For renters

Is it safe to send my bank statements and payslips to a landlord?

Guide · about 26 min read · Covers the law in England as at November 2026 · Reviewed on 2 November 2026

It turns on how they are handled, and that covers the way they reach the recipient as well as what is done with them afterwards. No provision prescribes a bank statement or a payslip the way the Right to Rent rules prescribe immigration documents, and asking for one is not itself prohibited. That is not the same as saying any request is lawful. Article 4(2) of the UK GDPR defines processing as any operation on personal data "such as collection, recording, organisation, structuring, storage" and more, so the duties attach to the collection and not only to what happens after the documents arrive. The UK GDPR applies to whoever is deciding the purposes and means, and that controller is subject to a set of duties: Article 5(1)(c) limits them to personal data that is "adequate, relevant and limited to what is necessary in relation to the purposes for which they are processed", Article 6(1) means they need a lawful basis, and Article 13 means you are to be told the purpose, the recipients and the storage period. Security sits in that set rather than outside it: Article 32(2) requires account to be taken of the risks presented by processing, "in particular from accidental or unlawful destruction, loss, alteration, unauthorised disclosure of, or access to personal data transmitted, stored or otherwise processed". VEYLO X is a software platform for renting and letting in England.

Do I have to send my bank statements and payslips if a landlord asks?

No provision in England prescribes bank statements or payslips as documents a prospective tenant must hand over, and asking for them is not itself prohibited. Neither of those answers the separate question of whether a particular request is lawful, because collection is processing under Article 4(2) and has to meet the same tests as everything that follows it. The decision to send them is yours, and so is the decision to ask what they are for first. Article 6(1) of the UK GDPR makes processing lawful only if and to the extent that at least one of its conditions applies, and the conditions include consent under point (a), processing necessary for the performance of a contract under point (b), processing necessary for compliance with a legal obligation under point (c), and processing necessary for the purposes of the legitimate interests pursued by the controller under point (f).

So there are two separate questions, and they are easy to run together. Whether you send the documents is a decision. Whether the landlord or the agent may lawfully hold and use them is a legal test against the words of Article 6(1) and the principles in Article 5. Which of those conditions a particular landlord or agent relies on, and whether it is made out on the facts of one letting, is something only someone who can read the actual request can say.

What does the law limit a landlord to collecting?

Three of the principles in Article 5(1) of the UK GDPR do most of the work here. Article 5(1)(c), data minimisation, requires personal data to be "adequate, relevant and limited to what is necessary in relation to the purposes for which they are processed". Article 5(1)(b), purpose limitation, requires personal data to be "collected (whether from the data subject or otherwise) for specified, explicit and legitimate purposes and not further processed by or on behalf of a controller in a manner that is incompatible with the purposes for which the controller collected the data". Article 5(1)(f) requires processing "in a manner that ensures appropriate security of the personal data".

Read together, those words mean the test is tied to a stated purpose rather than to habit. A document is not necessary because it is usually asked for. It is necessary, or not, in relation to the purpose the controller has specified. Specifying a purpose is not the same as justifying it, though, and the words carry that. Article 5(1)(b) asks for purposes that are "specified, explicit and legitimate", so legitimate is doing work of its own, and Article 6(1) still has to be satisfied for the processing whatever the purpose is called. A description of why a landlord or an agent wants a document is where the questions start, not where they end. The Information Commissioner's Office publishes guidance on data minimisation. Whether one particular statement, or one particular month of it, is necessary for one particular purpose turns on the purpose and the document, and we are not going to guess at yours. One further Article can be engaged by what a statement happens to show. Article 9(1) of the UK GDPR prohibits the processing of personal data "revealing racial or ethnic origin, political opinions, religious or philosophical beliefs, or trade union membership", together with genetic data, biometric data used to identify a person, "data concerning health" and data concerning sex life or sexual orientation. Transaction lines can carry some of those. Whether they do is a question about what the data actually reveals rather than about who was paid: a payee's name can make a characteristic plain, or can say nothing at all about the account holder, so the name on its own does not settle it. Article 9(2) lifts the prohibition only where the processing is based on Article 6(1) and one of its own conditions applies as well, so a lawful basis under Article 6 is not by itself an answer where Article 9 is engaged. Whether a particular statement engages it, and which condition in Article 9(2) any particular landlord or agent could rely on, is not a question this guide answers. What it does do is sharpen the Article 5(1)(c) question: the more a document carries that has nothing to do with the stated purpose, the more there is to ask about sending it whole, and that holds for an unredacted statement even where the income it evidences is wanted for a purpose nobody disputes.

