UK data protection changes for surveying practices

If you run a small surveying practice, this is written for you. It is for the firm with a few surveyors out on site and a trusted support team behind them. In that firm, the person who books the jobs is often the person who opens the letter from a solicitor asking for a client’s file. There is no data protection officer to hand it to.

That is fine. Most of what the law asks of a practice this size is to know what you hold, why you hold it, and what you would do if someone asked. What has changed is that the law was rewritten in 2025 and the new rules took effect in 2026. A couple of them need something written down before anyone asks.

What the Data (Use and Access) Act 2025 is, and when it applied

The Data (Use and Access) Act 2025 received Royal Assent on 19 June 2025. It is a wide Act, and the part that matters here rewrites pieces of UK GDPR, the Data Protection Act 2018 and PECR. PECR is the Privacy and Electronic Communications Regulations, the 2003 rules that govern marketing by email, text and phone, and cookies on websites.

It did not arrive all at once. The main data protection changes came into force on 5 February 2026 under the sixth commencement regulations, as DLA Piper set out at the time. The new duty on complaints followed on 19 June 2026. So by the time you read this, all of it applies to your practice.

What has not changed

Start here, because most of what you already do still stands. UK GDPR is amended, not replaced, and the principles are the same. You still need a lawful basis for every use of personal data, a privacy notice that says what you do, and a record of what you hold. A personal data breach that is likely to risk people’s rights must reach the ICO without undue delay and, where feasible, within 72 hours. Client names, addresses, phone numbers and the photographs you take inside an occupied home are personal data, as they were before.

The regulator has not changed either. The Act sets up an Information Commission to take over from the Information Commissioner, and the ICO will announce when that happens. Until then, the ICO’s guidance is the guidance to follow.

Does a surveying practice need to register with the ICO?

In almost every case it does. Any organisation that uses personal data, sole traders included, must pay the ICO’s data protection fee unless an exemption applies. A practice that holds client files and survey photographs is unlikely to fit one. Paying the fee puts you on the ICO’s public register, which is what most people mean by ICO registration.

The fee depends on turnover or staff numbers. A small practice usually falls into tier 1, which is £52 for a turnover of up to £632,000 or no more than 10 staff. Tier 2 is £78, and paying by direct debit takes £5 off. The ICO’s guide to the data protection fee sets out the tiers and the exemptions, and its self-assessment tells you in a few minutes whether you need to pay.

The complaints procedure every practice now needs

Do this one first. It is new, it is mandatory, and it has applied since 19 June 2026.

Section 103 of the Act inserts a new section 164A into the Data Protection Act 2018. A controller must help people complain about how their personal data has been handled. The example the Act gives is a complaint form that can be completed electronically and by other means. It must acknowledge a complaint within 30 days of receiving it. It must then look into the matter to the extent appropriate, and tell the complainant the outcome without undue delay.

The ICO’s guidance is blunt about scope. Every organisation that processes personal data needs a process, whatever its size, and there are no exemptions. For a small practice the process can be a paragraph. It should say where a complaint about personal data goes, who reads it, that it is acknowledged within 30 days, and where the answer is recorded. Put the route in your privacy notice, and put the paragraph where the support team can find it.

One practical point. A data protection complaint is not the same as a complaint about the survey, and your RICS complaints handling procedure does not cover it on its own. The two can sit together and the same person can run both, but the 30-day acknowledgement is a separate clock.

Subject access requests: reasonable and proportionate

A subject access request is the letter that asks for everything you hold about someone. In a practice it usually comes from a buyer who is unhappy after completion, or from a solicitor acting for one. The Act does not reduce the right, but it writes two working practices into law that the ICO had previously only put in guidance.

First, you only have to provide what a reasonable and proportionate search turns up. You are expected to look in the job file, the email account and the practice software. You are not expected to search every surveyor’s personal phone for a text from four years ago. If that is where the job history lives, though, the search is harder to keep proportionate.

Second, the clock now stops while you wait for the person to clarify what they want or to confirm who they are. The standard period is still one month. It can still be extended by up to two further months for complex or numerous requests, provided you say so before the first month ends.

