Short answer
A valuation or enquiry form collects personal data, so UK GDPR applies. In practice that means asking only for what you need at that step, telling people at the point of collection who will use their details and why, keeping marketing consent separate and optional, sending data securely, and deleting it when you no longer need it. Cookie and analytics rules under PECR also changed in 2026, with new exceptions for some low-risk cookies.
Every agency website collects personal data through its forms: names, phone numbers, email addresses, property addresses. That data brings in instructions, so it is worth handling well, both because the law requires it and because a form that feels intrusive puts people off. This guide covers the practical side for valuation and enquiry forms. It is not legal advice; your own data protection adviser or the Information Commissioner's Office guidance is the authority.
Collect only what you need
Data minimisation is one of the core principles of the UK GDPR: personal data should be adequate, relevant and limited to what is necessary for the purpose. For a first valuation request, the purpose is to arrange a valuation. That needs a name, a way to get in touch, the property's location and whether the owner is thinking of selling or letting. It does not need the owner's date of birth, employer, reasons for moving or mortgage details. Your valuer can ask for further information later if it becomes necessary.
| Field | Needed at first contact? | Notes |
|---|---|---|
| Name | Yes | One field is enough; a title field is rarely needed. |
| Email or phone | At least one | Let people choose how they prefer to be contacted. |
| Property postcode or address | Yes | Postcode alone is often enough to route the request. |
| Sale or let | Yes | Sends the request to the right team. |
| Preferred time to talk | Optional | Helpful, but should not be required. |
| Bedrooms, property type | Optional | Can help the valuer prepare; avoid making it required. |
| Date of birth, ID numbers, finances | No | Not needed to arrange a valuation. |
Tell people what happens to their details
People have the right to be informed about how their personal data is used. According to the Information Commissioner's Office, this information has to be given when the data is collected, and it has to be short, open about what happens, easy to understand and easy to find, in plain language.[1] The ICO also describes a layered approach, with key points given at the point of collection and fuller detail in a privacy notice.[1]
For a form, that means a short statement beside the submit button. An example for a valuation form:
"We use these details to arrange your valuation and contact you about it. They are shared with our valuer for your area and kept for [period]. See our privacy notice for more, including your rights."
The square brackets are for you to complete; the retention period should be the one your agency actually applies. The linked privacy notice should cover who you are, the purposes and lawful basis for processing, who data is shared with, how long it is kept, and people's rights, including how to complain to the ICO.
Keep marketing separate
Someone asking for a valuation has not asked for your newsletter. If you want to send marketing emails or property alerts, offer that as a separate, optional choice that is not ticked in advance and not required to submit the form. Electronic marketing is also governed by the Privacy and Electronic Communications Regulations, which have their own consent rules, so check the ICO's direct marketing guidance before relying on any exception.
Send and store data securely
- HTTPS throughout. Every page on the site, not only the form, should be served over HTTPS.
- Authenticated email sending. Forms should send through your own mail server with authentication, not through an unauthenticated script that may be blocked or spoofed.
- Limited copies. Avoid storing submissions in several places, such as a website database, an email inbox and a spreadsheet, unless each is necessary.
- Access control. Only the people who need submissions should be able to see them.
- Spam protection without excess data. Hidden fields and timing checks stop most automated submissions without collecting extra information about visitors.
Retention
Decide how long you keep enquiry data and write it into your privacy notice. A valuation request that never became an instruction does not need to be kept indefinitely. One approach is to set a period after which unconverted enquiries are deleted, with a longer period for records connected to instructions and transactions, which may be subject to other legal retention requirements, such as anti-money laundering records.
Identity checks belong elsewhere
Estate agency businesses are supervised by HMRC under the money laundering regulations, and letting agency businesses are too where individual rents are 10,000 euros or more a month for a month or longer.[2][3] Customer due diligence is part of onboarding, handled through your own procedures or a specialist provider. It should not be done through a public website enquiry form. Asking for passport numbers or copies of ID at the first enquiry collects sensitive data before you need it.
Cookies and analytics on the same pages
Forms often sit on pages that also carry analytics, chat widgets or advertising pixels. Those are governed by PECR's rules on cookies and similar technologies. The Data (Use and Access) Act 2025 changed those rules. Section 112[4] and Schedule 12 of the Act, in force since 5 February 2026,[5] add exceptions from the consent requirement where the sole purpose is collecting statistics to improve a website, or adapting how a website looks or works to the user's preferences. Both exceptions apply only if the user is given clear and comprehensive information about the purpose and has a simple, free way to object.[6] Advertising and tracking cookies still need consent.
The practical step is to list every cookie and script on your form pages and ask whether each one is needed. A chat widget or advertising pixel on a valuation page shares information with a third party at the moment someone is giving you their details, so it deserves particular scrutiny.
What the full privacy notice should cover
The short statement on the form points to a fuller privacy notice. For an agency, that notice is easier to read if it is organised around the situations in which you collect data, rather than as one long block. A workable structure is: who you are and how to contact you about privacy; what you collect from valuation requests, viewing requests, applicants, landlords and buyers, with the purpose and lawful basis for each; who you share data with, such as referencing providers, portals or your CRM provider; how long each kind of record is kept; how the website itself handles cookies and forms; and people's rights, including the right to complain to the ICO. Writing it this way also makes it easier to keep accurate when a process changes.
A checklist for each form
- Every field is necessary for the purpose, or clearly optional.
- A short privacy statement sits beside the submit button, linked to the full notice.
- Marketing consent is separate, optional and unticked.
- The form works over HTTPS and sends through authenticated email.
- Submissions go only to the people who need them.
- A retention period is set and written into the privacy notice.
- No identity documents or financial details are requested.
- Third-party scripts on the page are reviewed and justified.
Do we need consent to process a valuation request?
Consent is not the only lawful basis. When someone asks you to arrange a valuation, processing their details to do that may rest on another basis, such as taking steps at their request before entering a contract. Your privacy notice should state the basis you rely on; take advice if you are unsure.
Can we add valuation enquirers to our mailing list?
Only in line with the marketing rules, which generally means a clear, separate opt-in for electronic marketing to individuals. Check the ICO's direct marketing guidance.
Should the form show a phone number field?
It can, but making it optional respects people who prefer email and reduces the data you hold.
Sources
Checked on 29 October 2026. Each entry says what kind of source it is.
- The right to be informed, Information Commissioner's Office (regulator or enforcement guidance)
- Who needs to register for money laundering supervision, HM Revenue and Customs (government publication)
- Money laundering supervision for letting agency businesses, HM Revenue and Customs (government publication)
- Data (Use and Access) Act 2025, section 112, legislation.gov.uk (legislation)
- The Data (Use and Access) Act 2025 (Commencement No. 6 and Transitional and Saving Provisions) Regulations 2026 (SI 2026/82), legislation.gov.uk (legislation)
- Data (Use and Access) Act 2025, Schedule 12: Storing information in the terminal equipment of a subscriber or user, legislation.gov.uk (legislation)