Data (Use and Access) Act 2025

Every agency now needs a data-protection complaints process

From 19 June 2026, the Data (Use and Access) Act 2025 adds a complaints duty for every organisation that handles personal data — including letting agents and landlords. This is a one-time, organisation-level set-up. Here's exactly what it asks for, and a template you can adopt.

Download the free guide (PDF) → Or have it emailed
Instant download — no email required.
19 June 2026 the complaints duty applies 30 days to acknowledge a complaint Once per organisation, not per property

What the Act actually requires

The Data (Use and Access) Act 2025 ("DUAA") amends UK data-protection law. One change is a specific complaints duty: organisations that process personal data must make it straightforward for people to complain about how their data is handled, and must respond within a set time. For a letting agent or landlord, the personal data in question is your applicants', contract-holders' and landlords' information — referencing, ID, payment and tenancy records.

The duty, in five steps

  1. Operate a documented data-protection complaints process — written down, not "we'd deal with it".
  2. Give people a direct way to complain about your handling of their personal data — a named route (email or form).
  3. Acknowledge a complaint within 30 days of receiving it.
  4. Investigate without undue delay and keep the complainant informed of progress and outcome.
  5. Say so in your privacy notice — tell people they can complain to you directly, as well as to the ICO — and keep records of complaints and how they were resolved.

Why it applies to letting agents and landlords

The duty is organisation-level and turns on whether you process personal data — not on how many properties you manage. Specifically for lettings: you reference applicants, run credit and ID checks, hold tenancy and payment records, and share data with landlords, deposit schemes and contractors. That makes you a data controller, and the complaints duty applies to your business as a whole — once, not per property or per tenancy.

It's separate from your RSW service-complaints policy

Rent Smart Wales already expects a complaints / redress procedure for your lettings service. The DUAA duty is about personal data. They're different obligations — you need both, and one does not satisfy the other. They can point to different routes and people.

How HouseComply helps

We give you a ready-to-adopt template — the procedure, privacy-notice wording, and a complaints register — and we record that you've put a process in place. HouseComply does not assess or certify your data-protection compliance — adopting and operating the process is your responsibility.

What HouseComply does — and doesn't. HouseComply can record that you've put a process in place and store your template. It does not assess or certify your data-protection compliance. The process you adopt is your own; you're responsible for its content and for following it in practice.

Get the free guide + adoptable template

Drop your email and we'll send you the full guide and a white-label data-protection complaints template. Print-friendly, written for letting agents, free of charge.

We'll email the guide immediately. We never share your details — see our Privacy Policy. The checkbox above controls ongoing marketing emails (the guide itself sends either way because you asked for it).

Adopt the process inside HouseComply. We'll keep the record.

Adopt the data-protection complaints template, store it against your account, and record that your process is in place — alongside your Rent Smart Wales working practices. HouseComply records and stores; it does not assess or certify your data-protection compliance.

Download the free guide (PDF) 3 properties · 30 days · no card · no sales call