UK GDPR

GDPR & Legal Compliance

TenantAlert operates on a documented legitimate interests basis under UK GDPR, set out in a full Legitimate Interests Assessment. This assessment is currently undergoing independent legal review.

Lawful Basis for Processing

TenantAlert processes adverse tenant data under Article 6(1)(f) of UK GDPR — Legitimate Interests. A full Legitimate Interests Assessment (LIA) has been completed, documenting that:

The processing serves a genuine industry need (protecting letting agents and landlords from repeat adverse tenants)
The impact on data subjects is proportionate and mitigated by safeguards
The interests of data subjects do not override the legitimate interests of the network

Key Safeguards

Data Retention

Records are retained for 6 years in line with standard limitation periods for civil claims, then deleted automatically.

Subject Access Requests

Any individual can request details of any record held against them. Requests are processed within one calendar month, as required by Article 12 UK GDPR. Contact: dpo@tenantalert.co.uk

Dispute & Suppression

Any agent or individual can raise a dispute against a record. When a dispute is raised, the record's content is withheld from search results under Article 18 UK GDPR (restriction of processing) and a neutral 'under review' placeholder is shown in its place, pending review. Full moderation policy available on request.

ICO Registration

TenantAlert Ltd is registered with the Information Commissioner's Office. Registration number: ZC134269.

Data Security

Data is encrypted in transit (TLS 1.2+) and at rest. Access is role-gated. A formal Data Breach Response Plan is in place.

For Letting Agents — Your Compliance Position

When you join TenantAlert, you receive an Agent Compliance Pack containing:

Updated tenancy application form wording — so applicants are informed at the point of application that adverse data may be shared with a verified industry database
Privacy notice addendum — to add to your own agency privacy notice
Guidance on your obligations as a data controller

The application wording and privacy notice addendum are intended to help your agency document its own processing. Your compliance remains your own responsibility — you should ensure your processing meets your obligations under UK GDPR and seek independent advice where appropriate. TenantAlert acts as a separate data controller and carries its own ICO registration.

Request Compliance Pack

Documents Available on Request

Data Protection Impact Assessment (DPIA)
Legitimate Interests Assessment (LIA)
Data Processing Agreement (for agents who require one)
Data Breach Response Plan
Moderation and Dispute Suppression Policy

Contact: hello@tenantalert.co.uk

This page was last reviewed June 2026. TenantAlert Ltd, Company No. 17181885. Registered office: Towngate House, 2-8 Parkstone Road, Poole, BH15 2PW. ICO registration: ZC134269.