Subject access request to your landlord or letting agent: the tenant walkthrough for pre-tribunal disclosure (UK GDPR, 2026)

The renter has had a Form 4A rent increase notice. They have decided to challenge it at the First-tier Tribunal. Their bundle is half-written and they have a clear idea of the procedural defects in the notice. What they do not have - and what would meaningfully strengthen their case - is the landlord's own paperwork. The internal email where the agent told the landlord the increase was "punchy but probably worth a try". The rent-comparison spreadsheet the landlord said they had. The referencing report from move-in that may show the agent already had recent rent figures on file.

Every one of those documents is sitting on the agent's server right now. And the renter has a free, no-reason-needed legal right to ask for a copy of all of it - a subject access request (SAR) under Article 15 of the UK GDPR.

Most renters never use the SAR route. The ones who do tend to land a tribunal bundle that is two or three categories thicker than the landlord expected, which has a way of changing the tone of negotiations before the hearing even sits.

This walkthrough is for the renter who has decided to take a tenancy dispute seriously - whether it is a rent increase challenge, a deposit dispute, a possession defence, or a disrepair claim - and wants the disclosure pack the landlord or agent has been sitting on.

What an SAR is and what it does

A subject access request is the right, under Article 15 of the UK GDPR, to ask any organisation what personal data they hold about you. The right is free. No reason needs to be given. The recipient has 30 calendar days to respond. They must provide a copy of the personal data, plus information about how it is processed, who it is shared with, and how long it is kept.

For a renter, the practical effect is this: the letting agent has a file on you. It was opened when you applied for the property. It contains your referencing report, deposit records, the agent's internal notes, every email you have ever sent them, every email the landlord has ever sent them about you, and (often) any rent-comparison or market-evidence document the landlord relied on. All of it is personal data because it relates to an identified individual - you - and the agent must hand it over.

Two narrow exceptions apply. The agent can withhold information that is genuinely about a third party (the landlord's home address, for example, where the landlord is a private individual rather than a company - that is the landlord's personal data, not yours, and you are not entitled to it). They can also withhold information that is subject to legal professional privilege - which is a real but narrow category, covering only communications between the agent and their solicitor for the purpose of legal advice. The agent's internal note saying "let us try GBP 1,750 and see if the tenant pushes back" is not privileged - it is internal commentary, and it is yours.

The cost of getting it wrong, for the agent, is significant. The Information Commissioner's Office (ICO) handles complaints about SAR non-compliance and can issue enforcement notices, fines, and (most usefully for the renter) findings of fact that can be exhibited in tribunal bundles.

The five document categories worth requesting by name

A vague SAR ("please provide all personal data you hold about me") will get a vague response. A specific SAR ("please provide the following five categories of documents") will get the documents. Naming the categories prevents the agent from "interpreting" the request narrowly. Here are the five worth listing every time.

Category 1 - the referencing pack. When the renter applied for the property, the agent ran a credit check, employment check, previous-landlord reference, and an affordability assessment. The full pack is on file and is personal data. For a rent-increase challenge, this pack is gold - the agent already has documented evidence of what the renter's income, credit profile, and rent-affordability looked like at the start of the tenancy, which makes any "tenant can clearly afford a 22% increase" argument harder to run.

Category 2 - the landlord's instructions. Email and letter correspondence between the landlord and the agent about the renter's tenancy, including instructions to increase the rent, evict, raise issues, repair, or correspond with the renter. The renter's name and tenancy will be referenced throughout - all of it is the renter's personal data. The instructions to "test the market at GBP 1,750" or "let us see if we can push them out so we can re-let" are exactly the kind of admissions that change a tribunal hearing.

Category 3 - rent comparison or market evidence. Any document the agent or landlord prepared to justify the rent originally agreed, or any subsequent increase. Comparable-property reports, screenshots of Rightmove listings, the agent's automated valuation model output, broker reports. If the landlord plans to rely on these at tribunal, they will have shared them with the agent at some point - and the renter is entitled to a copy now.

