Estate and letting agents: the four exposures behind every tenant file
An agency keeps, in one place, the documents a fraudster wants most: the IDs, payslips, tax notices and bank details of tenants, guarantors, buyers and landlords. Deposits, first rents and service charges arrive at moments anyone can predict, and the website runs valuation forms and upload portals. All four exposures meet in one small business.
tenants and landlords whose passport copies, bank statements and salary details a London estate agency left exposed for almost two years; the ICO, the UK's data protection regulator, fined it £80,000 in 2019.
Wired-Gov, 19 Jul 2019accounts or so on a property listings site had their passwords stored as plain, readable text; the CNIL fined its publisher €100,000 in January 2024.
CNIL, 31 Jan 2024is the CNIL's reference for keeping unsuccessful candidates' solvency documents (proof of income and ability to pay) in an agency's active database, the files in day-to-day use.
CNIL, 6 May 2021What each one looks like in your business
Email in your name
A new tenant has just signed. A few minutes before your email asking for the deposit and first month's rent, another arrives from your exact address with "updated bank details". The tenant pays the fraudster. Without the right email settings on your domain (an enforced DMARC policy, which tells mail servers to put fakes in spam or refuse them), nothing stops that email from being delivered.
- The amounts are large and the timing is known: in England and Wales the initial requirements of a deposit scheme must be met within 30 days of receiving the deposit (Housing Act 2004, checked 8 Nov 2026). Service charge demands and a syndic's calls for funds (the payment requests a French building manager sends to flat owners) follow the same calendar.
- In a general commercial case, not a property one, the Dutch Supreme Court upheld a ruling that a payment on a forged invoice counted as payment, because the forged email came from the genuine address of the seller's group. The seller carried the loss (Hoge Raad, 28 May 2021).
- DMARC stops forgery of your exact domain. It does not stop lookalike domains (an address one letter off yours) or a mailbox taken over, so add two-step login (a code from your phone as well as the password) and a rule that bank details never change by email.
Tracking before consent
A homeowner fills in your free valuation form: address, phone number, a plan to sell. A Meta or Google Ads tag (a small piece of code from the ad platform) on the page reports the visit and the form to the ad platform before the visitor has answered the cookie banner.
- A valuation or application page says more than a shop page: where someone lives, that they plan to sell or move, sometimes their income.
- The CNIL's own security checklist for rental management lists asking visitors' consent for cookies the site does not strictly need as a website measure (CNIL, 6 May 2021).
- In June 2024 the CNIL fined a company it describes as specialised in property management €12,000 under its simplified procedure (a fast-track fine for smaller cases), for cookie consent and information (CNIL, checked 8 Nov 2026).
Customers with disabilities
A candidate tenant who uses a screen reader (software that reads the screen aloud) reaches your application form. The upload buttons have no labels and the CAPTCHA (the "prove you are not a robot" test) has no alternative, so the application never arrives. Your property search works only by dragging a map.
- Estate agency is not on the list of services in the European Accessibility Act, the EU law that since 28 June 2025 requires many online services to work for people with disabilities. The Act reaches an agency only where its site or app is an e-commerce service, one through which a consumer concludes a contract (EUR-Lex, 17 Apr 2019).
- Microenterprises are exempt: fewer than 10 staff and no more than €2 million in turnover or balance sheet total. Many independent agencies qualify (EUR-Lex, 17 Apr 2019).
- In the UK the Equality Act 2010 applies to every agency, whatever its size: a service provider must make reasonable adjustments, reasonable changes so that disabled people are not put at a disadvantage (Equality Act 2010, checked 8 Nov 2026).
Payment and site security
Your application portal stores each uploaded document at an address that ends in a number. Change the number and another applicant's passport and payslips appear, with no password asked.
- The ICO fined a London estate agency £80,000 after passport copies and bank statements of 18,610 tenants and landlords sat on a server anyone could open without a login (open to anonymous access) from March 2015 to February 2017. It said customers were left exposed to the potential risk of identity fraud (Wired-Gov, 19 Jul 2019).
- A Scottish housing association's new customer portal showed residents other residents' names, addresses, dates of birth and antisocial behaviour files for five days. The ICO reprimanded it: the portal had not been tested properly before launch (Public Technology, 25 Apr 2024).
- The CNIL fined a property listings publisher €100,000, in part because passwords could be one character long and were stored in clear text, for about five million accounts (CNIL, 31 Jan 2024).
Does the European Accessibility Act apply to you?
Only if consumers can conclude a contract through your site or app, for example book and pay or sign online, and you are not a microenterprise. A site that only shows listings is likely outside.
Estate agency, letting and property management are not services the Act names in their own right. It reaches an agency only where its website or app is an e-commerce service: provided at a distance, at a consumer's request, with a view to concluding a consumer contract. A private landlord or seller counts as a consumer. Microenterprises providing services are exempt: fewer than 10 staff and no more than €2 million in annual turnover or balance sheet total. Online maps are excluded if the essential information is also given in an accessible way, and service contracts agreed before 28 June 2025 may continue unchanged until they expire, for five years at most (EUR-Lex, 17 Apr 2019). An agency in scope must publish how its service meets the requirements; the Dutch regulator says that statement must be easy to find and accessible (ACM, checked 8 Nov 2026). Online applications that end in an e-signature sent by email, and owner portals where rent or charges are paid, are a grey zone.
