Data protection is something every independent inventory clerk, agent and landlord must handle—but too often, it feels wrapped in jargon, fear, and unnecessary paperwork. In our recent AIIC webinar, we were joined by Rob Cole (Senior Engagement and Policy Officer) and Jessy Jarvis from the Information Commissioner’s Office (ICO). Their message was reassuringly clear:
Small businesses must be compliant, but GDPR should be simple, proportionate, and practical—not a mountain of paperwork.
Below, we’ve summarised the most important points that apply directly to inventory clerks and those working in the private rented sector.
1. Understanding Data Roles: Controller, Processor, or Both?
One of the biggest areas of confusion is who is legally responsible for data. Rob Cole broke this down simply:
- Data Controllers decide how and why personal data is used.
This includes sole traders and small businesses—size doesn’t reduce responsibility. - Data Processors act only on the instructions of a controller.
- Joint Controllers share responsibility and must have clear agreements in place.
- Controller–Processor contracts must set out how data is used, secured, retained, and handled during a breach before any work begins.
Jessy added an important clarification, especially relevant to the inventory sector:
Property data alone is not personal data—unless it identifies a living individual.
For example:
A photo of an empty kitchen is not personal data.
A photo including a child’s school certificate is.
This distinction affects how clerks structure reports, manage images, and store data relating to sole-trader landlords, whose business contact details may also qualify as personal data.
2. Privacy, Transparency, and the Core GDPR Principles
Rob reminded us that the seven data protection principles sit at the heart of UK GDPR. The ICO emphasised three above all:
- Lawfulness
- Fairness
- Transparency
For clerks, this means being upfront about:
- what data you collect
- why you collect it
- who receives the report
- how long you keep information
- your legal basis for doing so
Providing a clear Privacy Notice isn’t optional—and the ICO made this easier than ever with their simple generator tool:
👉 ICO Privacy Notice Creator:
https://ico.org.uk/for-organisations/advice-for-small-organisations/privacy-notices-and-cookies/create-your-own-privacy-notice/
Rob also cautioned against defaulting to consent as the lawful basis. For most day-to-day clerk work, contract, legitimate interest, or legal obligation provide a more stable foundation—especially since consent can be withdrawn at any time.
3. Individual Rights and Subject Access Requests (SARs)
Subject Access Requests remain the most common interaction many small businesses have with GDPR.
Key points from Rob:
- Requests can be verbal or written.
- You have one month to respond (extendable to three for complex cases).
- You cannot charge a fee.
- Identity checks should be reasonable, not obstructive.
- Clarify what the requester actually needs—this avoids unnecessary work.
- Data should be provided in a commonly accessible electronic format.
Other rights—erasure, rectification, portability, and objection—may arise less frequently in the inventory world but still require a straightforward response process.
4. Data Breaches: Staying Calm and Acting Quickly
A breach isn’t always a cyber attack. In the inventory sector, simple mistakes like:
- emailing the wrong landlord
- losing a device
- uploading the wrong report
- sending access information to the wrong party
can all qualify.
Rob outlined the required approach:
- Contain the issue (e.g., ask the unintended recipient to delete the file).
- Assess the risk—does it put someone’s rights at risk?
- Report to the ICO within 72 hours if that risk is significant.
- Record everything, even if unreported.
- Review and improve to prevent reoccurrence.
The ICO’s “ripple effect” campaign highlights how even small errors can cause real harm—so proportionate, prompt action matters.
5. Data Retention and Disposal: Keep It Only As Long As Needed
Jessy and Rob were clear:
Don’t keep data forever.
This is especially relevant for inventory clerks, whose photographs and reports can accumulate quickly.
Examples discussed:
- Some records (e.g., payroll) have legally mandated retention periods.
- Others—such as photos and reports—are determined by your business needs, often aligned with the tenancy length and deposit dispute timeframes.
- Tools like Inventory Base can automate deletion schedules to reduce risk.
- Not all data needs shredding—only content that identifies living individuals.
A simple, clear retention policy is enough, provided it is documented and reflected in your Privacy Notice.
6. ICO Registration and Fees
Most inventory clerks process personal data electronically and therefore must pay the ICO data protection fee—typically £52 per year for small operators. Exemptions do exist, and the ICO encouraged members to use their quick online tool:
👉 ICO Fee Self-Assessment:
https://ico.org.uk/for-organisations/data-protection-fee/data-protection-fee-self-assessment/
Remember:
Having CCTV—even in a home office—automatically triggers the fee requirement.
7. Upcoming Legal Changes: What Clerks Should Watch For
Rob highlighted two legislative updates:
- The Data Use and Access Act 2025 – strengthening transparency and expanding obligations in phased rollouts.
- The Renters Rights Act – introducing new expectations for landlords and agents handling tenant information.
The ICO will continue to update its guidance as these changes take effect, and AIIC will ensure members remain informed.
8. The Light-Touch Approach: What Clerks Actually Need
The ICO made it clear that small businesses do not need corporate-level documentation. Instead, they need:
- A simple privacy notice
- A short retention policy
- Clear processor agreements
- Secure storage and sensible operational practices
- Transparency with tenants
- A calm, proportionate breach response plan
And importantly:
You can link to your Privacy Notice and Retention Policy directly in your report disclaimers to streamline compliance.
This aligns perfectly with the realities of inventory work: practical, efficient, and easy to implement.
Final Thoughts
The webinar confirmed what the AIIC has long advocated: compliance doesn’t have to be complicated. With clear processes, proportionate documentation, and the free tools the ICO provides, independent inventory clerks can remain compliant without drowning in paperwork.
Over the coming months, the AIIC will continue to provide templates, short guides, and sector-specific advice to help members stay confident and compliant.
If you missed the webinar, a replay will be made available to members shortly.
Further resources
If you’d like to view the notes from the meeting you can find them here
We have produced a Light Touch data retention policy that you can amend for your own use. Download below
We’ve also produced a simple, step by step guide for smaller businesses that want to stay compliant. Find it below
Links
The ICO have a wealth of resources to help and you can find them here
https://ico.org.uk/for-organisations
Find the fee self-assessment tool here
https://ico.org.uk/for-organisations/data-protection-fee/data-protection-fee-self-assessment
You’ll find the Privacy Policy generator tool here
