Learn how to create a verified tenant database in 2026 to streamline tenant screening, ensure compliance, and protect your property legally.
A verified tenant database is a landlord-facing directory of identity-checked tenant profiles where Right to Rent evidence, consent records, and supporting documents are stored in a dated, auditable format. To start building one today: collect a signed consent form and privacy notice, run a Right to Rent check on every adult occupier, and save a dated copy of the evidence. That single sequence gives you a statutory excuse against civil penalties and puts you on the right side of UK GDPR from day one.
Collect written consent and issue a fair processing notice before gathering any personal data.
Run a Right to Rent check on every adult who will occupy the property, not just the named tenant.
Save a dated copy of documents or the Home Office profile page immediately after checking.
Record the check date, the checker's name, and the document expiry (if time-limited) in your profile record.
Diarise follow-up checks for any permission that expires during the tenancy.
Key takeaways
A compliant verified tenant database requires Right to Rent evidence, dated copies, written consent, and a documented lawful basis under UK GDPR for every adult occupier.
Point
Details
Run checks on every adult
Right to Rent checks must cover all adult occupiers, not just the named tenant, to secure a statutory excuse.
Save dated evidence immediately
Keep copies of documents or Home Office profile pages for the tenancy duration and one year afterwards.
Document consent and lawful basis
Collect a signed consent form and issue a privacy notice before gathering any personal data.
Use tiered verification levels
Assign ID-checked, Right to Rent verified, or fully verified status to speed decisions and trigger the right next step.
Hauzed as your starting point
Hauzed delivers identity-verified tenant profiles and workflow tools so you build your database from qualified, checked applicants.
Why building a verified tenant database matters more than ever
With Section 21 abolished from 1 May 2026, you can no longer serve a no-fault eviction notice as a fallback. Pre-tenancy vetting is now your primary practical defence. Industry analysis following the Renters' Rights Act argues that professional-grade tenant databases and thorough pre-tenancy verification have moved from optional tools to essential infrastructure.
The legal stakes are real on two fronts:
Right to Rent failures can result in civil penalties that can be substantial for a first breach, rising sharply for repeat failures. A documented, prescribed check is the only route to a statutory excuse.
UK GDPR breaches can trigger ICO enforcement action, including fines and mandatory audits, if you collect tenant data without a lawful basis, a privacy notice, or adequate security measures.
Longer possession proceedings mean a weak paper trail now costs you months in court rather than weeks.
Reputational damage from a data breach or a discrimination complaint can affect your ability to let properties in future.
The minimum dataset for a compliant, useful profile covers identity, right to rent, financial standing, references, and consent. Thorough tenant referencing across all five areas is the most effective way to avoid rent arrears and tenancy disputes.
Your fair processing notice must state what data you collect, why, how long you keep it, who you share it with, and how tenants can exercise their data subject rights. Collect it at the point of application, before any checks begin.
Pro Tip:Store the exact version of the privacy notice the tenant signed, alongside the timestamp of their consent. If your notice changes, you will need a record of which version each tenant agreed to.
How do you verify a tenant's identity and right to rent?
There are three prescribed methods, and the right one depends on the tenant's immigration status and your setup. The landlord's guide to Right to Rent checks sets out when to use each and which documents are acceptable.
Manual document checks
Ask the tenant to produce original documents from the acceptable documents list.
Check the document in the tenant's presence (or by live video call if they cannot attend in person).
Verify the document is genuine: check the photo, expiry date, and any security features.
Make a clear copy (scan or photograph) and record the date you carried out the check.
Keep the copy for the duration of the tenancy and one year afterwards.
Home Office online share code checks
Ask the tenant for their share code and date of birth.
Go to the Home Office online checking service and enter both details.
Review the profile page, confirm the photo matches the person, and note the permission expiry date.
Save or print the profile page as your evidence record, with the date of access noted.
OFDIA-registered RtR DVSP digital checks
For tenants who hold a UK or Irish passport or a valid biometric document, you can use a Right to Rent Digital Verification Service Provider (DVSP). DVSPs use facial recognition and document scanning to produce a compliant report.
Confirm the provider is on the OFDIA register before using them.
