Estate and letting agents are being advised to strengthen their approach to Data Subject Access Requests (DSARs) as consumer awareness of personal data rights increases, placing greater compliance obligations on property professionals.
Paul Offley, Group Compliance Officer at The Guild of Property Professionals, has reported an increase in the volume and complexity of requests from individuals seeking access to their personal information held by agencies. He notes that requests can be particularly complex where an agency has maintained long-standing relationships with clients.
Legal obligations under GDPR
Under the UK General Data Protection Regulation (GDPR), individuals have the right to request access to personal data held about them by an organisation. For estate and letting agents, this can include emails, property records, viewing notes, correspondence, internal communications and other information relating to a particular individual.
Requests can be made verbally or in writing, and individuals do not need to specifically use the words ‘Data Subject Access Request’ for their request to be valid. The request can arise at any stage of the property journey, whether from a prospective buyer, seller, landlord, tenant or any other individual whose personal information is being processed.
Compliance risks and staff training
Offley highlighted that responding appropriately involves considerably more than simply forwarding emails or printing customer records. It requires identifying relevant personal data, considering the rights of other individuals, applying appropriate exemptions where necessary and ensuring that information is disclosed securely within the applicable statutory timeframe.
Failure to properly manage a request can expose an agency to regulatory complaints, reputational damage, customer dissatisfaction and potential enforcement action. This comes at a time when estate agents are already managing time-intensive administrative processes, adding to operational pressures.
“Understanding DSARs is not simply a matter for compliance officers or senior management,” Offley said. “Frontline staff, negotiators, property managers, administrators and branch managers all have a role to play in recognising requests and ensuring they are passed to the appropriate person.”
Industry implications
The increased focus on data compliance adds another layer of regulatory responsibility for agencies already navigating changing market conditions and regulatory requirements. Offley recommends that estate and letting agencies review their existing processes and ensure they have clear procedures in place for recognising, recording and responding to Data Subject Access Requests.
He emphasised that agencies should support these procedures with appropriate staff training and a thorough understanding of what personal information may be held across the agency’s systems, records and communications. A well-managed DSAR process demonstrates that an agency understands its responsibilities and respects the rights of the individuals it serves, helping to build confidence and trust.
