Estate agents handle significant amounts of personal data - names, addresses, financial information, identification documents, and more. The UK General Data Protection Regulation (UK GDPR) and the Data Protection Act 2018 set out how this data must be collected, processed, stored, and disposed of.
Non-compliance can lead to enforcement action by the Information Commissioner's Office (ICO) and serious reputational damage. The highest tier of fine is up to £17.5 million or, for a business, 4% of total worldwide annual turnover if that is higher (UK GDPR Article 83).
Are You a Data Controller?
Yes. As an estate agent, you determine why and how personal data is processed in connection with property sales and lettings. This makes you a data controller under the UK GDPR. You must register with the ICO and pay the annual data protection fee (the amount depends on the size of your business - check the current figure on the ICO data protection fee page) and comply with all data protection principles.
The Seven Data Protection Principles
- Lawfulness, fairness, and transparency - you must have a lawful basis for processing data and be open about how you use it
- Purpose limitation - collect data for specified, explicit and legitimate purposes and do not use it for something incompatible - a compatible new purpose still needs its own lawful basis
- Data minimisation - only collect what you actually need
- Accuracy - keep data accurate and up to date
- Storage limitation - do not keep data longer than necessary
- Integrity and confidentiality - protect data with appropriate security measures
- Accountability - demonstrate compliance with these principles
Lawful Bases for Processing
The most relevant lawful bases for estate agents are:
- Contract - processing data to fulfil your agency agreement with a vendor or landlord
- Legal obligation - processing required by law, such as AML identity checks
- Legitimate interests - processing data for your business purposes where this does not override the individual's rights (e.g., sharing property details with genuinely interested buyers)
- Consent - where no other basis applies, particularly for marketing communications
Practical Compliance Steps
Privacy Notice
Provide a clear privacy notice explaining what data you collect, why, how long you keep it, and who you share it with. This should be given to vendors, buyers, landlords, and tenants at the point you collect their data. Since 19 June 2026 it must also tell people they can complain to you under section 164A of the Data Protection Act 2018, as well as to the Information Commission, still known as the ICO, under section 165 (UK GDPR Article 13(2)).
Marketing Consent
Marketing emails and texts to individuals are covered by the Privacy and Electronic Communications Regulations (PECR) as well as the UK GDPR. You generally need the person's prior consent (PECR regulation 22). A narrow exception, the "soft opt-in", covers marketing of your own similar services where you got the person's details during a sale, or negotiations for a sale, to them - and only if you gave them a simple, free way to refuse at the time and in every message since. Keep records of when and how consent was given, and provide a simple way to unsubscribe.
Data Sharing
When you share buyer details with a vendor, or pass information to a conveyancer or mortgage broker, ensure you have a lawful basis. Do not share more data than necessary for the purpose.
AML Records
The Money Laundering Regulations 2017 require you to keep customer due diligence records for five years from when a one-off transaction completes or, for an ongoing business relationship, from when the relationship ends - records of transactions within a relationship never need keeping for more than 10 years (regulation 40). When that period ends you must delete personal data obtained for AML purposes, unless another law requires you to keep it, the person has consented, or you reasonably believe it is needed for legal proceedings. Do not keep other personal data longer than necessary.
Data When a Sale Falls Through
If a sale collapses, review what data you still need to retain. Delete buyer data you no longer need for any lawful purpose. Vendor data may need to be kept if the agency agreement is still in effect.
Subject Access Requests (SARs)
Individuals have the right to request a copy of the personal data you hold about them. You must respond without undue delay and within one month (UK GDPR Article 12A). Since 5 February 2026 that month starts at the latest of: when you receive the request, when you receive any identity information you asked for, or when any permitted fee is paid. You can extend by up to two further months for complex or numerous requests, but only by telling the person, with reasons, within the first month. If you reasonably need more information to identify what an access request relates to, the time until they reply does not count. Have a process in place before a request arrives.
Complaints About Data Handling
Since 19 June 2026, anyone who thinks you have broken data protection law in handling their personal data can complain to you directly (Data Protection Act 2018 section 164A). You must make complaining easy - for example with a complaint form that can be completed electronically and by other means - acknowledge each complaint within 30 days of receiving it, look into it without undue delay, keep the person updated on progress, and tell them the outcome.
Security
Appropriate security measures include:
- Encrypting laptops, phones, and portable devices
- Using strong, unique passwords and multi-factor authentication on all systems
- Restricting access to personal data to staff who need it
- Shredding physical documents containing personal data before disposal
- Ensuring your CRM and email systems are properly secured
Data Breaches
If a data breach occurs (e.g., an email sent to the wrong person, a laptop stolen, or a cyber attack), you must assess the risk. If the breach is likely to result in a risk to individuals' rights and freedoms, you must notify the ICO without undue delay and, where feasible, within 72 hours of becoming aware of it (UK GDPR Article 33). If the risk is high, you must also notify the affected individuals.
Are you an independent estate or letting agent? Listing on Domovita is free for agents - no subscription, no per-branch or listing fee, and no minimum term or tie-in. See how listing with Domovita works.
GDPR compliance is an ongoing responsibility, not a one-off exercise. The ICO website provides detailed guidance specifically for small businesses. If in doubt, seek specialist advice.
Last reviewed: 22 October 2026.