In what looks like a massive breach of data protection, contact details of hundreds of landlords and agents were revealed in an email sent by the compulsory registration programme, Rent Smart Wales.

The email from Rent Smart Wales was intended to be sent to landlords who had not completed the registration process.

But one of those who received it was Hannah McCartan, managing director of Swansea-based McCartan Lettings & Property Management, who has been fully signed up to the scheme for months.

Cardiff council, which handles Rent Smart Wales on behalf of the Welsh government, said it is aware of the issue and it is being investigated.

Since November all landlords who rent out a property need to register with Rent Smart Wales by law and also be licensed if they carry out any property management duties, such as finding tenants. If they are not licensed, landlords must use a licensed agent to manage the property.

Rent Smart Wales believes there are 208,000 privately-rented properties in Wales, but only 65% had been registered by November’s deadline.

The email sent out last Thursday said: “We are writing this email to you as you have a started but not complete (sic) landlord registration with Rent Smart Wales.”

A follow-up email – this time not showing recipients’ email addresses – was sent on Friday, with the assurance that the scheme takes data protection very seriously.

A spokesperson for McCartan Lettings & Property Management expressed dismay at the email – and frustration at the scheme generally.

The spokesperson said: “We are in favour of regulation and of programmes that help our landlords raise the standard of letting in Wales – especially as more people in the UK are choosing to rent long term.

“However, we are deeply disappointed that one of our directors’ email address was included in this, and concerned that potential recipients could wrongly assume we are not compliant with the new law.

“After widespread apathy from the Welsh public towards the legislation, as well as chronic understaffing leading to lengthy wait times for licences to be processed, an inability to reach members of staff with queries or issues by phone, and questions being raised regarding policing, this does not bode well for Rent Smart Wales.”

Douglas Haig, director in Wales for the Residential Landlords Association, said: “We have long been warning of the need for greater security around the Rent Smart scheme to prevent this kind of error occurring.

“With landlords and letting agents expected to register by law, they need to have the confidence that their personal details will be handled sensitively.

“Whilst we are sure this was an innocent mistake and a simple case of human error, we would like to see measures put in place to ensure it cannot happen again.”

A Rent Smart Wales spokesman at Cardiff Council said: “Rent Smart Wales is aware that an issue arose on February 2 in relation to contacting customers.

“Rent Smart Wales and the City of Cardiff Council take data protection seriously. The matter is currently being investigated in line with the council’s data protection policies.”