Credit checks in tenant selection: What is allowed, what is not, and what the DSK 2026 regulates

Problem: During tenant selection, data is regularly collected that is not permissible under data protection law, such as ID copies or self-disclosure forms prior to the viewing appointment.

Cause: Unstructured processes and the widespread misconception that a signed consent form suffices as a legal basis, even though it is practically ineffective in a tenancy relationship.

Thesis: The DSK Guidance V2 (January 2026) specifies a clear phased logic, and those who structurally anchor it in their process workflow prevent violations in day-to-day operations rather than trying to intercept them through training.

What is permitted during credit checks in tenant selection?

Direct answer: In tenant selection, credit data is permissible in stages. For initial inquiries and viewing appointments, only name and contact details may be processed. As soon as prospective tenants state that they wish to rent a specific apartment, employment, net salary, open insolvency proceedings, and payment defaults are permissible. Verification documents such as pay slips or redacted bank statements follow only after a decision has been made in favor of an applicant. ID copies are not permitted. The legal basis is not consent (ineffective), but Art. 6(1)(f) GDPR; once rental intent is stated, Art. 6(1)(b) becomes decisive. Data must be deleted as soon as the purpose ceases to apply, typically within six months at the latest in case of potential claims under the AGG (General Equal Treatment Act). Source: DSK Guidance V2, January 2026.

Legal basis: Not consent, but legitimate interest

A common error in practice: landlords and property managers have prospective tenants sign a consent form, assuming this fulfills GDPR requirements. This is incorrect.

The DSK Guidance V2 establishes that consent is not a valid legal basis in a tenancy relationship. The power imbalance between landlord and prospective tenant renders genuinely voluntary consent practically ineffective: applicants cannot refuse consent without jeopardizing their chances of being considered.

The legal basis at the viewing appointment is legitimate interest under Art. 6(1)(f) GDPR. Landlords have a legitimate interest in organizing the leasing process and collecting the necessary information. At this stage, this essentially means name and contact details. According to the guidance, financial circumstances are generally not yet necessary for a mere viewing appointment. Legitimate interest therefore only holds as long as data collection remains limited to what is necessary and the phased logic is observed.

However, this basis does not apply throughout the entire process. As soon as prospective tenants declare their intent to rent a specific apartment, a pre-contractual relationship is established. From this point forward, according to the guidance, Art. 6(1)(b) GDPR is authoritative rather than lit. f, and only then do employment status, net salary, and comparable credit data become permissible. In practice, this means: the legal basis shifts during the process and depends on the declared intent to rent, not on the viewing appointment alone. If one of these two legal bases is available, recourse to consent is inadmissible.

What changed in 2026: DSK Guidance V2

The authoritative standard for data-protection-compliant credit checks in tenant selection is the DSK Guidance V2.0, January 2026 (datenschutzkonferenz-online.de). It replaces V1.0 from January 2024 and contains revised rules regarding the phased logic, permitted data categories, and the legal basis.

Anyone still relying on V1.0 or who has not yet incorporated the update is working on an outdated basis. V2 has been the valid reference since January 2026. The following sections exclusively reflect the requirements of V2.

The Phased Logic: What is permissible when

The DSK Guidance V2 structures permissible data processing according to the stage of the application process, distinguishing up to three milestones. Premature data collection is not permitted.

Stage 1: Listing, initial inquiry, and viewing appointment

• Permitted data: Name, contact details

• Information regarding financial circumstances is generally not yet required at this stage

• Details may be verified by presenting an ID card and the verification may be documented. Creating an ID copy remains impermissible here as well.

Stage 2: Declaration of intent to rent a specific apartment

• Permitted data: Employment, amount of net income, disposable amount available for rent after deducting ongoing monthly liabilities, open insolvency proceedings, rental payment defaults

• The trigger is the declared intent to rent, not the viewing appointment alone

• Practical benchmark (not from the guidance): Gross base rent (Bruttokaltmiete) should not exceed approximately one-third of net income.

Stage 3: Decision in favor of an applicant

• Proof of income is now permissible, for instance via pay slips, income tax assessments, or copies of bank statements, each with non-essential details redacted

• A credit report also belongs to this stage and must only contain details necessary for the tenancy

Never permitted, regardless of the stage

• ID copies, unredacted bank statements, self-disclosure forms prior to viewing

The phased logic is not optional. A self-disclosure form requested prior to the viewing violates DSK specifications. The same applies to requesting an ID copy at any stage of the process.

Unlock data requests only after the viewing step

Most data protection violations in tenant selection do not stem from malicious intent, but from unstructured processes: one employee sends the self-disclosure form before the viewing, another requests an ID scan, and a third stores files without deletion deadlines. A guided, auditable leasing process ensures the phased logic structurally: further data requests are only enabled after the viewing stage.