How do I find out what my documents are going to be used for?

You ask, and Article 13 of the UK GDPR puts that information on the controller rather than leaving you to extract it. The deadline it sets is "at the time when personal data are obtained", so it is tied to the collection and not to the first email about it, and a request that arrives with no privacy information attached is early rather than late, and whether it is anything more than that turns on facts this guide cannot see. The deadline attaches to the collection being asked for, and Article 13(4) provides that paragraphs 1, 2 and 3 "do not apply to the extent that the data subject already has the information", so a landlord or an agent that has already given you its privacy information is in a different position again, as is one already processing information about you. This guide reaches no conclusion about a request it has not seen. Where personal data are collected from the data subject, Article 13 requires the controller to provide the identity and the contact details of the controller, the purposes of the processing and the legal basis for it, the recipients or categories of recipient of the personal data, the period for which the personal data will be stored or, where that is not possible, the criteria used to determine that period, and the existence of the rights to request access to and rectification or erasure of the personal data. One further item on the Article 13(2) list goes straight to the question this guide is about: Article 13(2)(e) requires the controller to provide "whether the provision of personal data is a statutory or contractual requirement, or a requirement necessary to enter into a contract, as well as whether the data subject is obliged to provide the personal data and of the possible consequences of failure to provide such data". That is the sentence that separates being legally compelled from being asked on terms.

Two items on that list are the useful ones to read closely. The recipients item tells you who else is in line to see the documents, which can include a referencing company instructed by the landlord or by the agent. Read it for what it is: Article 13(1)(e) asks for "the recipients or categories of recipient", so a lawful answer can be a category rather than a list of names, and it is not a guarantee of seeing every person with access. The storage period tells you how long they expect to keep them. If a request for documents arrives with none of this attached, asking for it is not an awkward question. It is asking for information Article 13 requires to be provided at the time the data are obtained, which is the moment you would be sending them. One limit on Article 13 is worth knowing, because that list is not the only one. Article 13 applies where personal data are collected from the data subject. Article 14 covers the other case, where the personal data have not been obtained from the data subject, and requires its own list, including the categories of personal data concerned, the recipients, the storage period and, under Article 14(2)(f), "from which source the personal data originate". So where information about you moves between a landlord, an agent and a referencing company, which of the two Articles applies depends on who obtained what from whom. Whether a particular agent or referencing company is a controller in its own right or a processor acting on someone else's instructions turns on the actual arrangement, and this guide does not decide it. Our guide on what landlords can and cannot ask for when you rent covers the wider list of requests.

Can I black out parts of a bank statement before I send it?

You can, and what you are doing is deciding what to disclose rather than exercising a right to have the result accepted. Article 5(1)(c) of the UK GDPR limits a controller to personal data that is "adequate, relevant and limited to what is necessary in relation to the purposes for which they are processed", and that obligation sits on whoever is the controller, which Article 4(7) ties to deciding the purposes and means rather than to holding the file, and not on the person sending them. What it gives you is a question worth asking rather than a right to have a redacted document accepted: if the stated purpose is to see income rather than spending, the parts that show neither are the parts to think about. Blacking out a line is not a legal right to withhold it, a redaction can leave a document no longer adequate for the purpose that was stated, and a landlord or an agent can ask again for an unredacted document.

What that leaves is a conversation about purpose rather than a standoff. A reader who wants to narrow what is sent can ask what the document is being used for, which Article 13 says should be stated anyway, and then send what answers that purpose. Whether a particular redaction leaves the document adequate and relevant for a particular stated purpose is a judgement on the facts, and it is one for an adviser who can see both the request and the document.

Is this part of a Right to Rent check?

