MIT Live 2026 in London on 13 October: a useful prompt to review tenant-screening, GDPR and supplier checks

MIT Live 2026 takes place on 13 October 2026 at County Hall, London. It is an industry event, not a legal update, so it does not create any new statutory duties for landlords or letting agents by itself. That said, the themes likely to be discussed — regulation, risk, AI, technology, operational processes and customer experience — overlap with areas where property businesses can already fall short if they rely heavily on tenant-screening software, automated workflows or third-party data platforms.

That makes the event a useful prompt rather than a compliance deadline. If your business uses automated affordability checks, ID verification, fraud alerts, lead scoring, chatbots, CRM automations or rent-chasing systems, you are already handling personal data and may be relying on technology to influence decisions affecting applicants and tenants. The relevant framework is not new: UK GDPR and the Data Protection Act 2018 are already in force, alongside other duties that may arise under consumer protection law, equality law and right to rent rules, depending on how the system is used.

Why landlords and agents should care now

Many landlords use proptech through their agent, referencing provider or software stack without ever treating it as a legal or operational risk issue. In practice, that can mean decisions are made quickly, based on vendor outputs, with limited checking of whether the process is fair, secure and properly documented.

That is particularly relevant in faster-moving London markets. A landlord or agent handling high enquiry volumes in boroughs such as Wandsworth, Newham, Haringey, Brent or Southwark may process large numbers of ID documents, bank statements, payslips, right to rent records and contact details in short periods. The faster the workflow, the greater the temptation to trust the software result without proper human review.

Who should attend MIT Live 2026

For most firms, if anyone attends, it should be one person with authority to change process — typically a compliance lead, operations manager, director or business owner. A junior negotiator is less likely to be able to act on issues raised.

For very small self-managing landlords, attendance may not be necessary unless you directly use screening or automation tools yourself. For larger portfolio landlords, HMO operators and agencies using multiple external suppliers, sending one decision-maker is easier to justify if the business intends to review contracts, workflows and recordkeeping afterwards.

Build a register of every system handling applicant or tenant data

Before the event, prepare a simple list of each system that touches applicant or tenant information. That should include:

• referencing platforms
• deposit-related software
• e-signature tools
• CRM systems
• maintenance portals
• ID or fraud-checking tools
• rent collection apps
• AI assistants or chatbot tools

Against each one, record:

• supplier name
• what data it processes
• whether it makes or supports decisions
• where the data is stored
• whether you have a signed data processing agreement

If you cannot answer those basic points for a supplier, that is already a gap worth addressing.

Check whether a DPIA is needed

If you use AI or automated tools in a way that could significantly affect applicants or tenants, consider whether you need a Data Protection Impact Assessment (DPIA). Under UK GDPR, a DPIA is required where processing is likely to result in a high risk to individuals’ rights and freedoms.

This article should be careful not to overstate the law: using software does not automatically mean a DPIA is required in every case. But if a tool is used to help reject applicants, detect alleged fraud, profile affordability or rank individuals in ways that could materially affect them, you should be able to explain:

• what the tool does
• what human oversight exists
• how someone can challenge an outcome
• what steps are taken to identify or reduce unfair bias

If that explanation is missing, your governance may already be too weak.

Review supplier contracts and overseas data transfers

Supplier contracts deserve separate scrutiny, especially where landlords rely on software chosen by an agent, broker or outsourced operator. Ask for:

• the data processing agreement
• any sub-processor list
• evidence of technical and organisational security measures
• details of any international data transfers

Where personal data is transferred outside the UK, appropriate transfer mechanisms may be needed under UK data protection law. The exact mechanism will depend on the destination country and supplier setup, so the article should avoid implying that one document or process applies in every case.

The original draft referred to “SOC reports or equivalent controls”. That is broadly fine as a commercial check, though not a legal requirement in itself. It is better framed as supporting evidence of supplier assurance rather than something landlords must obtain in every case.

Identity checks, fraud prevention and right to rent

Identity verification and fraud prevention are sensible areas to review, particularly given the wider use of digitally altered documents and impersonation techniques. If you use tenant-screening or ID tools, confirm:

• who checks exceptions or mismatches
• how borderline cases are escalated
• what records are retained
• how the process interacts with right to rent checks where applicable

The draft was right to be cautious on AML. Anti-money laundering duties do not generally apply to ordinary residential letting agency work in the same way they apply to estate agency work, although separate obligations can arise in limited areas such as high-value lettings. For most mainstream residential landlords, the more immediate issue is sound identity checking, fraud prevention and recordkeeping, rather than standard AML supervision rules.

Refresh staff guidance before the event

The suggested internal deadline of 30 September 2026 works well as an operational target, provided it is presented clearly as a business choice, not a legal deadline. Before the event, businesses planning to attend should refresh guidance on:

• data protection basics
• fair treatment of applicants
• manual override procedures
• when staff must escalate a machine-generated outcome
• who can make the final decision in borderline cases

That is especially relevant in high-volume London markets such as Camden, Islington and Hackney, where speed can overtake judgement.

Use the event as a fact-finding exercise

Attendance only has value if it leads to action. Ask whoever attends to record, for each relevant session:

• any mention of new guidance or regulator focus
• any operational risk the business has not already considered
• any process change worth reviewing internally

Then convert the notes into an action list with named owners and target dates within a week of the event.

Practical next steps

1. Decide whether your business actually needs representation at MIT Live 2026 on 13 October 2026.
2. Before 30 September 2026, complete a register of the systems that handle applicant or tenant data.
3. Identify missing supplier documents, unclear data flows and any processing that may require a closer UK GDPR review.
4. Schedule a post-event review meeting for the week beginning 19 October 2026 if someone attends.

Rentals & Sales can help audit tenant-data workflows, review proptech supplier paperwork and tighten manual checks around automated screening and ID processes.

General information only, not legal advice; check current ICO and government guidance for your circumstances.