Those two rules reward a practice that keeps its job records in one place. If the client, the property, the report, the terms and the emails hang off one job record, the search is a filter and an export. If they are spread across three inboxes and a shared drive, “reasonable and proportionate” becomes a judgement you will have to defend.

Legitimate interests: what the new list does and does not do

Legitimate interests is one lawful basis a practice may use where processing is not required by a contract or legal duty. It comes with a balancing test that has to be written down. The Act adds a short list of recognised legitimate interests that skip the balancing test altogether. They cover disclosures to public bodies that need the data, national security and defence, emergencies, the prevention and detection of crime, and safeguarding vulnerable people.

For a practice, that list is narrow. It covers the day the police ask about a property you inspected, or a safeguarding concern raised after a visit. It does not cover the everyday.

The Act also confirms, in Article 6 itself, that three familiar purposes can be legitimate interests. They are direct marketing, sharing data within a group of companies for administration, and network security. That settles an old argument, but those three still need the balancing test. So nothing you rely on today needs a new basis, and the assessment you wrote for marketing to past clients still needs to exist. If it does not, write it now.

Marketing to past clients and agents: PECR and the higher fines

PECR governs marketing emails, texts and calls, and the Act changed two things about it.

The one that bites is enforcement. PECR breaches are now enforced under the same penalty provisions as UK GDPR, applied by Schedule 13 of the Act. That lifts the ceiling on fines for a marketing breach to the UK GDPR levels. The ICO’s marketing fines have historically gone to firms sending millions of messages. The rule that applies to a practice emailing three hundred past clients is the same one.

The rule itself has not softened. An email offering a service to an individual needs consent, or the narrow “soft opt-in” where you collected the details during a sale or its negotiation, market your own similar services, and offered an opt-out both then and in every message. Sole traders and some partnerships count as individuals under PECR. Many of the estate agents, mortgage brokers and one-person conveyancers you deal with are exactly that. A list of contacts gathered from old instructions is not a marketing list.

Two things are worth checking. Your practice software or CRM should record marketing consent separately from the consent to be contacted about a job, with a date. And every marketing email should carry an unsubscribe link that works.

Cookies on your own website

If your practice website uses analytics, the Act’s change to PECR helps. Cookies used purely for aggregate statistics that improve the site, or for remembering how a visitor wants it to look, may no longer need consent. Schedule 12 requires clear information and a simple, free way to object. An analytics provider must act only for you and use the information only to improve the site. Individual tracking, advertising and profiling still need consent. If a web agency set your banner up in 2023, ask them whether it still reflects what the site actually does.

Automated decisions and the AI tools you use

The Act rewrites the rule on decisions taken solely by automated means. The old position was a near-ban with exceptions. The new one, in section 80, allows significant automated decisions provided safeguards are in place. That means telling the person, letting them make representations, and letting them ask for a human to look again. The stricter rule remains where special category data is involved.

For a surveying practice the honest answer is that very few decisions are automated in that sense. An AI tool that flags items in a report for a surveyor to review is not deciding anything about a person. A tool that priced quotes automatically and declined some clients would be closer, and a system that screened instructions by postcode would be closer still.

The connection to the RICS AI standard is direct. Our checklist on that standard asks firms to record who may use each tool, which client data it receives and where that data goes. The same record helps show your data protection position, so write it once and use it twice.

If you have an AI assistant, hand it this brief

Most of the work above is writing down what your practice already does, in a form you could show the ICO or a complainant. That is a first draft an assistant such as Claude or ChatGPT can produce in a few minutes, provided you give it the facts and keep the decisions. Two rules before you paste anything.

• No client data. The brief below needs only how your practice is set up and which tools you use. If an answer would need a client’s name, address or file, it is the wrong tool for the job.
• You still decide. The output is a draft, not legal advice. Read every line, correct what the assistant did not know, and put your own name on the decisions and the complaints route.

Copy the brief, fill in the three bracketed sections, and paste the whole thing into the assistant you use.

