What obligations do you have under Data Protection rules?

Although in most cases as a lodger landlord you will not be a business, you still need to keep your lodger’s data safe.  

For example, you should not post messages about them on social media complaining that they don’t pay their rent on time!

You will find an online guide on the government website here which has information about the data protection rules, plus you can find a huge amount of information on the Information Commissioners Office (ICO) website.

The Information Commissioner is responsible for enforcing the regulations and for providing help and guidance to the public.

Do you need to register with the ICO?

Most businesses which hold information about people will need to register with the ICO, which involves going on a public register and paying an annual fee of around £35 pa.

Whether lodger landlords need to register is a moot point.  You are not (in most cases) a business but you do hold data, sometimes sensitive data, about your lodger (for example financial details, maybe medical details etc).  

When preparing this article we spoke with the ICO helpline and the person we spoke to said that registration in most cases would not be necessary unless

• You have installed CCTV in the property, and/or
• Are storing data electronically

So although we do suggest, in this Guide, that you might want to scan information, such as copy forms and certificates, into your computer, you may technically be making yourself liable for registration with the ICO by doing this.

Although in reality, it is unlikely that the ICO would expect someone taking a single lodger into their home to register, and even if you were storing their data on your computer, it is highly unlikely that they would ever penalise you for this.

However, if you take in several lodgers, particularly if you have an HMO license and are effectively a ‘professional’ Lodger Landlord renting rooms to lodgers as a business, you will almost certainly need to register.

If you are not sure, the ICO have a telephone helpline where you can talk to one of their advisers.

Dealing with Data

Although you are unlikely to have to register with the ICO, you will still be expected to deal with your lodger’s data in a proper way.  

This basically means keeping it safe and secure. 

You may also want to consider serving a data information notice on your lodger, just letting them know what data you hold and what you do with it. This is part of the transparency required by the regulations.

You will find a draft data information notice you can use along with detailed notes available for sale on Your Law Store.  As to whether you need to serve this:

• It is probably not necessary if you just rent a room to a single lodger – particularly if all your lodger’s data is stored in paper format (ie not on your computer)
• Even if you store information on computer or online, it is probably not really necessary 
• However, if you rent to several lodgers, and renting to lodgers is effectively a small business, particularly if your property is an HMO, you should always serve a data information notice on lodgers and applicants.

How long should you keep data?

The Data Protection rules say you should keep data no longer than is necessary.  However, this does not mean that you should be too quick to delete it, even if your lodger is agitating for you to do this.

There are two circumstances where you will need it:

• If you are investigated by the Revenue, who will need to have details of your lodger income, and/or
• If a legal claim is brought against you by your lodger.

For these reasons, we recommend that you should keep all data for not less than six years after your lodger has left.  If your lodger objects to this, you can say that you are required to keep financial information for this length of time by the revenue.