Likely in scope
- A site or app where consumers book and pay for a holiday let, for an agency with 10 or more staff or more than €2 million in turnover and balance sheet total.
- A paid service taken out online, such as a tenant-file or valuation service, for an agency of the same size.
- A lease, management mandate or sales mandate signed through the site, for an agency of the same size.
Likely outside it
- A listing site where visitors only browse, ask for a viewing or send an enquiry, with the contract signed later.
- A microenterprise: fewer than 10 staff and no more than €2 million in turnover or balance sheet total.
- A map search, if the same listings can be found without the map.
In the UK the Act does not apply to UK agencies serving UK customers, but the Equality Act 2010 does: a service provider must not discriminate and must make reasonable adjustments, whatever its size (Equality Act 2010, checked 8 Nov 2026). An agency taking bookings from EU consumers, for holiday lets in France for example, should check the Act for those sales.
Our reading of the directive and the regulators' guidance, not legal advice. If your case sits close to the line, ask a lawyer.
Checks you can do in a minute
Can someone send email as you?
Run the free email check on your agency's domain. No DMARC record, or p=none (watch only), means anyone can send email from your exact address. The safe settings are p=quarantine (fakes go to spam) or p=reject (fakes are refused).
Do your payment emails warn tenants?
Open the template you send for the deposit and first rent, or for service charges. Does it say plainly that you never change bank details by email, and to call the number in the lease before paying? Is two-step login on for every mailbox that sends it?
Can a stranger open an applicant's file?
Use only a test application you created yourself. Copy the link to one of its uploaded documents, log out, and open the link in a private window. If it opens without a login, anyone with the link can see it. Never change numbers in the address to look at other people's files; call your web provider instead.
How old is your oldest unsuccessful applicant's file?
Look in the shared mailbox, the CRM (your client database) and the downloads folder. In France the CNIL's reference is three months in the active database (CNIL, 6 May 2021).
Does tracking start on your valuation form before the visitor agrees?
Open your free valuation page in a private window and leave the banner alone. Is Refuse as visible as Accept? In the browser's developer tools, the Network tab shows whether Meta, Google Ads or analytics load before you choose.
The padlock and security settings, portal included
Type http:// and your domain: it should move to https:// (the padlock, an encrypted connection) with no warning. A free header checker shows which security headers your site sends, the settings that tell browsers how to protect your visitors. Check the tenant or owner portal too, not only the brochure site.
Can you search and apply with the keyboard alone?
Put the mouse away. With Tab, Shift+Tab and Enter, search, open a listing, fill in the application or contact form and send it. Can you find listings without the map?
Is the page the law asks for on your site?
UK letting agents holding client money: is your protection certificate on the website (Client Money Protection Schemes for Property Agents Regulations 2019, checked 8 Nov 2026)? Netherlands: are your selection criteria and your written anti-discrimination approach published (Tweede Kamer, 6 Feb 2024)? French syndics: do service charge letters print the portal password where anyone can read it? The CNIL says they should not (CNIL, 6 May 2021).
What owners in this sector tell themselves
Email and Cookie Fix
Email Fix and Cookie Fix together: your email protected, and no tracking before visitors say yes. For businesses the accessibility law does not cover.
Keep it fixed: from €39 a month
Confirm it with a real scan
We read only what any visitor can see, and your domain's public settings: no login, no testing of your systems. You get a private report by email with screenshots, a score for each of the four exposures, and fixed prices.
The detail, for those who want it
One number in a web address
SERGIC, a French property management company, held candidate tenants' documents online: ID cards, tax notices, bank details, even divorce judgments. Changing a number in a document's web address opened another candidate's file, with no login. The flaw was known from March 2018 and fixed on 17 September 2018; during its check the CNIL, France's data protection regulator, downloaded 9,446 documents with a small program, from a folder of 290,870 files (CNIL, 28 May 2019). The CNIL fined the company €400,000, and in November 2020 France's highest administrative court, the Conseil d'État, upheld the fine, saying simple measures such as user authentication (a login for each user) would have prevented the flaw (Conseil d'État, 4 Nov 2020).
Nobody needed a password, and a login on each file would have kept them shut.
What applies, market by market
What you may ask a candidate tenant
Only the documents on the official list set by decree (décret n° 2015-1437). The CNIL names forbidden ones, among them bank account statements, the carte Vitale (the French health insurance card) and a divorce judgment, and says a visit should not depend on handing over documents. Asking for a forbidden document can cost a company up to €15,000 (CNIL, 10 Oct 2025).
How long to keep tenant files
The CNIL's reference for rental management: candidates' solvency documents in principle three months in the active database, prospect data three years from last contact, and longer only for a legal obligation or a real litigation need (CNIL, 6 May 2021).