No. Right to Rent is a separate duty with its own documents. Section 22 of the Immigration Act 2014 provides that a landlord must not authorise an adult to occupy premises under a residential tenancy agreement if the adult is disqualified as a result of their immigration status, and article 3 of S.I. 2014/2874 prescribes the requirements for the check, with article 4 setting which documents must be obtained and article 5 dealing with checking and copying them. That check is a check of documents, or an online check using a share code, that go to immigration status. In England the prohibition in section 22 is on the landlord, and the penalty for contravening it can sit elsewhere: under section 25(2) of the same Act an agent is responsible for a landlord's contravention if, and only if, the agent acts in the course of a business and, under arrangements made with the landlord in writing, was under an obligation to comply with the prescribed requirements on the landlord's behalf. Where that is so, section 24(2)(b) excuses the landlord from the penalty for a pre-grant contravention, and section 24(5) qualifies that one: the subsection (2) excuses are not available if the landlord knew that entering into the agreement would contravene section 22. Section 24(6)(b) is the separate excuse for a post-grant contravention, and section 24(5) is not written to reach it. Either way section 25(3) allows a notice requiring the agent to pay instead. VEYLO X does not carry the check out and does not decide its outcome.

The lists of acceptable documents are set by law, in the Schedule to that Order, which article 4 applies, and they are reproduced in the Home Office's code of practice for landlords and their agents, and the online route is described at Prove your right to rent in England on GOV.UK. A payslip and a bank statement are documents about money, not about immigration status. So a request for them is a separate request, made for a separate purpose, and the purpose has to be stated separately. Our guides on how Right to Rent works for tenants and on sending a copy of your passport cover that check on its own terms.

Can I be charged for a referencing check?

No. Section 1 of the Tenant Fees Act 2019 prohibits a landlord from requiring a relevant person to make a prohibited payment in connection with a tenancy of housing in England, section 2 imposes the equivalent prohibitions on a letting agent, and section 3 provides that a payment is a prohibited payment unless it is a permitted payment by virtue of Schedule 1. A charge for referencing is not among the permitted payments in that Schedule.

Section 1 reaches a payment required to be made to a third party as well, so the cost does not become yours because an outside company does the work. Section 12 makes it an offence to breach the same section again within five years of a final financial penalty for a different breach of it. If a fee has been asked for, an advice service is the place to take it, and our guide on being charged for referencing sets out the position in full.

Can a landlord ask for money before I sign anything?

Being asked for documents and being asked for money are two different events, and the money rule is the stricter of the two. Section 9 of the Renters' Rights Act 2025 inserted section 5A into the Tenant Fees Act 2019, which deals with prohibitions relating to pre-tenancy payments of rent. GOV.UK sets out the effect for tenants at rent in advance and deposits: a landlord or letting agent must not accept, ask for or encourage a payment of rent before the tenancy agreement is signed, and in the period after it is signed and before the tenancy starts the amount that can usually be asked for in advance is capped, with stated exceptions. Two things narrow that, and both are easy to read past. The prohibition is on a payment of rent, and it is tied to one kind of tenancy: paragraph 1(1A) of Schedule 1 to the Tenant Fees Act 2019 makes a payment of rent a prohibited payment where it is payable before the tenancy is entered into and the tenancy is an assured tenancy, and section 5A is framed throughout around "an assured tenancy of housing in England". It is also not a prohibition on every payment asked for before signing. Paragraph 2 of that Schedule makes a tenancy deposit a permitted payment, with the excess prohibited above five weeks' rent where the annual rent is less than £50,000 and above six weeks' rent where it is £50,000 or more, and paragraph 3 makes a holding deposit a permitted payment, capped at one week's rent. Paragraph 3(2) defines it as money paid before the grant of a tenancy "with the intention that it should be dealt with by the landlord or letting agent in accordance with Schedule 2", and paragraph 3(5) takes it outside the permitted payments where an earlier holding deposit for the same housing has not been repaid and none of paragraphs 6 to 12 of that Schedule applies. So the timing is not the whole definition.