Category 4 - prior tenancy paperwork. The tenancy agreement(s) the renter has signed, any addenda or side letters, the inventory, the gas safety certificate, the EPC, the deposit protection certificate and prescribed information. These should have been served on the renter at the start, but often were not, or were filed and lost. The SAR is a clean way to retrieve them.

Category 5 - deposit, fee, and payment records. The agent's internal ledger of what the renter has paid, when, in respect of what. Holding deposit transactions, rent payments, the deposit protection paperwork, any deductions proposed or made. For a deposit-return dispute, this is the agent's own version of events.

The SAR letter template

Here is the template, with the five categories embedded. Send by email (to the named data protection officer if there is one, otherwise to the office's general email with "FAO Data Protection" in the subject line) and follow up with a posted copy if there is any reason to suspect the email will be ignored.

[Renter name]
[Property address]
[Phone] [Email]
[Today's date]

[Letting agent or landlord name]
[Office address]

FAO: Data Protection Officer

By email: [data-protection@agent.co.uk]
By post: [agent address]

Dear Sir or Madam,

Re: Subject Access Request - UK GDPR Article 15
Tenancy at [property address]

I am writing to make a subject access request under Article
15 of the UK GDPR. I would like a copy of all personal
data you hold about me, in any format, including paper
files, internal emails, internal notes, third-party
correspondence, and electronic records.

Without limiting the scope of this request, please provide
the following five categories of records in particular:

1. The referencing pack prepared in respect of my
   application to rent the property at [address], including
   the credit check report, employment check, previous-
   landlord reference, affordability assessment, and any
   automated decision-making outputs.

2. All correspondence between you and the landlord (and any
   third parties acting on the landlord's behalf, including
   the landlord's solicitor where the communication is not
   subject to legal professional privilege) in respect of
   my tenancy, including but not limited to instructions to
   increase the rent, terminate, or take any enforcement
   action.

3. Any rent comparison, market evidence, comparable
   property analysis, automated valuation model output, or
   broker report prepared in respect of my tenancy or the
   property at any time.

4. The tenancy agreement(s), any addenda or side letters,
   inventory, gas safety certificate(s), energy performance
   certificate, deposit protection certificate, and
   prescribed information that was issued or held in
   respect of my tenancy.

5. Your internal ledger of payments and charges in respect
   of my tenancy, including holding deposit transactions,
   rent payments, deposit protection paperwork, and any
   deductions proposed or made.

If you intend to redact information on the basis that it
is third-party personal data, please redact rather than
withhold the document entirely, and explain the basis for
each redaction. If you intend to withhold information on
the basis of legal professional privilege, please confirm
that the communication was made for the dominant purpose
of obtaining legal advice from a qualified solicitor.

Please confirm receipt of this request. The 30-day
response deadline runs from the date you receive this
letter.

Yours sincerely,
[Renter full name]
[Date of birth - for identity verification]

The date-of-birth line at the end is the agent's standard identity-verification request. Putting it on the letter pre-empts the agent writing back to ask for it, which can otherwise be used as a delay tactic.

The 30-day clock and what comes back

The 30-day clock starts the day the agent receives the SAR. Day 30 falling on a weekend or bank holiday rolls to the next working day. The agent can apply a one-month extension (taking the total to 60 days) only where the request is "complex" or "numerous" - in which case they must tell the renter the extension reason within the original 30 days. Silence past day 30 is non-compliance and the ICO complaint route opens.

What usually comes back, in a clean response, is a zip file or a stack of paper containing:

• A cover letter listing the categories of data found.
• The referencing pack (often the cleanest single document).
• Email exports - sometimes hundreds of pages, often unredacted, sometimes lightly redacted.
• The internal notes from the agent's CRM (e.g. ResidentialSuite, Reapit) - look for the "Notes" or "Diary" tab printouts.
• Any rent-comparison or market-evidence documents the agent has on file.
• The tenancy paperwork.
• The ledger.