Security and cookies
The same reference expects a separate login for each user, an encrypted connection (TLS), no identifiers such as file numbers in web addresses, a secure upload form (HTTPS, the padlock) for candidates' files, no passwords printed on service charge letters, and consent for cookies that are not strictly necessary (CNIL, 6 May 2021).
Syndics' owner portals
Under article 18 of the law of 10 July 1965, a professional syndic must offer owners secure online access to the building's documents, unless the owners' general assembly decides otherwise (Loi n° 65-557 du 10 juillet 1965, checked 8 Nov 2026).
Decisions and rulings in this sector
| Market | Date | Who decided | Against | Outcome | Why | Source |
|---|---|---|---|---|---|---|
| FR | May 2019 | CNIL | SERGIC, a property management company (named in the Conseil d'État ruling of Nov 2020) | €400,000 and publication | Candidate tenants' files (ID cards, tax notices, bank details, divorce judgments) opened by changing a number in a web address, with no login; flaw known from March 2018, fixed in September 2018; rejected candidates' files never purged | CNIL |
| FR | Nov 2020 | Conseil d'État | SERGIC | Appeal rejected, €400,000 fine upheld | The flaw could have been avoided by simple measures such as a login; keeping every candidate's file in the live database was excessive | Conseil d'État |
| FR | Jan 2024 | CNIL | Publisher of a property listings website for private sellers (kept anonymous in the CNIL's record) | €100,000 | Passwords could be one character long and were stored in clear text, for about 5 million accounts; data kept beyond stated periods; incomplete contract with its data processor (the provider handling data on its behalf) and privacy notice | CNIL |
| FR | Dec 2024 | CNIL | A small estate agency (kept anonymous by the CNIL) | €40,000 | Staff monitored by cameras recording sound and by screenshot software; one administrator account and password shared by four people; no impact assessment (the written risk study the law requires for high-risk uses of personal data) | CNIL |
| FR | Jun 2024 | CNIL (simplified procedure) | A company specialised in property management (kept anonymous by the CNIL) | €12,000 | Cookie consent, and what visitors were told | CNIL |
| FR | Dec 2025 | CNIL (simplified procedure) | A software company serving rental and co-ownership management (kept anonymous by the CNIL) | €15,000 and order to comply | No valid legal ground for its marketing, what people were told, data security | CNIL |
| FR | Dec 2025 | CNIL (simplified procedure) | A public body managing rental housing (kept anonymous by the CNIL) | €20,000 and order to comply | Data used beyond its stated purpose, more data than needed, what people were told, their right to object, data security | CNIL |
| FR | Jul 2018 | CNIL | A social housing company (kept anonymous by the CNIL) | €30,000 | Tenant file used to send every tenant a letter campaigning against a housing benefit cut, a purpose incompatible with housing management | CNIL |
| FR | Apr 2017 | CNIL | A real estate agency (kept anonymous by the CNIL) | Monetary penalty, not made public | Data kept too long, what people were told, security, and failure to answer the CNIL, concerning tenants and landlords | CNIL |
| FR | Jul 2019 | CNIL (inspection programme) | About ten estate agencies, networked and independent (not named) | Reminders of obligations and corrective measures | On-site checks in 2018; recurring failings in what candidates and guarantors were told, how long data was kept, and physical and IT security | CNIL |
| UK | Jul 2019 | ICO | Life at Parliament View Ltd (LiFE Residential) | £80,000 (Data Protection Act 1998) | Bank statements, salary details and passport copies of 18,610 tenants and landlords exposed from March 2015 to February 2017; anonymous access left on during a transfer to a partner's server; reported only after a hacker contacted the ICO | Wired-Gov |
| UK | Apr 2024 | ICO | Clyde Valley Housing Association | Reprimand | A new customer portal showed residents other residents' names, addresses, dates of birth and antisocial behaviour files for five days; not tested before launch; first report not escalated | Public Technology |
| NL | May 2021 | Hoge Raad (Dutch Supreme Court) | Companies in a general commercial case, not a property case | Appeal rejected; a payment on a forged invoice counted as payment | The forged invoice, with a new bank account, came from the genuine email address of the seller's group, so the seller carried the loss. Listed here for what it suggests about rent and deposit diversion | Hoge Raad |
Questions worth asking
Your answers stay on this page. Each one shows why it matters.
How do applicants send you their documents?
How do tenants, owners and buyers learn your bank details?
Do you run a tenants' or owners' portal, and was access tested before launch?
Can a consumer conclude a contract on your site or app (book, pay or sign online), and how big are you?
answers point to something worth fixing.
The full assessment scores all four exposures and builds your list for the next 30 days.
Not legal advice. A lawyer should confirm three points. First, whether the European Accessibility Act applies to a given agency site, especially online applications that end in an e-signature sent by email and owner portals where rent or charges are paid. Second, who carries the loss when a tenant, owner or buyer pays forged bank details, in each country: the Dutch ruling cited here is a general commercial case, not a property one. Third, any anti-money-laundering identification duties for agencies in France.