Online security is not perhaps the first thing that most landlords will think about when managing their properties, but it is important.
For example, you will normally hold the following information about your tenants:
- Their contact details
- Referencing documents
- Identification documentation
- Rent records, and sometimes
- Information about health and personal difficulties
All of these will be very useful to criminals committing identity theft or fraud, or targeting tenants with convincing scams.
This is why we have data protection legislation. So how does this apply to landlords?
Security is part of data protection compliance
New rules came in for data protection in 2018 with the introduction of the General Data Protection Regulation (GDPR). I wrote about this in 2018 on this blog here and here.
As discussed there, it is important that landlords take appropriate security measures proportionate to the risks involved.
The current framework is the UK GDPR and the Data Protection Act 2018, as amended. These require landlords to take appropriate technical and organisational measures to protect the personal information they hold.
So what sorts of things are we discussing here?
Practical precautions landlords can take
Strong, unique passwords
NEVER use something like ‘password’ or your name or something which can easily be guessed.
I know many people are put off using strong passwords because of the difficulty of remembering and using them. However, if you use a password manager, it can remember all your complex passwords and log you into sites. Making life a whole lot easier.
We use Bitwarden, but there are other services available.
The manager needs protecting with a strong master password, but remembering one password is considerably better than trying to remember all passwords! Enable two-step verification where available.
It may take a while to get used to using a password manager, but they save a whole lot of time once you have got a grip on them.
Find more help from the National Cyber Security Centre.
Two-step verification
This is where, when you log into a service, you have to verify that you are who you say you are, for example, by inputting a code sent to your phone.
It is particularly important for your email account, any online storage holding tenant documents, property management software and financial accounts. Enable it wherever it is available.
Software updates
If you run a website like I do, the various plugins are issuing updates all the time. It is important that you do the update as this helps protect your service.
Updates are also essential for phones, computers, browsers and apps. Devices or software which no longer receive security updates should be replaced or upgraded.
All the time the hackers and the criminals are trying to break into services, and the software companies are working to stop them. If you are using a service which has not been updated for a long time you are at risk.
So although it’s annoying to have to keep doing updates, you should nevertheless do them.
Checking unexpected requests
The hackers and criminals also send out a barrage of ‘phishing’ emails every day. So if something looks a bit odd – check it out before doing anything or clicking any links.
For example, Is the senders email address correct? If the email is supposed to be from your Local Authority but is actually from 4kyyys778s@gmail.com it is almost certainly fake!
However, an apparently correct email address does not prove that a message is genuine.
If an unexpected message asks you to make a payment, change bank details, disclose information or log into an account, check independently. Telephone the person or organisation using a number you already trust, or find their contact details on their official website. Do not use the contact details supplied in the suspicious message.
If a message is suspicious, you should NEVER
- Click any links or
- Download any attachments
If you do this, you could introduce destructive software into your computer, which could lead to identity theft or other nasties. Phishing can also lead to a convincing fake login page which steals a password.
The best way to deal with these emails is just to ignore them and delete them. You could also forward them to report@phishing.gov.uk, before deleting.
That goes too for emails which claim to have infected your machine, introduced spyware and demand large sums of money to be paid into a Bitcoin account if you want to avoid embarrassing videos being broadcast on the internet.
These mass-mailed threats are commonly bluffs. Receiving one does not establish that someone has accessed your computer or recorded you. Do not reply or pay; report the email and delete it.
If it includes a password you still use, change that password immediately, including on any other accounts where you have reused it.
Landlord Law members will find further guidance in the FAQ here.
Back up your records
Keep secure backups of important records and check that you can restore them.
Make sure you have a backup which cannot be altered or deleted through an attack on your everyday system.
Secure your devices and restrict access
Protect computers and phones with a password or PIN, enable device encryption where available, and lock the screen when you leave them unattended.
Only give people access to tenant information where they need it. Remove access when it is no longer required, and check recipients carefully before sending documents.
Do not collect more personal information than you need, or keep it longer than necessary. Remember, however, that some records (such as right to rent documentation in England) must be retained for a period of time to meet legal obligations.
Using an outside service does not remove your responsibilities
Where a company processes personal information on your behalf, you must choose a provider offering sufficient data protection guarantees and have a written contract covering the required data protection terms.
These may form part of the provider’s standard contractual documents.
What should you do if things go wrong?
Act promptly to contain the incident and obtain technical help where needed. If you have cyber insurance, contact your insurer promptly too.
Establish what information has been affected and assess the risks to the people concerned. Keep a record of any personal data breach, its effects and what you have done about it, including your reasons for deciding whether notification is necessary.
You must notify the Information Commissioner’s Office (ICO) without undue delay and, where feasible, within 72 hours of becoming aware of a personal data breach, unless it is unlikely to result in a risk to individuals’ rights and freedoms. Do not wait until you have every detail: further information can be supplied later.
Where a breach is likely to result in a high risk to those individuals, you must normally also inform them without undue delay.
Remember that a personal data breach can include losing access to information, or sending documents to the wrong person, as well as information being stolen by hackers.
For further guidance, see the ICO guidance on personal data breaches or speak to one of their advisers. I have always found them most helpful.
Leave a Reply