All documents used to collect data, like tenancy agreements, application forms etc, must have a privacy policy covering:
What personal information is collected and why it’s needed;
How this information is used and who it might be shared with;
How long their personal information is retained.
This information should be available to tenants on a privacy statement.