Subject Access Request to a Landlord or Letting Agent

Start with your own paperwork. Within 30 days of taking your deposit your landlord had to give you the prescribed information, and GOV.UK lists what it must contain: the scheme’s name and contact details, its dispute resolution service, and “their (or the letting agency’s) name and contact details”. That document names the organisations you are asking.

Then check the register. The ICO publishes a free, name-searchable register of organisations that pay the data protection fee, which returns the exact registered company name and address behind a shopfront brand — which is what you want on the envelope. Two cautions: a landlord can be a controller who owes you an answer and still be exempt from the fee, so not on the register does not mean not a controller; and the register carries individuals as well as companies.

If in doubt, ask both. Whether the agent or the landlord holds a particular document often turns on a management agreement between them that you have never seen. Right to Rent is the clearest example: the Home Office tells landlords they can ask an agent to carry out the check and that the agreement should be in writing, and where the agent has accepted that responsibility in writing the liability moves to the agent. So the copy of your passport is with whichever of them that private agreement says.

Form is not the problem. The ICO is explicit that there are no formal requirements for a valid request, that you can make one verbally or in writing, “to any part of your organisation”, and that you do not have to use the phrase “subject access request” at all. The branch email address you already have is a valid place to send it.

Deposit adjudicators decide on documents. The Tenancy Deposit Scheme tells landlords the adjudicator will usually expect to see the “Tenancy agreement”, “Check-in report and/or inventory”, “Check-out report” and a “Rent statement”, supported by “Estimates”, “Quotes”, “Invoices” and “Receipts”. Shelter puts the consequence plainly: the schemes are likely to reject a landlord or agent’s claim if they do not have a check-out report and an inventory.

So name the documents rather than asking for “everything”. A useful list for a deposit dispute: the inventory and check-in report; the check-out report and the photographs taken with it; any mid-tenancy inspection reports; the quotes, invoices and receipts behind each deduction; the rent statement; the maintenance and repair log; internal notes, emails and call recordings about you and about the property; and the prescribed information if you never received it. mydeposits tells tenants directly to obtain a breakdown of costs from your landlord or agent — a request is how you do that when they will not send it.

Name the dates too. An organisation has to carry out a reasonable and proportionate search — not an exhaustive one. What counts as reasonable depends on the volume of information, the difficulty of locating it, and the size and resources of the organisation. This is a common reason for a partial response, and it is worth being specific about what you want.

Two things people forget. A camera is one: the ICO says that where a camera captures images from a communal area data protection rules apply, and that you can ask the owner for a copy of the footage you are in. Your Right to Rent file is the other — the Home Office code tells landlords to keep copies of your documents for the time you are their tenant and for one year after, so if a former landlord still has a copy of your passport two years on, that is a question worth asking.

Nobody is going to go and look for it. TDS says its process “is not investigative”, that “The adjudicator will not visit the property, there is no hearing”, and — the sentence that matters most — “TDS will not normally seek further evidence, including asking for any evidence which is stated to be available on request”. The DPS says the same thing from the other side: “We don’t routinely request specific items of evidence, so make sure you submit everything relevant to your claim”. Telling an adjudicator that a document exists is not the same as producing it.

But do not upload the whole bundle. The DPS warns that if the volume or type of evidence is particularly large or complex the adjudicator may decide they cannot make a decision at all, and TDS says it may return submissions “where the evidence submitted is excessive”. A response to a request often runs to hundreds of pages. Pull out the documents that answer the deduction and submit those.

Everything you upload, the other side reads. TDS: “It is your responsibility to make sure that you do not send us evidence which you do not want the other parties to the dispute to see”. A response to a request can contain your own sensitive material and other people’s. Check it before it goes in.

What it costs. There is normally no fee. A reasonable fee may only be charged where a request is manifestly unfounded or excessive, or where you ask for further copies. That is separate from the deposit scheme’s dispute service, which all three schemes say is free to use — although the DPS reserves the right to charge a landlord a fee where the tenancy is not an assured shorthold tenancy or an occupation contract.

How long they have. An organisation must respond without undue delay and within one month. It may extend by up to two further months where the request is complex or you have made a number of requests, but it must tell you within the first month that it is doing so, and why. Read that against the scheme deadlines above: the request is the slower of the two clocks in every case.

Proving who you are. An organisation may ask you to verify your identity, but only where it has reasonable doubts about who you are, and it should ask for the minimum needed. Where it needs further information to deal with your request, the one-month clock pauses until you provide it. An agent that has held a copy of your passport for the whole tenancy is not in much doubt about who you are.

Why parts come back blacked out. A tenancy file is full of other people: joint tenants, housemates, neighbours who complained, the contractor who wrote the quote. The ICO’s guidance on information about other people lets a controller withhold what would reveal someone else’s personal data, but not more than that: “you must still provide as much of the requested information as you can, without disclosing the third party’s identity”. A blanket refusal because “the file mentions other people” is not what the guidance says. Legal advice your landlord took is a different matter and can be withheld outright.

If the answer is late or incomplete. Complain to the organisation first. Since 19 June 2026 every organisation has had a legal duty to give you a clear way to raise a data protection complaint, to acknowledge it within 30 days, to look into it properly and to tell you the outcome. If it does not, or the answer is incomplete, you can then complain to the Information Commissioner's Office. A complaint about the deposit decision itself is a different door again, and goes to the scheme.

Where the schemes stand on their own data. They differ more than you would expect. TDS publishes a dated privacy notice, a dedicated data protection mailbox and a postal address for requests, and states the one-month deadline. The DPS publishes a data protection officer contact through Computershare, but its notice carries no date and no retention period. mydeposits publishes no data protection contact of any kind on its privacy policy, its support page or its terms — there is no dedicated address to write to, only its general contact details. Check the scheme’s own site before you send, and do not use a disputes mailbox for a data request.

The deposit deadlines above are the England and Wales schemes. The right of access is the same across the United Kingdom; the deposit rules are not.

In Scotland a deposit must be protected within 30 working days of the tenancy starting — a different clock and a different trigger from the 30 days after receipt that applies in England and Wales — and the schemes are different. In Northern Ireland the deposit must be protected within 28 days and cannot exceed one month’s rent. Take the deadline from your own scheme, not from this page.

One more thing worth knowing before you rely on any of it. Shelter is the best free source there is on deposit disputes and it says you do not need to send the evidence until the scheme asks for it. That is right for two of the three schemes and wrong for the third: mydeposits’ insured scheme asks a tenant to upload the evidence at the point of raising the dispute. Read your own scheme’s page.