Library · Act of Parliament
Data Protection Act 2018 and UK GDPR
The rules for handling leaseholders' and residents' personal data: lawful basis, transparency, security, retention and data subject rights.
What it does
The UK GDPR and the Data Protection Act 2018 apply to any organisation handling personal data, including a block management company holding names, contact details, payment records and correspondence.
What a block company needs
- A lawful basis for each use of data. Running the lease and the company is usually “contract” or “legitimate interests”; some duties are “legal obligation”.
- A privacy notice telling leaseholders and residents what you hold and why.
- Security: keep records in a secure system, not personal inboxes, and limit access to those who need it.
- Retention: keep records only as long as needed (financial records are usually kept at least six years).
- Rights: respond to subject access requests within one month.
- ICO fee: many small organisations must pay the data protection fee to the Information Commissioner’s Office unless exempt. Check the ICO’s self-assessment.
Status
In force across the UK, as amended by the Data (Use and Access) Act 2025.
Read the official text at legislation.gov.uk
Crown copyright, reused under the Open Government Licence v3.0. Summary by Freeholdpilot, checked 1 November 2026. This is legal information about the law in UK-wide, not legal advice for your building. For advice, speak to a solicitor.