That matters at the same moment as the document request, because both tend to arrive together. A request for a statement is not a request for money, and agreeing to one is not agreeing to the other. Nor are advance rent and a deposit the same question: which of the two a particular request is, and whether the tenancy in question is an assured tenancy, decides which rule applies, and neither is something this guide can tell you. Our guide on paying rent in advance before you move in covers the cap and the timing.

What are the rules on refusing someone because of children or benefits?

There are two bodies of law here, and both are about how people behave, not about predicting what anyone will decide. Section 33 of the Equality Act 2010 deals with discrimination, harassment and victimisation in the disposal of premises, which includes the terms on which premises are offered, a refusal to dispose of them, and the treatment of a person with respect to things done in relation to persons seeking premises. The Renters' Rights Act 2025 adds a second set, in force on 1 May 2026. Section 33(1) provides that a relevant person must not, in relation to a dwelling that is to be let on an agreement which may give rise to a relevant tenancy, prevent a person from enquiring whether the dwelling is available for let, accessing information about it, viewing it or entering into a tenancy of it, on the basis that a child would or may live with or visit that person there, or apply a provision, criterion or practice in order to make people who would have a child live with or visit them there "less likely to enter into a tenancy of the dwelling than people who would not". The comparison is part of the test, not decoration. Section 34(1) does the same on the basis that a person is or may be a benefits claimant. Both carry exceptions on their face: section 33(2) covers conduct that is a proportionate means of achieving a legitimate aim and conduct that prevents a breach of an insurance term of the kind described there, section 34(2) covers the insurance case, and section 33(3) and section 34(3) take out conduct consisting only of publishing advertisements or disseminating information or providing a means of direct communication between a prospective landlord and a prospective tenant. GOV.UK publishes Rental discrimination: a guide for tenants.

What those provisions do not do is tell anybody what any particular decision was based on. Whether a particular refusal falls inside either body of law turns on the facts, the evidence and the reasons, and this guide does not answer it. An adviser, or one of the free services named at the foot of this page, is the place to take a specific set of facts.

How long can a landlord or agent keep my payslips and statements?

No provision sets a number of months. Article 5(1)(e) of the UK GDPR requires personal data to be "kept in a form which permits identification of data subjects for no longer than is necessary for the purposes for which the personal data are processed", so the period is tied to the purpose rather than to a calendar. Article 13 requires the controller to provide the period for which the personal data will be stored or, where that is not possible, the criteria used to determine that period, which means the answer for a particular letting should be something you were told at the start.

Two things follow for a reader who has already sent documents. The first is that the stated purpose is the thing to look at, because a purpose that has ended is the start of the argument that the data is no longer necessary for it. The second is that a controller can have more than one purpose, including one it is under a legal obligation to serve. Which purposes a particular landlord or agent has, and how long each needs the documents for, is not something this guide can tell you.

How do I ask what a landlord or agent still holds about me?

You make a subject access request. Article 15(1) of the UK GDPR gives a data subject the right to obtain from the controller confirmation as to whether or not personal data concerning him or her are being processed and, where that is the case, access to the personal data and to the information listed in that paragraph, which includes the purposes of the processing, the categories of personal data concerned, the recipients, and the envisaged storage period. There is no form to use, and Article 12(5) requires the information to be provided free of charge, subject to Article 15(3), which allows a reasonable fee based on administrative costs for further copies, and subject to the controller's power to charge a reasonable fee or refuse to act where it can show a request is manifestly unfounded or excessive. The Information Commissioner's Office explains the right on its website.

On timing, read the words rather than a figure. Article 12(3) requires the controller to provide information on action taken on a request made under or by virtue of Articles 15 to 22D "without undue delay and in any event before the end of the applicable time period", and Article 12A sets that period. Article 12A(1) makes it one month beginning with the relevant time, and Article 12A(2) makes the relevant time the latest of three events: the controller receiving the request, the controller receiving any information it asked for under Article 12(6), and the payment of any fee charged under Article 12(5). Article 12A(3) lets the controller extend it by two further months by giving notice, where that is necessary by reason of the complexity of the requests or their number, and Article 12A(4) requires that notice to be given before the end of the first month and to state the reasons for the delay. Article 12A(5) stops the clock where the controller reasonably requires further information in order to identify what an Article 15 request relates to. So one month is the starting point rather than the whole answer, and which date a particular request runs from is something only someone who can see the correspondence can work out. Article 12(4) requires a controller that does not act on a request to give the reasons, and to say what can be done about that, including making a complaint to the controller itself under section 164A of the Data Protection Act 2018, which section 164A(3) requires the controller to acknowledge within 30 days beginning when it is received, making a complaint to the Information Commission under section 165 of that Act, and seeking a judicial remedy.

