Agents warned about Data Subject Access Requests

Agents are being urged to take a proactive approach to Data Subject Access Requests (DSARs).

It comes amid warnings that increasing consumer awareness of personal data rights is placing greater responsibility on property professionals to ensure they understand and comply with their legal obligations.

Paul Offley (pictured), Group Compliance Officer at The Guild of Property Professionals, says that agents must recognise the importance of handling requests correctly, particularly as the volume and complexity of requests from individuals seeking access to their personal information continues to grow.

Understanding DSARs is not simply a matter for compliance officers or senior management.”

Offley said he has seen an increase in the number of requests from individuals seeking access to their data, some of which can be particularly complex, especially where an agency has maintained a long-standing relationship with the individual concerned.

With estate and letting agents holding significant amounts of personal information relating to buyers, sellers, landlords and tenants, understanding Data Subject Access Requests (DSAR) is no longer optional. It is an essential part of professional practice, maintaining customer trust and ensuring regulatory compliance.

Personal data

Under the UK General Data Protection Regulation (GDPR), individuals have the right to request access to personal data held about them by an organisation. For estate and letting agents, this can include emails, property records, viewing notes, correspondence, internal communications and other information relating to a particular individual.

However, Offley is concerned that some agents may still underestimate the significance of a DSAR, viewing it as an administrative inconvenience rather than a legal obligation that requires careful consideration and handling.

A Data Subject Access Request can arise at any stage of the property journey, whether from a prospective buyer, seller, landlord, tenant or any other individual whose personal information is being processed.

Requests can be made verbally or in writing, and individuals do not have to specifically use the words ‘Data Subject Access Request’ for their request to be valid.

Relevant responses

Offley highlights that responding appropriately involves considerably more than simply forwarding a collection of emails or printing a customer record. It requires identifying relevant personal data, considering the rights of other individuals, applying appropriate exemptions where necessary and ensuring that information is disclosed securely and within the applicable statutory timeframe.

Failure to recognise or properly manage a request can expose an agency to unnecessary risks, including regulatory complaints, reputational damage, customer dissatisfaction and potential enforcement action.

Conversely, a well-managed DSAR process demonstrates that an agency understands its responsibilities and respects the rights of the individuals it serves, helping to build confidence and trust.

Offley says: “Understanding DSARs is not simply a matter for compliance officers or senior management. Frontline staff, negotiators, property managers, administrators and branch managers all have a role to play in recognising requests and ensuring they are passed to the appropriate person.”

“Estate and letting agencies should review their existing processes and ensure they have clear procedures in place for recognising, recording and responding to Data Subject Access Requests.

“This should be supported by appropriate staff training and a thorough understanding of what personal information may be held across the agency’s systems, records and communications.”