Home › Landlord guides › Applicant data for letting agents

For letting agents

How long can a letting agent keep an applicant's details?

You took forty enquiries on a flat and let it to one person. What are you allowed to do with the other thirty-nine? This is the part no property CRM explains — and the answer is more generous than most agents assume.

Written for UK letting agents · Last updated September 2026 · 7 min read

The quick answer: Replying to someone about their own enquiry is not marketing at all, and you can do it freely. Offering them a different property is direct marketing and needs the soft opt-in. There is no legal time limit on how long you keep them — the law asks you to set a period and be able to justify it, not to pick a number from a rulebook.

Two things that look the same and are not

Almost every worry an agent has about applicant data comes from treating one activity as though it were the other.

Chasing their own enquiry. Someone asked you about a flat. Ringing, emailing or messaging that person about that flat is solicited correspondence. It is not direct marketing, and the PECR marketing rules simply do not apply to it. This is the job.

Offering them a different property. The moment you push a good applicant towards something they did not ask about, it becomes direct marketing — and that is where the rules start.

The soft opt-in, in plain words

The soft opt-in is the exception that lets you market to someone without collecting a formal consent, and it is the one most letting agents are relying on without knowing its name. The ICO sets out five conditions, and you need all five:

You obtained the contact details yourself.
You did so while selling or negotiating to sell a product or service.
You are marketing only your similar products or services.
You gave them a chance to opt out when you collected the details.
You give them a chance to opt out in every message since.

🔎 The good news most agents miss

Condition two sounds like it needs a completed deal. It does not. The ICO is explicit: “A person doesn't need to actually buy anything from you. It's enough if ‘negotiations for the sale' took place.”

So the applicant who viewed in March, loved it, and lost out to someone else is not out of reach. An enquiry that went nowhere still counts as negotiations. That single sentence is the difference between a dead list and a working one.

And the condition that catches people out is number four. The opt-out has to be offered at the point you collect the details — which, for an enquiry that arrives from a portal, is on the portal's own form, before it reaches any system of yours. No CRM can do that one on your behalf. It is worth checking what your portal enquiry form actually says, because that is where this condition is either met or missed.

So how long can you keep them?

This is the question everyone wants a number for, and the law deliberately refuses to give one. The ICO's storage limitation guidance says it plainly:

“The UK GDPR does not set specific time limits for different types of data. This is up to you.”

What it does say is that you should not keep data indefinitely “just in case”, or where there is only a small chance you will use it. So the thing you actually need is not a period. It is a reason for the period.

A reason that holds up

Here is one that works for lettings, and it is the reasoning behind ProPixa's own default of twelve months from last contact: a UK tenancy cycle is twelve months. Somebody who missed a flat in March is plausibly looking again next March, when their own tenancy ends. That is a specific, honest, industry-grounded justification — which is exactly what the ICO is asking for, and considerably better than “we keep everything”.

Twelve months is our default, not a legal requirement. Yours might be six, or twenty-four. What matters is that you chose it for a reason you could explain.

Anonymise rather than delete

Most agents assume the end of a retention period means deletion, and quietly resist it — because deleting five years of enquiries means losing five years of knowing what your market asked for.

You do not have to make that trade. Truly anonymised data falls outside the storage limitation principle altogether. Strip the name, the phone number, the email and the notes; keep the property, the date, the source and the outcome. Your enquiry statistics survive indefinitely and lawfully, and the only thing you lose is the part you should not have been holding.

One caution: anonymised is a high bar. Pseudonymising — swapping a name for a code you could reverse — does not take data out of scope, because it still permits identification.

Who is actually responsible

Your agency is the data controller. Your CRM or property software is a processor, acting on your instructions.

That matters more than it sounds. It means the retention period and the lawful basis are your decisions, not your supplier's — and a supplier who tells you their software “makes you GDPR compliant” is describing something that is not in their gift. What good software can do is make a defensible decision easy to apply and a careless one hard.

A short checklist

Can you say, in one sentence, why you keep applicants for the period you keep them?
Does your portal enquiry form offer an opt-out at the point of collection?
Does every marketing message you send carry an opt-out?
When someone says stop, is that recorded somewhere the whole team sees — or in one negotiator's head?
Do you have a way to anonymise old enquiries rather than choosing between keeping them all and losing them all?

Built for the agent, not the landlord

ProPixa tracks applicants and enquiries the way a negotiator actually works — every call, email and WhatsApp chase logged, returning enquirers flagged before you pick up the phone, and a place to record a “stop” that the whole team can see.

See it for letting agents →

Frequently asked questions

Is chasing an applicant direct marketing?

Not when you are replying to them about the enquiry they made themselves. That is solicited correspondence and the PECR marketing rules do not apply to it. Offering that same person a different property is direct marketing, and that does need the soft opt-in conditions to be met.

How long can a letting agent keep an unsuccessful applicant's details?

There is no legal number. The ICO says the UK GDPR does not set specific time limits and that the period is yours to set — but it also says you should not keep data indefinitely just in case. What you need is a documented reason for the period you choose, applied consistently.

Can I put an old applicant back on my list when a new property comes up?

Yes, if the soft opt-in conditions are met — you took their details yourself while negotiating, you are offering a similar service, they were given a chance to opt out when you collected the details, and every message since has carried an opt-out.

Does an enquiry that went nowhere still count as 'negotiations'?

Yes. The ICO is explicit that a person does not need to have bought anything from you — it is enough that negotiations for a sale took place. An applicant who viewed a flat and did not take it still counts.

Who is responsible, the agency or the software?

The agency is the data controller. Your CRM is a processor acting on your instructions, so the retention period and the lawful basis are your decisions, not your supplier's.

Should I delete old applicants or anonymise them?

Anonymising keeps the business value and removes the risk. Strip the name, phone, email and notes, and keep the property, the date, the source and the outcome. Truly anonymised data is outside the storage limitation principle, so your enquiry statistics survive while the personal data does not.