What do I do next?

Six steps, and the first one is the one to take if any of the open questions above touch your situation. VEYLO X is a software platform for renting and letting in England.

Take advice before sending anything you are uneasy about, and in particular if you think a request goes beyond the stated purpose. Citizens Advice and Shelter both give free advice, and an adviser who can read the actual request is the person to ask.
Ask for the Article 13 information if it did not arrive with the request: who the controller is, the purposes and the legal basis, the recipients, and the storage period or the criteria for it. Article 13 of the UK GDPR requires those to be provided where personal data are collected from you.
Keep your own dated record of what you sent, to whom and on what date, so that a later question about a document has an answer that does not depend on memory.
Ask which condition in Article 6(1) of the UK GDPR the landlord or the agent relies on, since processing is lawful only if and to the extent that at least one of them applies.
Make a subject access request under Article 15(1) of the UK GDPR if you want to see what is held, read the reply against the purposes you were given at the start, and note that Article 12A puts the ordinary period at one month from the relevant time, extendable by two further months by notice.
Treat a request for money separately from a request for documents, and separate advance rent from a deposit. Section 5A of the Tenant Fees Act 2019, inserted by section 9 of the Renters' Rights Act 2025, deals with pre-tenancy payments of rent in connection with an assured tenancy of housing in England, while paragraph 2 and paragraph 3 of Schedule 1 to that Act make a tenancy deposit and a holding deposit permitted payments subject to their own caps, and a charge for referencing is not a permitted payment at all.

Three questions are left open here, and each of them decides a real case. Is a particular request limited to what is necessary in relation to the purpose that was specified? Which condition in Article 6(1) applies to it? And how long is "no longer than is necessary" for the purposes a particular landlord or agent actually has? None of the three has a general answer, which is why this guide does not give one. An adviser who can see the request, the reply and the paperwork is the person to put all three to.

Common questions

What if the agent will not go ahead unless I send everything?

An agent can decide what it asks for before it puts anything to a landlord, and you can decide what you are willing to send, so the two sit against each other rather than one overriding the other. What an agent asks for is not unrestricted, because a commercial preference is not a lawful basis. Asking and collecting are not the same event, though: a request is made before anything reaches the agent, and what has to answer Article 6(1) and the principles in Article 5(1) is the collecting and the holding of whatever comes back. So three things are worth keeping apart: asking, collecting, and processing what was collected. The UK GDPR tests the second and the third, and it tests them against a justification that has to exist before the data is obtained rather than afterwards, which is why a wide request is the moment to ask what the stated purpose is rather than something to wave through. A request made with no explanation of why any of it is needed is separately a question under the Digital Markets, Competition and Consumers Act 2024, which replaced the 2008 Regulations: section 225 prohibits unfair commercial practices and section 227 makes a practice a misleading omission where it omits material information, meaning "information that the average consumer needs to take an informed transactional decision". Both have been in force since 6 April 2025. This guide applies neither body of law to a request it has not seen, and says nothing about what any particular request shows. The question the data protection side raises is whether what it would collect could be justified against the purpose that was stated. Article 5(1)(c) of the UK GDPR limits personal data to what is "adequate, relevant and limited to what is necessary in relation to the purposes for which they are processed", and Article 5(1)(b) ties the collection, whether from you or otherwise, to purposes that are specified, explicit and legitimate. The practical move is to ask for the purpose in writing, which Article 13 requires to be provided anyway, and then to look at the request against it. Whether a particular request is wider than its stated purpose allows is a judgement on the facts, and this guide does not make it. An adviser who can see the request and the agent's privacy information is the person to ask.

