instead run from receipt of proportionate identity information, authority for a representative or a fee that is lawful in limited circumstances. A request received on a weekend still starts on that date; if the corresponding deadline falls on a weekend or public holiday, it moves to the next working day.

A complex request, or several rights requests from the same person, can justify an extension of up to two further months. The agency must tell the requester about the extension and its reasons within the first month. A large volume of information does not automatically make a request complex, and relying on a software supplier to retrieve records does not do so either. Record the calculation and any decision to extend rather than treating the due date as a calendar reminder with no reasoning behind it.

Verify identity without collecting more than you need

Check that the requester is the person the records concern, especially where there is a risk of sending tenancy, financial or health information to the wrong person. The check must be reasonable and proportionate. ICO says existing verification measures, such as an account login, may be enough; formal identity documents should only be requested when necessary.

For a request made by a solicitor, family member or other representative, establish their authority to act and receive the information. Do not send the disclosure to a familiar third party merely because staff recognise their name. Record what evidence was requested and why, then protect and dispose of any extra identity material under the agency’s retention rules.

Clarify scope when it is genuinely needed

If a request is vague and the agency holds a large amount of information, ask for details such as the tenancy, date range, subject or type of record. ICO’s current guidance allows the response clock to pause where clarification about the requested information is reasonably required. Explain why clarification is needed, make the process easy and record the dates on which the question and answer were sent.

Clarification is not permission to force a tenant to narrow a broad request. If they confirm that they want all their personal information, the agency should carry out reasonable and proportionate searches. It can also begin work on obvious parts of the request while it waits for an answer. Asking about a preferred delivery format does not stop the clock.

Build a search plan across the agency

Start with an information map: which branches, teams, processors and record types could hold personal information about this requester? Search terms may include previous names, email addresses, telephone numbers, property addresses, tenancy references and contractor job numbers. Test the terms on a sample before running the full search, and document systems and date ranges searched.

ICO requires a reasonable and proportionate search, judged against the request, volume, difficulty and the fundamental nature of the right. An agency must be able to explain why a proposed search would be unreasonable or disproportionate. There is no general technology exemption for archives or backups, although ICO does not expect extreme measures to recreate information that was genuinely deleted through normal records management.

An email hit is a lead, not automatically a disclosure. A tenant copied into a message may appear in the results even though the message says nothing about them. Review the content and context to decide what is their personal information. Keep a collection log showing search terms, custodians, exports, exclusions and follow-up questions. This makes gaps visible before the response is assembled.

Review the result for third-party information and exemptions

A maintenance file may combine the tenant’s report with a contractor’s details, a neighbour’s complaint and a property manager’s notes. The person is entitled to their own personal information, not automatically every document returned by the search. Provide enough context for the response to be intelligible, while reviewing information about other people.

Under ICO’s rights-of-others guidance, information that would reveal another person need not be provided unless that person consents or it is reasonable to disclose without consent. Removing a name may not work when the requester can identify the person from the circumstances. Use redaction on a working copy, check that hidden text and file metadata are not exposed, and have a second reviewer inspect sensitive disclosures.

Other exemptions depend on the facts. ICO says they must be considered case by case and the reasons documented. Refer legal privilege, crime and taxation, negotiations, confidential references or other uncertain exemptions for specialist review. Do not apply a blanket label across the whole file because one item may be exempt.

Send a usable response through a suitable channel

A response normally includes confirmation of processing, the requester’s personal information and the required supplementary information, such as purposes, categories, recipients, retention, source and rights. The agency’s privacy notice may cover some supplementary points, but a link does not replace the copy of personal information itself. Explain codes or context needed to understand the material.

If the request arrived electronically, provide the copy in a commonly used electronic format unless the requester reasonably asks for another commonly used format. Match security to the sensitivity and risk. ICO suggests secure remote access or an encrypted file with the access code sent separately as possible methods. Check the destination and attachments before release, then record what was sent, when and by whom.

Treat refusal and fees as exceptional decisions

In most cases an agency cannot charge for a SAR. A reasonable fee or refusal may be available for a manifestly unfounded or excessive request, but ICO describes a high threshold. Assess each request on its own evidence; repeated requests or an ongoing dispute do not make the threshold automatically. Record the reasoning and the information given to the requester about complaints and judicial remedies.

Make the next request easier to handle

Close the case with a short review. Note missing exports, unsearchable inboxes, unclear controller and processor responsibilities, duplicate retention and channels that staff used outside policy.ICO recommends an information asset register, trained request handlers, a case log and systems that support extraction and redaction. Those controls reduce the search effort while preserving the person’s rights.

If suppliers hold records for the agency, make retrieval assistance part of the processing agreement and test the export before a real deadline. Our guide to AI supplier data checks covers the questions to ask before sharing tenant information. Use the property systems integration guide to map data movement, and the tenant communication guide to make the request route clear to staff and residents.

Letting agencies reviewing their wider operating model can start with Tekniti for agencies. A workflow platform can support ownership, reminders and evidence, but the agency remains responsible for deciding how each request is handled. Keep qualified review available for difficult redactions, exemptions and controller-role questions.

This article uses the ICO’s right-of-access guidance, updated on 8 December 2025, and the recognition page amended on 7 April 2026. Check the linked guidance when a request arrives because the facts, records and legal position may change.