Keys, Fobs and Alarm Codes: A Handover Checklist That Protects You Both

The first time a client hands you a front door key with a little cardboard tag on it, something changes. You're no longer someone who turns up and cleans. You're a person who can walk into somebody's home when they're not there. Clients feel that shift, and so should you.

It's also the point where your insurance, your data protection obligations and your reputation all get tested at once. The good news is that a proper protocol takes about twenty minutes to set up and roughly five minutes per new client thereafter.

What your insurer is quietly expecting

Dig out your policy wording and read the section on keys. Most UK cleaner's insurance policies — public liability, and often contents or goods-in-trust cover — include conditions about how client keys are handled. Typical requirements look like this:

• Keys must not be left on the premises unattended, and never left in a lock or under a mat.
• Keys must not be identifiable with the client's address if they're lost or stolen.
• Keys should be kept in a locked cabinet or safe when not in use.
• Client keys should not be left in a vehicle overnight.
• Loss or theft of keys must be reported to the client promptly.

Breach one of those and you may find a claim refused, or an excess applied that you weren't expecting. It's worth a phone call to your broker to ask, in plain terms, what your policy requires and whether goods in trust are covered — that is, clients' property in your care.

The handover: two signatures, five minutes

Whoever hands over keys, both of you sign the same sheet. It takes minutes and it settles almost every argument later. Record:

• The client's name, site address and your internal client reference.
• What is being handed over: front door key, back door key, fob, key safe code, alarm code, gate code.
• Whether any key is a master key or gives access to communal areas or other flats.
• Who else holds a copy — family, letting agent, building manager.
• The alarm procedure: entry code, exit code, how long before the alarm arms, what to do if it goes off.
• What the client wants you to do if you can't get in, or if something looks wrong.

The client keeps a copy. You keep a copy. If keys are later returned, log that too, with a date and a signature.

Labelling without advertising the address

Never write a client's address on a key tag. If a set is lost, an addressed tag is a burglar's dream. Instead, use a short code — 'C-014' or 'JH-03' — and keep the code-to-client mapping in your records, not on the ring.

One habit worth building early: the key register and the keys should never travel in the same bag. If your kit gets stolen from the van and the register is in there too, you've handed over access to a dozen homes and the addresses to use them on.

GDPR: the keys aren't data, the register is

Client names, addresses, phone numbers, alarm codes and key codes are all personal data, and some of it is sensitive in a practical sense. You're processing it under the contract you have with the client, which is a lawful basis — but that doesn't mean anything goes.

A few sensible rules:

• Only record what you actually need. You don't need a client's date of birth to clean their kitchen.
• Store the register in one place — a password-protected spreadsheet or a job management app — not spread across texts, WhatsApp threads and the back of an envelope.
• Don't send alarm codes over unencrypted channels more than necessary, and delete the message afterwards.
• Have a short privacy notice explaining what you hold and how long you keep it.
• When a client leaves, return the keys, log it, and delete their records after the period you've stated — keeping enough to satisfy HMRC for invoices, but not their alarm code forever.
• Most small businesses that process personal data electronically need to pay the ICO data protection fee. It's modest, and it's a legal requirement.

If a bag containing keys and the register goes missing, treat it as a personal data breach. The risk to clients is physical, not just informational, so tell them straight away and consider whether it needs reporting to the ICO within 72 hours. Having a one-page plan for that scenario beats improvising it at 9pm on a Friday.

Lone working: the bit clients never think about

Most cleaners work alone, in other people's houses, often with nobody knowing exactly where they are. That's a genuine risk and it deserves a written risk assessment — even a short one.

In practice: share your day's schedule with a second person, agree a check-in text at the end of each job, keep a phone charged and on you, and agree with clients in advance what you'll do if the alarm is going off or the door is open when it shouldn't be. The answer is usually: don't go in, call the client, call the police if it looks like a break-in.

Add a line to your terms reserving the right to leave a property if you feel unsafe, and back it up in practice. No job is worth that risk.

What to put in the terms before the first handover

• The client authorises you to hold keys and codes for the duration of the contract only.
• You are not a keyholding or emergency response service; you won't attend outside scheduled visits.
• If keys are lost or stolen, you'll cover reasonable lock-change costs up to a stated limit, or your insurance excess — whichever is lower. Put a number in there.
• Keys are returned within an agreed period after the contract ends, and a charge applies if the client doesn't collect them.
• Sub-contractors or staff may access the property, and are vetted and bound by the same rules.
• No keys are accepted without a signed handover record.

That last clause protects you more than any other. It turns a vague favour into a documented arrangement, and it signals to clients that you take their home seriously — which is exactly the impression you want before you've cleaned a single room.