Agents have been accused by the regulator of lack of awareness when it comes to data protection.

The Information Commissioner’s Office said that visits to agents’ offices plus an online survey in conjunction with the NAEA and ARLA revealed some worrying findings.

These included a lack of formal policies, procedures and training; lack of awareness about using encryption to protect personal data; the “widespread” use of generic accounts to gain access to IT systems; passwords not being changed regularly, and being weak; and lack of security for manual records containing personal data.

The ICO said it was also concerned that none of the agencies that let staff work from home had a remote working policy outlining responsibilities towards personal data.

There was no guidance as to how paper documents and mobile devices should be stored off-site or secured during transport.

Only one of the agents visited by the ICO had a data policy in place, although 71% of agents who took part in the survey said they did.

Over half of all the agents did not require complex passwords to be used.

Leanne Doherty, good practice group manager at the ICO, said: “More than half a million people work in the real estate sector in the UK. That’s a lot of people handling a lot of personal data.

“It’s an important responsibility to get that right.

“We’d urge agents to take the time to look at our recommendations. The measures we list are far less painful than the cure of a £500,000 fine.”

The ICO’s recommendations are here