Landlords and letting agents now need a clear route for tenants and applicants to complain about how their personal data is handled, after the Data (Use and Access) Act 2025 introduced a new complaints requirement.
The change is already live, and the NRLA says landlords must be able to receive and acknowledge data complaints, including those made through social media, even if small operators do not need a formal written policy.
For landlords, the immediate issue is not theory but process. A sector already adjusting to the Renters’ Rights Act now has another compliance point that can be missed by self-managing operators who still treat data protection as a once-a-year paperwork task rather than an active part of tenancy management.
NRLA says complaints must be acknowledged within 30 days
The NRLA says the easiest way to comply is to provide an email address that people can use to raise complaints about the use of their data. Complaints must be acknowledged within 30 days, although they do not have to be fully resolved inside that same window.
The NRLA says landlords should investigate and address complaints within a reasonable time, with the likely timescale depending on complexity and how many people need to be consulted.
The body also warns that if a complaint lands on social media, it still counts. The better course is to acknowledge it and move the discussion to a private contact channel such as email, rather than trying to handle personal data issues in public.
This follows Residential Landlord’s recent report that more self-managing landlords are moving towards agents as compliance pressure grows. It also builds on Residential Landlord’s wider coverage of rising enforcement risk, showing that landlord exposure is no longer limited to repairs, licensing and possession paperwork.
Small landlords are most exposed to missing quiet compliance changes
The risk here is less about a wave of claims and more about landlords simply not noticing the rule until something goes wrong. Many smaller operators already rely on personal phones, informal messaging and ad hoc record-keeping. Once complaints handling becomes a legal expectation, that approach looks weaker.
There is also a wider point for agents. Firms that market themselves as compliance support for landlords will be expected to show they have a proper complaint path and staff awareness in place, especially where they control referencing, applicant records and tenant communication.
While this is not the biggest regulatory shift facing the sector, it is the kind of low-profile rule that can catch people out because it sits outside the usual licensing and tenancy checklist. The NRLA’s guidance is here: new data protection rules coming in today.
Opinion
This is exactly the type of rule that gets dismissed as minor until a complaint lands. Landlords who still run tenancies through scattered inboxes and WhatsApp threads should take the hint. Compliance drift is becoming one of the fastest ways to create avoidable trouble.