No data field for ID copies

The system does not feature a data field for ID copies. This ensures compliance with the DSK phased logic through the workflow itself rather than relying on training and notice boards, significantly reducing the risk of deviations in daily operations.

Automate deletion reminders

Following a rejection, the process triggers a reminder to observe the retention deadline. As a result, data deletion remains traceable within the workflow rather than depending on the memory of individual employees.

Address data protection as an overall responsibility

The phased logic in credit checks is just one component of overall data protection obligations. Supplementary guidance on comprehensive data protection responsibility in management can be found in the article on GDPR in property management.

Conclusion

Credit checks during tenant selection are not prohibited, but strictly regulated. The DSK Guidance V2 (January 2026) specifies which data may be collected when, which legal basis applies, and how long data may be retained. Those who understand the phased logic and structurally embed it in their workflow safeguard their management operations against avoidable risks.

ID copies are not permitted. Consent is not a valid legal basis. Applicant data must be deleted as soon as its purpose ceases; if claims under the AGG are conceivable, the guidance regularly cites a maximum of six months.

Schufa score as an automated decision

In its ruling of December 7, 2023 (C-634/21, curia.europa.eu), the European Court of Justice determined that a Schufa score constitutes an automated decision within the meaning of Art. 22 GDPR if it plays a "decisive role" in a rejection. This means: if a prospective tenant is rejected solely or predominantly based on a Schufa score, the process falls under the requirements of Art. 22 GDPR, including information obligations and the right to human review.

Note on product availability: Schufa housing scoring, which was previously directly accessible to landlords, was discontinued as of April 1, 2024. It is no longer available to landlords and property managers.

Deletion obligations: When must applicant data be deleted?

The DSK Guidance V2 does not set a blanket standard period, but ties retention directly to purpose:

• Principle: Deletion as soon as the purpose of processing ceases (Art. 17(1)(a) GDPR), meaning immediately after a rejection

• If claims under the AGG are possible: generally at the latest after six months, provided no further assertion of claims is to be expected

• Exception: longer retention if litigation is specifically anticipated or already pending

The exception must be documented and justified. Retaining data "just in case" without concrete justification is insufficient under data protection law. The deletion period applies to all data collected during the application process, including credit files and verification documents.

Audit-compliant documentation in property management helps manage deletion deadlines transparently and provide evidence of timely deletion in the event of a dispute.

We do not provide legal advice. Property managers are advised to clarify specific legal questions with a specialized attorney or their industry association (VDIV, IVD).

Sources:- DSK Guidance V2.0, January 2026- ECJ Judgment of December 7, 2023, C-634/21- Art. 5(1)(c), Art. 6(1)(b), Art. 6(1)(f), Art. 17(1)(a), and Art. 22 GDPR

Q: May I ask prospective tenants for their Schufa credit report?A: Once prospective tenants declare that they wish to rent a specific apartment, it is permissible to request information regarding rent arrears or ongoing insolvency proceedings. The credit report itself belongs to the final stage under DSK Guidance V2—after the selection of a specific applicant—and may only include information necessary for the lease. A full Schufa report exceeds this scope. In addition: if the Schufa score plays a "decisive role" in a rejection, Art. 22 GDPR applies (ECJ C-634/21, December 7, 2023). Furthermore, note that the former Schufa housing scoring for landlords was discontinued on April 1, 2024, and is no longer available.

Q: Are ID copies permitted during tenant selection?A: No. The DSK Guidance V2 (January 2026) specifies that collecting ID copies during tenant selection is not permitted. An ID copy contains information (place of birth, nationality, serial number) not required for credit assessments. The data minimization principle under Art. 5(1)(c) GDPR prohibits collecting unnecessary data. It is permissible to inspect the ID card and document that the check was performed.

Q: How long may I retain applicant data after a rejection?A: The DSK Guidance V2 specifies no blanket retention period. The baseline rule is deletion as soon as the purpose of processing ceases (Art. 17(1)(a) GDPR), meaning immediately after a rejection. If claims under the AGG are conceivable, data must generally be deleted at the latest after six months, provided no further claims are under consideration. Longer retention is permissible only if litigation is specifically anticipated or already initiated, and this must be documented and justified. Property managers should consult specialized legal counsel or their association (VDIV, IVD) for specific legal inquiries.

Q: What does the DSK Guidance V2 regulate differently compared to 2024?A: DSK Guidance V2 (January 2026) updates and clarifies the specifications of V1.0 from January 2024. Key aspects: clearer structuring of the phased logic (which data is permitted at which stage of the process), explicit clarification that consent is not a valid legal basis in tenancies due to structural power imbalances, and updated rules on deletion deadlines. Anyone still working with V1.0 should download V2 directly from datenschutzkonferenz-online.de and adjust their workflows accordingly.