Should I send documents by email, or is there a safer way?

Three things are worth doing whichever route is used. Make sure the recipient is the person or the firm you take them to be before anything goes out. Keep your own copy of what you sent and the date. Keep the privacy information you were given with it, because a later question about who held what is answered by that record rather than by recollection. None of the three makes a route safe, and the rest of this answer is why nobody can tell you that any route is. What you send is your choice, and the route often is not: a landlord or an agent can say how it wants documents sent, and you can decline that route or ask for another one without being able to require it. What the route is not is outside the security duty. Article 5(1)(f) of the UK GDPR requires personal data to be processed "in a manner that ensures appropriate security of the personal data", and Article 32(2) requires account to be taken of the risks presented by processing, "in particular from accidental or unlawful destruction, loss, alteration, unauthorised disclosure of, or access to personal data transmitted, stored or otherwise processed". That word transmitted settles whether the sending counts. It does. Article 32(1) then sets the level of security by reference to the state of the art, the costs of implementation, the nature, scope, context and purposes of the processing and the risk, and names pseudonymisation and encryption among the measures. What follows from that is that a route has to be assessed rather than assumed. It does not follow that an upload area is more secure than an email attachment: different arrangements do offer different protection, and which of them does turns on how the one in front of you is built and run rather than on which kind it is. Nothing in the UK GDPR names a single method as the compliant one, and nothing here says any method is safe. Those duties bind the controller and the processor rather than you, which is why this guide neither recommends a method nor tells you one is safe.

Can I ask a landlord to delete my documents after the home is let to someone else?

You can ask, and the request has a named right behind it rather than only a principle. Article 17(1) of the UK GDPR gives a data subject the right to obtain erasure without undue delay, and puts the controller under an obligation to erase without undue delay, where one of its grounds applies; the first ground, Article 17(1)(a), is that "the personal data are no longer necessary in relation to the purposes for which they were collected or otherwise processed". That reads across to Article 5(1)(e), which requires personal data to be kept in a form which permits identification "for no longer than is necessary for the purposes for which the personal data are processed". It is not an absolute right: Article 17(3) disapplies paragraphs 1 and 2 to the extent that processing is necessary, among other things, for compliance with a legal obligation under domestic law or for the establishment, exercise or defence of legal claims. What a controller cannot do is treat the request as a matter of preference, because where a ground is made out and no exception applies the obligation to erase is the controller's. Whether a particular purpose has ended, and whether any of the Article 17(3) exceptions covers what is left, is not a question this guide answers, and Article 13 means the storage period you were given at the start is where to look first.

Does any of this change if a letting agent is doing the asking rather than the landlord?

The principles apply to whoever is processing the data, so the answer does not turn on which of the two sent the email. An agent may be acting as a processor on the landlord's instructions, or as a controller in its own right, and Article 13 of the UK GDPR requires the identity and the contact details of the controller to be provided where personal data are collected from the data subject, which is where to start looking. It is a start and not an answer: the disclosure names a controller for that collection, and it does not settle whether the same business is also a controller in its own right for other purposes, or a processor for particular operations, which Article 4(7) and (8) tie to what is actually being decided. The data minimisation, purpose limitation, storage limitation and security principles in Article 5(1) bind the controller whichever name is on the request. One point sits outside the data protection questions and is worth keeping separate from them. The prohibition in section 22 of the Immigration Act 2014 is on the landlord, while section 25(2) of that Act lets arrangements made in writing put the obligation to comply with the prescribed requirements on an agent acting in the course of a business, and three separate questions follow rather than one: whether the agent is responsible for the contravention under section 25(2), whether the landlord's excuse under section 24(2)(b) is available, which section 24(5) withdraws where the landlord knew, and whether the Secretary of State gives the agent a notice under section 25(3). Nothing transfers automatically. Which role a particular agent occupies for a particular letting is a question of fact that this guide does not answer.

Sources

The primary sources behind this guide. Where the law and a summary disagree, the law is what counts.

This article is general information, not legal advice. It covers England only and reflects the position as at November 2026. For your own situation, take advice, and consider free advice from Citizens Advice or Shelter.

Get started