The DVSP report replaces the manual copy but does not remove your obligation to check every adult occupier.
You still need to diarise follow-up checks where the permission is time-limited.
If a tenant's status is unclear or the online service returns an uncertain result, contact the Home Office Landlord Checking Service (LCS) for a formal response.
Pro Tip:Set a calendar reminder for the permission expiry date on the day you complete the check. A missed follow-up is one of the most common reasons landlords lose their statutory excuse.
How to store and protect verified tenant data lawfully
Private landlords are data controllers under UK GDPR and must document their lawful bases, maintain a Record of Processing Activities (RoPA), and implement appropriate technical and organisational measures. Using an agent or a platform does not transfer that responsibility unless you have a written data processing agreement (DPA) in place.
Your lawful bases for processing tenant data will typically be:
Contract (processing necessary to enter or perform a tenancy agreement).
Legal obligation (Right to Rent checks required by the Immigration Act 2014).
Legitimate interest (referencing and fraud prevention, balanced against tenant rights).
Practical security measures to put in place:
Encrypt files at rest and in transit; avoid storing scanned documents in unprotected email folders.
Restrict access to tenant records to named individuals only, with a log of who accessed what and when.
Set a deletion schedule: keep records for the tenancy duration and one year after it ends, then delete or anonymise securely.
Document your breach response process so you can notify the ICO within 72 hours if required.
Tenancy records qualify as personal data and must be handled with the same rigour as any other sensitive personal information. Where you use a letting agent, your DPA must specify what data they can process, for what purpose, and for how long.
Pro Tip:Keep an audit log of every access to a tenant's profile record. When a Data Subject Access Request (DSAR) arrives, you will need to demonstrate exactly what data you hold and who has seen it.
A practical workflow to build and maintain your verified tenant list
Four phases cover the full journey from first enquiry to ongoing tenancy management.
Phase 1: Pre-qualification
Publish your privacy notice on your listing or application form.
Collect basic pre-qualification details (household size, move-in date, income band) to filter enquiries before requesting personal data.
Confirm the applicant is an adult occupier who will need a Right to Rent check.
Phase 2: Application and consent
Send the full application form with the privacy notice attached.
Collect signed consent for credit checks, referencing, and data processing.
Record the consent timestamp and privacy notice version in the profile.
Phase 3: Verification and decision
Run the Right to Rent check using the appropriate method (manual, share code, or DVSP).
Complete credit, income, and landlord reference checks with the tenant's written consent.
Record the outcome, the checker's name, and the date in the profile.
Apply your verification tier (see the next section) and make a documented letting decision.
Phase 4: Onboarding and retention
Save all evidence to the tenant's profile record with dates.
Diarise follow-up Right to Rent checks for time-limited permissions.
Schedule a profile review at the 12-month mark and at any change of occupier.
Diary reminders to set immediately:
Permission expiry date (from share code or DVSP report).
Annual profile review date.
Tenancy end date plus one year (deletion/archival trigger).
How should you design tenant profiles and verification levels?
Tiered verification levels let you make faster decisions and match your due diligence to the risk profile of each tenancy. A well-structured tenant profile signals to applicants that you take the process seriously, which tends to attract more prepared candidates.
Verification level
Evidence held
Method used
Confidence
Unverified
Name and contact only
Self-declared
Low
ID-checked
Photo ID confirmed
Manual or DVSP
Medium
Right to Rent verified
RtR evidence saved and dated
Manual, share code, or DVSP
High
Fully verified
RtR + credit + income + references
All of the above
Highest
Use these levels as workflow triggers:
ID-checked only: request additional documents before proceeding.
Right to Rent verified: proceed to referencing stage.
Fully verified: eligible for tenancy offer; consider whether a guarantor is still required based on income ratio.
If an applicant reaches only partial verification, document why and what additional steps were requested. That paper trail protects you if a decision is later challenged.
Common pitfalls that invalidate your statutory excuse or create GDPR risk
The most frequent failure is not running a check on every adult occupier. The prescribed check must cover all adults who will live in the property, not just the person who signs the tenancy agreement. Miss one occupier and you lose the statutory excuse for the whole tenancy.
