ICO Registration for Property Businesses: Do You Need It?

Do property businesses need to register with the ICO? In most cases, yes — if you process personal data electronically for a business purpose, registration and the data protection fee are a legal requirement. A property sourcer or agent who holds investor contact lists, seller enquiries, viewing notes and anti-money-laundering identity records is processing personal data on a substantial scale, which is exactly what the regime is built around. This guide explains when ICO registration applies, how the data protection fee tiers work, what counts as processing, the lawful basis and ROPA basics, how KYC retention interacts with UK GDPR, and where ICO registration sits among a sourcer's other obligations.

This is general information, not financial, legal or tax advice — seek independent professional advice.

Who must register with the ICO?

The starting point is simple: if you process personal data on a computer or other automated system for a business purpose, you almost certainly need to register and pay the fee. A property sourcer rarely escapes this, because the entire model runs on data about identifiable people. Consider what a typical sourcing operation holds:

• Investor lists — names, contact details, budgets, strategy preferences and prior enquiries, usually in a CRM or spreadsheet.
• Seller and vendor leads — owners who have asked to sell, often including sensitive context about their circumstances.
• Website enquiry and waitlist submissions — every form that captures a name and email.
• KYC and AML records — identity documents, proof of address and source-of-funds evidence collected for due diligence.

There is a narrow set of exemptions — for example some organisations that only process data for limited internal purposes such as staff administration or their own accounts. In practice these rarely cover a commercial sourcing business, which markets to investors and handles third-party seller data as its core activity. Do not assume you are exempt because you are small or sole-trader; the exemptions turn on what you do with the data, not your size. Confirm your specific position with the ICO before deciding either way.

The data protection fee and its three tiers

The fee is the price of registration, and it is deliberately modest. It is not a charge for advice, approval or a quality mark — it funds the ICO's work as the UK's data protection regulator. The amount you pay depends on which of three tiers you fall into, assessed mainly by staff numbers and annual turnover.

Most independent property sourcers and small agencies will sit in Tier 1, and many qualify for a discount when paying by direct debit. Because the thresholds and amounts are set by regulation and reviewed from time to time, treat the figures published on the ICO website as the source of truth at the moment you register. Budget for it as a small recurring annual cost, renewed each year.

What counts as processing personal data

This catches far more than people expect. It is not only the formal CRM; it is the inbox of seller enquiries, the spreadsheet of investor budgets, the notes from a viewing, the WhatsApp thread with a vendor, and the folder of scanned passports gathered for AML checks. Each of those is personal data, and in some cases — identity documents and source-of-funds material — it shades into more sensitive territory that warrants tighter security.

The practical takeaway is that a sourcer cannot ring-fence "the data we care about" from everything else. The obligation attaches to the personal data wherever it lives. That is why registration is the floor, not the ceiling: paying the fee acknowledges that you process this information, but it is the day-to-day handling that the law actually cares about.

Lawful basis and the ROPA

UK GDPR does not let you process personal data simply because it is convenient. For each activity you must identify a lawful basis, and you should be able to say which one applies to what. For a property sourcer the common bases map roughly as follows:

• Contract — data you need to deliver a service the investor or seller has agreed to.
• Legitimate interests — proportionate business and marketing activity, supported by a documented balancing assessment that weighs your interest against the individual's rights.
• Legal obligation — records you are required to hold under other laws, such as AML records under the Money Laundering Regulations 2017.
• Consent — needed for certain direct electronic marketing under the Privacy and Electronic Communications Regulations (PECR), and which must be freely given and revocable.

Why the ROPA matters

A Record of Processing Activities (ROPA) is the written inventory that ties all of this together: what data you hold, why, the lawful basis, who you share it with, how long you keep it and how it is secured. Most organisations processing personal data are expected to maintain one, and it is among the first documents the ICO asks to see. For a sourcer it is also genuinely useful — it becomes the map you reach for when an investor asks what you hold about them, or when you need to know whether a five-year-old KYC file is due for deletion. Build it once, keep it current, and most other data-protection tasks become easier. Confirm the current ROPA expectations on the ICO website.

Retaining AML and KYC records under GDPR

Retention is where data protection and anti-money-laundering rules meet, and the two pull in the same direction once you understand them. Under the Money Laundering Regulations 2017, customer due diligence and transaction records are generally retained for five years after the business relationship ends or the transaction completes. After that, they should usually be deleted unless another legal obligation requires you to keep them.

UK GDPR's storage-limitation principle says you must not keep personal data for longer than you need it. Far from conflicting, the AML rule gives you a clear, defensible answer to the GDPR question: you keep KYC records for five years because the law requires it, and you delete them afterwards because GDPR requires that. The discipline is to write the retention period down in your ROPA, apply it consistently, and actually run the deletions when they fall due — holding records "just in case" indefinitely is itself a GDPR failing. Confirm current retention obligations with the ICO and HMRC, as both regimes are reviewed periodically.

Consequences of not registering

The data protection fee is small; the cost of ignoring it is not. The ICO maintains a public register of organisations that have paid, sends reminders to those it believes should be registered, and can impose a monetary penalty for non-payment running to several thousand pounds depending on the tier you should have been in. That penalty is separate from any enforcement for wider UK GDPR breaches such as a data breach or unlawful processing.

• Financial penalty for failing to pay the fee, scaled by the tier you fall into.
• Public visibility — being absent from the register is checkable by anyone, including the investors and partners doing diligence on you.
• Separate GDPR exposure — non-registration often signals weaker data handling generally, which is exactly what attracts further scrutiny.

For a firm that wants to be trusted with investor and seller data, registration is simply a basic cost of operating credibly — cheap insurance against a penalty and a reputational dent that outlasts it.

Where ICO registration sits among a sourcer's obligations

It is tempting to treat compliance as a single box to tick. It is not. ICO registration is one of several parallel obligations, each covering a different risk, and satisfying one does nothing for the others.

Who's behind L&M

Verifiable sources cited in this guide

Frequently asked questions about ICO registration and property data