Section 164A for landlords and letting agents
Landlords and letting agents hold unusually sensitive material about applicants and tenants, from bank statements to immigration documents. Complaints about it are section 164A complaints with a 30-day acknowledgement deadline.
Does section 164A apply to you?
A letting agent is usually a controller of applicant and tenant data in its own right, and a landlord is a controller too. Decide who acknowledges before a complaint arrives.
The complaints you are most likely to get
- Referencing and credit check data kept after a failed application
- Right to rent documents retained longer than needed
- Tenant details passed to contractors, buyers or other agents
- Deposit dispute evidence shared with the other party
- Former tenants' records used for marketing new properties
Channels to watch
The 30-day clock starts when a complaint reaches your organisation by any route, so every channel below needs a named owner.
- The branch inbox and phone
- Individual negotiators' work email
- Portal enquiry forms
- Letters to the registered office or branch
- In person at the branch or at a viewing
Worked examples
| What arrives | How to treat it |
|---|---|
| A failed applicant asks why you still hold their bank statements | A complaint about retention. Check your actual deletion practice, not your intended policy |
| A tenant objects that a contractor was given their phone number and tenancy history | A complaint about sharing. Check what you actually sent, and whether it was necessary |
| A landlord and agent both receive the same complaint | Agree who acknowledges and who investigates, and confirm to the complainant, so neither assumes the other has done it |
A minimum viable process
- Publish a complaints route with an electronic option and another means. Use the complaints policy template.
- Add the section 164A wording to your privacy notice and your subject access request template. Use the privacy notice wording.
- Log every complaint with the date it was received. Use the complaints log template.
- Acknowledge within days, not weeks. See the 30-day acknowledgement rule.
- Investigate, update the person, decide, tell them the outcome and signpost the ICO. See how to handle a data protection complaint.
Prove you met the duty, not just that you meant to
The work in section 164A is operational: spotting the complaint, dating it, acknowledging it within 30 days, keeping the person informed and recording the outcome. PrivacyComplaints does that part for small organisations.