Other red flags and pitfalls to watch for:
No dated copy: a check without a recorded date is not a compliant check.
No DPA with your agent: if your letting agent processes tenant data on your behalf without a written DPA, you are in breach of UK GDPR.
Inconsistent document dates: a passport issued after the stated date of birth, or a utility bill dated before the applicant claims to have moved in, warrants further scrutiny.
Unverifiable referees: a previous landlord whose contact details cannot be independently confirmed is a significant red flag.
New or thin credit file: a credit file opened very recently with no history may indicate identity fraud.
Discriminatory approaches: you must apply the same checks to all applicants regardless of nationality. Treating non-UK nationals differently is unlawful under the Equality Act 2010.
Retaining data beyond the retention period: keeping records longer than tenancy plus one year without a documented reason creates unnecessary GDPR exposure.
Failing DSAR processes: you must respond to a Data Subject Access Request within one calendar month. Missing that deadline can trigger ICO investigation.
If you discover a gap in an existing record, document the remediation step taken and the date. A corrected record with a clear audit note is far better than an unexplained gap.
Why verified tenant databases change how letting actually feels
Adopting a structured, verified tenant database shifts the entire dynamic of the letting process. Before you have a system, every new enquiry starts from zero: you are assessing a stranger with no paper trail, no verified identity, and no documented history. That uncertainty drives slow decisions, gut-feel judgements, and disputes that are hard to resolve because nothing was written down.
Once you have a database with tiered verification levels and a clear workflow, the decisions become faster and more defensible. You are not guessing whether an applicant's income checks out; you have a dated payslip and a credit report in the file. You are not hoping a previous landlord reference is genuine; you have a verified contact number and a written response on record.
The practical lesson most landlords learn early is that documentation discipline matters more than the specific tool you use. A well-kept spreadsheet beats a poorly maintained platform every time. But as your portfolio grows, the manual overhead of maintaining dated copies, diary reminders, and access logs across multiple properties becomes the bottleneck. That is when a purpose-built platform starts to pay for itself in time saved and risk avoided.
Hauzed gives you verified tenant profiles from the first enquiry
Sorting through unverified enquiries and maintaining compliant records manually takes real time, and the margin for error has narrowed since Section 21 was abolished. Hauzed is built specifically to reduce that overhead: every tenant on the platform completes identity verification before they can send a request, so you receive qualified, identity-checked interest rather than anonymous messages.
For landlords and letting agents, Hauzed provides:
Identity-verified tenant profiles available before the first conversation.
AI matching via Hauzer to surface the most relevant candidates for your property.
Echo for smart chat follow-up, so no enquiry goes unanswered.
Secure document handling with privacy controls built into the platform workflow.
Bulk publishing and team accounts for agencies managing larger portfolios.
Keep a saved copy of any Home Office profile page you access, with the access date recorded alongside it. That copy is your evidence if the check is ever queried.
FAQ
What is a verified tenant database?
A verified tenant database is a landlord-facing record of identity-checked tenant profiles where Right to Rent evidence, consent forms, and supporting documents are stored in a dated, auditable format. It gives you a defensible basis for every letting decision.
How long do you need to keep Right to Rent check records?
You must keep copies of Right to Rent documents for the entire duration of the tenancy and for one year after it ends, then delete or securely archive them.
What is an OFDIA-registered RtR DVSP?
A Digital Verification Service Provider (DVSP) on the OFDIA register is an approved provider that uses facial recognition and document scanning to carry out a compliant Right to Rent check. The 2026 Right to Rent code of practice sets out the requirements for using one.
Do landlords need a data processing agreement with their letting agent?
Yes. If your letting agent processes tenant personal data on your behalf, you need a written data processing agreement (DPA) specifying what data they can process, for what purpose, and for how long. Without one, you remain in breach of UK GDPR as the data controller.
How does Hauzed help with building a verified tenant database?
Hauzed requires tenants to complete identity verification before they can send rental requests, so landlords and agents receive pre-checked applicant profiles from the outset. The platform also supports secure document handling, AI-assisted tenant matching via Hauzer, and team workflows for agencies managing multiple properties.