You are helping a small UK surveying practice bring its data protection records up to date after the Data (Use and Access) Act 2025, whose main data protection provisions came into force on 5 February 2026 and whose complaints duty (section 164A of the Data Protection Act 2018) came into force on 19 June 2026. Work only from the facts I give you. Where you do not know something, write "to confirm" rather than inventing it. Use UK English. Do not ask me for any client data and do not include any in your output.

ABOUT THE PRACTICE
[Number of surveyors and support staff. RICS-regulated? Survey types offered, e.g. Level 2, Level 3, valuations. Whether you work for panels or lenders as well as private clients. Who currently handles complaints and data requests.]

WHERE OUR DATA LIVES
[Practice software or CRM, email system, shared drive, report-writing tools, any AI tools, accounting package, website host and analytics. For each, whether client data goes into it and where the supplier says it is hosted.]

HOW WE MARKET
[Do we email past clients, estate agents, brokers or conveyancers? How did we get their details? Do we record marketing consent separately from the consent to be contacted about a job? Does our website have a cookie banner, and what does the site actually use cookies for?]

Please produce, in this order, with a short heading for each:

1. Complaints procedure. A one-paragraph data protection complaints process that names the route (an email address or form), who reads it, the 30-day acknowledgement, and where the outcome is recorded. Add the two or three sentences to put in our privacy notice so people know the route exists. Say how it sits alongside our RICS complaints handling procedure without merging the two.

2. Subject access request process. Where a request is logged, who runs the search, which systems from my list count as a reasonable and proportionate search, the one-month clock, when it can be extended by up to two months, and when the clock stops while we ask for clarification or identity.

3. Legitimate interests assessment. For each purpose we rely on legitimate interests for (list them from what I told you, including any marketing to past clients or agents), the three-part test: the purpose, why the processing is necessary, and the balance against the person's interests, with a one-line conclusion.

4. Marketing check. Whether each group we email needs consent or can rely on the soft opt-in under PECR, noting that sole traders and partnerships count as individuals. What our consent record should capture (source, date, wording), and the unsubscribe wording.

5. Website cookies. From what I said the site uses, which cookies are strictly necessary, which may fall within the statistics or appearance exceptions (with the three conditions: information, an easy way to object, processor-only sharing), and which still need consent. Three questions to put to whoever runs our website.

6. Processor and AI tool register. A table of every tool from my list that holds client data: supplier, hosting location, whether a data processing agreement is in place, whether it uses AI, and a "to confirm" column. Note that the AI tools also belong in the register the RICS AI standard asks for.

7. Gaps. A short list of anything the Act or the ICO expects that my answers did not cover, so I can go and find out.

Keep it plain and practical. Where a choice is ours to make, say so rather than making it for us, and never state a legal position as certain where the ICO's guidance is still developing.

If you use SCORE, the systems answer for items 2 and 6 is short. The client, property, terms, report and emails sit on one job record, and our data processing agreement and sub-processor list are published.

A checklist for a small practice

1. Write the data protection complaints paragraph and add the route to your privacy notice. This has been due since 19 June 2026.
2. Decide where a subject access request is logged and who runs the search. Note the one-month clock and the stop-the-clock rule.
3. Find, or write, the legitimate interests assessment for the processing you rely on, including marketing to past clients.
4. Check that marketing consent is recorded separately from job contact consent, with a date, and that the unsubscribe link works.
5. Ask whoever runs your website whether the cookie banner matches what the site does.
6. List the tools that touch client data, including AI tools, and where each one processes it. Use the same list for the RICS AI register.
7. Confirm that each supplier’s data processing agreement and sub-processor list say where data is processed. If data leaves the UK, record the adequacy regulation, safeguard or exception that covers the transfer.
8. Check that your data protection fee is paid and that your entry on the ICO register is current.

Where SCORE fits

SCORE is practice software for UK surveying and valuation firms. It holds the client, the property, the terms, the report and the emails against one job record. That is what makes a subject access search a filter rather than a hunt. It is hosted in the UK, keeps an audit trail on every job, and your data can be exported in full at any time. Our data processing agreement and list of service providers are published, so much of the supplier check is already documented.

SCORE is not approved, endorsed or affiliated with RICS, and this article is not legal advice. The Act and the ICO’s guidance are the documents to work from, and both are free to read.