Many fixed-term leases end in late autumn, so for a lot of small landlords the next job is finding someone new. You place the ad, the enquiries come in, and before long you have a folder full of other people's lives: payslips, bank statements, ID photos, messages about their kids and their jobs.

Most of that you never needed. Under the GDPR, which applies to you even if you let a single flat, a landlord who collects personal data from applicants is the data controller for that data. That means you collect only what you need for a clear purpose, keep it safe, and delete it when the purpose has gone. The good news is that doing it properly takes less paperwork, not more.

This guide goes stage by stage. It is based on the GDPR as it applies across the EU, with notes for the UK and Ireland. National rules differ, so check anything unclear with your data protection authority or a lawyer.

Stage 1: the first enquiry and the viewing

At this point you are talking to people, not choosing between them. You need to be able to reply to them and to know who is coming through the door.

What to ask: name, phone number or email address, and perhaps when they would like to move in and how many people would live there.

What not to ask yet: ID copies, bank statements, payslips, employer details, ID or tax numbers.

The Irish Data Protection Commission (DPC) has addressed this directly. In its guidance on requesting personal data from prospective tenants it notes that landlords often collect a lot of information from many applicants at the application stage, "the overwhelming majority of whom will not ultimately become a tenant". Its view is that detailed information is usually not needed until you have picked a preferred tenant. Back in 2014 it had already found no basis for collecting bank details, PPS numbers and utility bills at viewing stage, and it has said landlords should not ask for photos or PPS numbers before a lease is signed (Irish Times report). That guidance is Irish, but the principle behind it, data minimisation, is in the GDPR everywhere.

Stage 2: the serious applicant

Once someone has seen the place and wants it, and you are seriously considering them, you can reasonably check two things: can they pay, and how did their last tenancy go?

  • Ability to pay. The DPC considers it reasonable to ask for documents that confirm an applicant can pay the rent. That can be a recent payslip, an employment contract or, for the self-employed, a recent tax statement. If you ask for bank statements, you do not need every transaction: the DPC has said a statement showing running balances, with the transaction details removed, was enough. Invite applicants to black out what you do not need.
  • A previous landlord's reference. A short call or email to their previous landlord, with the applicant's knowledge, is usually the most useful check you can make. Ask about rent paid on time, the state of the property at the end and whether they would let to them again. Ask the applicant for the contact; do not go looking for it yourself.

One point that surprises many landlords: consent is usually the wrong legal basis here. The DPC warns that the imbalance between a landlord and someone who needs a home means consent is unlikely to be freely given. These checks normally rest on the steps needed before entering a contract or on your legitimate interest, which is exactly why they must stay proportionate.

In some countries tenants are used to offering a standard document, such as a credit report from a national credit bureau. Whether you can ask for one, and how, depends on local practice, so check yours.

Stage 3: signing the contract

Now you need enough to identify the parties properly and run the tenancy:

  • full name and current address of each adult tenant,
  • the identifying details your national practice expects in a lease (in Hungary, for example, contracts customarily include date and place of birth and mother's name),
  • contact details,
  • the bank account the rent will come from, if useful for matching payments,
  • an emergency contact, if the tenant wants to give one.

Anything required by law, such as tenancy registration or tax reporting in your country, can also be collected at this stage, because then you have a legal obligation as your basis.

Off limits at every stage

Some things you should not ask about or dig into at all:

  • Health, religion, ethnic origin, political views, sexual orientation. These are special categories of data under Article 9 of the GDPR, and in many countries asking about them when choosing a tenant can also be discrimination.
  • Social media. Scrolling through an applicant's profiles is collecting data you have no need for, and it will show you exactly the kind of information listed above. Leave it alone.
  • Criminal records. Under Article 10 of the GDPR, data about criminal convictions may only be processed under official authority or where national law specifically allows it. In many countries a private landlord has no such permission, so do not ask for a certificate of good conduct unless you have checked that your country's law allows it.

View, don't copy: ID cards

You may well want to see an ID card at signing, to make sure the person in front of you is the person named in the contract. Look at it, compare the details with the contract, and hand it back. Do not photocopy or photograph it.

This comes from the Hungarian authority NAIH's general position. In its statement on making copies of documents (NAIH/2018/3654) it says that showing a photo ID is the proper way to confirm identity, that a copy proves nothing about the original's validity, and that keeping copies breaches purpose limitation and data minimisation. NAIH has held that copying ID documents without a specific legal basis is unlawful even if the person consents, and it has fined organisations that did it. NAIH has not ruled on private landlords specifically, so this is our inference, but it is hard to see why a landlord would be treated differently from a bank or an employer. Other EU authorities generally take a similar minimal approach.

The UK exception. In England, landlords must carry out Right to Rent checks and keep copies of the documents, or save the online check, for the length of the tenancy and at least one year after. That is a legal obligation, so copying is lawful there. It applies to England only, and only to the documents and steps the check requires.

A short privacy notice

Applicants should know what you collect and why when you collect it. A few lines in the ad or a short message after the viewing is enough for a small landlord:

I use your contact details to arrange the viewing and to get back to you. If we go ahead, I will ask for proof of income and a previous landlord's contact. If you are not chosen, I will delete your information within a month of the property being let. You can ask me what I hold about you or ask me to delete it at any time.

Add your name and contact details, and mention the data protection authority as the place to complain. In the UK, check on the ICO website whether you need to pay the data protection fee.

Storing it safely

  • Keep everything in one place, not spread over your phone, two inboxes and a kitchen drawer.
  • Use a strong password and two-factor login on email and cloud storage.
  • Lock paper copies away and shred them when finished.
  • Do not forward applicants' documents to anyone who does not need them.

Once you have chosen, LeasingTrack can help keep things tidy: you invite the new tenant by email, and they see only their own lease, not your other properties or other applicants.

Deleting what you no longer need

Rejected applicants. Once the property is let and the new lease is signed, you no longer have a reason to keep the other applicants' payslips or references. The DPC says this data should be disposed of securely. The GDPR sets no fixed number of days; a few weeks after signing is a sensible, defensible habit. Delete the emails and attachments too, and check your downloads folder.

The chosen tenant. Keep the contract and payment records for the tenancy and for as long as you might need them for tax or legal claims afterwards. Those periods depend on your country (in Hungary, for example, the general limitation period for civil claims is five years). Payslips and bank statements from the application stage have done their job once the lease is signed, so you can usually delete them then.

In short

  1. Viewing: name and contact details.
  2. Serious applicant: proof of income and a previous landlord's reference.
  3. Signing: what the contract and the law require.
  4. Never: health, religion, sexual orientation, social media and, in many countries, criminal records.
  5. Look at ID, don't copy it, unless a law such as England's Right to Rent requires it.
  6. Tell people what you do, keep it safe, and delete what you no longer need.

This is a general guide, not legal advice. If your situation is unusual, ask your data protection authority or a lawyer.