The unredacted email exports are usually where the most useful material is found. Look in particular for: instructions from the landlord to the agent ("let's push the rent to GBP 1,750"), the agent's own market-rate suggestions, any internal commentary about how the rent compares to recent lets in the block, and any discussion of repairs the landlord has resisted.

When the agent claims "third-party data" or "legal privilege"

Two common pushbacks. Neither is usually well-founded.

"This is third-party data and we cannot share it." Test: is the document about you? If yes, it is your personal data, regardless of whether it also mentions other people. The agent must redact the bits that are not about you (e.g. the landlord's home address) and provide the rest. They cannot withhold entire documents on the basis that they contain a third-party reference. The ICO's guidance is explicit on this.

"This is subject to legal professional privilege." Test: was the document a communication between the agent and a qualified solicitor for the dominant purpose of obtaining legal advice? An email from the landlord to the agent saying "shall we evict?" is not privileged - the landlord is not a solicitor. An email from the agent's solicitor advising on the eviction notice is privileged. The renter is entitled to insist on the narrow construction.

If the agent refuses on either basis without explanation, the response letter is short.

Thank you for your response of [date].

You have withheld [category / document] on the basis of
[third-party data / legal professional privilege]. Under
the ICO's guidance on subject access, you are required to
redact rather than withhold where third-party data can be
separated, and to confirm the privilege test is met where
privilege is claimed. Please reconsider and disclose, with
appropriate redactions, within 14 days.

If I do not receive a satisfactory response, I will refer
the matter to the Information Commissioner's Office.

Most agents reconsider at this stage rather than face an ICO complaint and the additional administrative cost it would bring.

The ICO complaint route at day 31

If day 30 has passed and nothing has come, the route is the Information Commissioner's Office. Their complaints process is online at ico.org.uk, free, and handled by case officers who are experienced in SAR enforcement against letting agents and landlords. The complaint takes 10-15 minutes to file. Attach the original SAR letter, evidence of delivery (an email read receipt or proof-of-posting), and a one-paragraph note of the chronology.

The ICO can do three things, in escalating order: write to the agent reminding them of their obligations (usually enough), issue an enforcement notice (compels disclosure within a fixed deadline), or issue a fine. The renter does not get the fine, but the renter does get the disclosure - and a finding by the ICO that the agent failed to comply.

That ICO finding is also exhibitable in a tribunal bundle. A note in the witness statement to the effect of "the landlord and agent failed to comply with my subject access request and the ICO issued an enforcement notice on [date]" is the kind of detail that shifts the dynamic of the hearing.

How the disclosed pack lands in a tribunal bundle

For a Form 4A rent increase challenge, the disclosed pack typically becomes Exhibits 5 to 10 of the tenant's bundle, in this order:

• Exhibit 5: the referencing pack (evidence of income and affordability at start of tenancy).
• Exhibit 6: the landlord's instructions to the agent about the increase (evidence of intent and rationale).
• Exhibit 7: the rent comparison evidence the landlord prepared (evidence that the comparator set is weak or selectively chosen).
• Exhibit 8: the prior tenancy paperwork (evidence of the rent baseline and any side-letter rent-review clauses).
• Exhibit 9: the ledger (evidence of full and timely rent payment history).
• Exhibit 10: the ICO complaint and any enforcement correspondence (only if the SAR was resisted).

The witness statement paragraph at the start of the SAR-derived section reads something like: "On [date] I served a subject access request on the landlord's agent. The response is at exhibits 5 to 9. The disclosed correspondence shows [point of fact relevant to the procedural challenge]." Short, dated, factual.

Where the RentSOS check fits

The free check at rentsos.co.uk identifies the procedural defects in a Form 4A rent increase notice. The SAR walkthrough above is the way to gather the evidence pack that supports those procedural defects at tribunal. The check tells the renter what the case is; the SAR tells the renter what the landlord has been thinking. Together they produce the strongest possible bundle.

---