Credit checks in tenant selection: What is allowed, what is not, and what the DSK 2026 regulates

Problem: During tenant screening, it is easy to ask for more information than data protection supervisory authorities deem necessary.

Cause: Inconsistent processes and the assumption that a signed consent form is sufficient as a legal basis, even though the guidance document does not consider consent in self-disclosure forms to be the appropriate tool.

Thesis: The DSK Guidance Document V2 (January 2026) outlines which information is generally required at which stage. Establishing these milestones within one's own workflow reduces operational risk instead of relying on employee training to mitigate it.

What is permitted during credit checks in tenant screening?

Direct answer: The guidance document of the German Data Protection Conference (DSK, V2.0, January 2026) distinguishes between up to three stages. For a viewing appointment, first name, last name, and contact details are sufficient (for social housing, additionally the certificate of eligibility); information regarding economic circumstances is generally not yet required. If prospective tenants declare their intention to rent a specific apartment, asking about employer and occupation, net income, opened consumer insolvency proceedings, and eviction orders due to rent arrears from the past five years is considered permissible. Verification documents such as payslips or redacted bank statements are only intended after the decision to select a specific applicant. A copy of an identity card is not required for a viewing appointment and is therefore inadmissible. The guidance does not consider consent forms for self-disclosure to be the appropriate tool; Art. 6(1)(f) GDPR generally applies, and Art. 6(1)(b) applies at the latest once the intention to rent is declared. According to the guidance document, data must be erased as soon as the purpose ceases to exist—typically at the latest after six months in the case of potential claims under the AGG (General Equal Treatment Act). Source: DSK Guidance Document V2.0, January 2026.

Legal basis: Legitimate interest, not consent

Landlords and property managers sometimes have prospective tenants sign a consent declaration and assume that GDPR requirements are thereby fulfilled. The guidance document takes a different view.

The DSK Guidance Document V2 does not consider declarations of consent in self-disclosure forms to be the appropriate mechanism. It justifies this firstly by the statutory legal basis under Art. 6(1)(b) and (f) GDPR, and secondly by the lack of voluntariness: If entering into the tenancy agreement depends on providing the information, freely given consent cannot be established (Art. 7(4) GDPR).

The legal basis for a viewing appointment is legitimate interest pursuant to Art. 6(1)(f) GDPR. Landlords have a legitimate interest in organizing the letting process and collecting the necessary information for that purpose. At this stage, this essentially consists of name and contact details. According to the guidance document, information on economic circumstances is generally not yet required for a mere viewing appointment. Thus, the legitimate interest only holds as long as data collection remains limited to what is necessary and the tiered approach is adhered to.

However, this basis does not apply throughout the entire process. As soon as prospective tenants state their intention to rent a specific apartment, a pre-contractual relationship is established. From this point onward, according to the guidance, Art. 6(1)(b) GDPR is the decisive legal basis rather than point (f), and from here it considers questions regarding employer, profession, net income, and comparable creditworthiness information permissible. In practice, this means: The legal basis changes throughout the procedure, and it is tied to the declared intention to rent, not the viewing appointment alone. Where one of these two legal bases is available, consent is not the appropriate mechanism according to the guidance.

What changed in 2026: DSK Guidance Document V2

The benchmark of the data protection supervisory authorities for tenant selection is the DSK Guidance Document V2.0, January 2026 (datenschutzkonferenz-online.de). It supersedes V1.0 from January 24, 2024.

Anyone still working with V1.0 should obtain V2.0. The following outlines V2.0.

The tiered approach: What is permissible when

The DSK Guidance Document V2 structures permissible data processing according to the status of the application procedure, distinguishing between up to three stages.

Stage 1: Advertisement, initial inquiry, and viewing appointment

• Permissible data: Name, contact details

• Information on economic circumstances is generally not yet required here

• If prospective tenants view the apartment alone, the information may be verified by presenting an ID card, and the verification may be documented. In doing so, copying the ID card is not required according to the guidance and is therefore inadmissible.

Stage 2: Declaration of intent to rent a specific apartment

• Permissible data: Employer and profession, amount of net income and the disposable amount remaining for rent after deducting ongoing monthly obligations, opened consumer insolvency proceedings, eviction orders due to rent arrears from the past five years

• The trigger is the declared intention to rent, not the viewing alone

• Practical rule of thumb (not from the guidance): Gross cold rent should not exceed approximately one-third of net income.

Stage 3: Decision in favor of an applicant

• Proof of income is now permissible, for example via copies of pay slips, income tax assessments, or bank statements, in each case with non-essential information redacted

• A credit report also belongs to this stage and may only contain information necessary for the tenancy

Not required according to the guidance

• An ID copy during the viewing appointment, unredacted bank statements, and generally information on financial circumstances during the viewing appointment

The guidance represents the common view of the German data protection supervisory authorities, is not a law, and serves as an important benchmark for practical operations.

Establish stages in your own workflow

Where the process is not standardized, staff can easily end up requesting different documents at different times. It is helpful to determine internally once and for all which details are requested at which stage, and to embed this definition into the operational workflow rather than relying on training materials.

Have IDs shown rather than copied

If identity needs to be verified during an unattended viewing, ask to see the ID and record the check in a file note; the guidance considers this permissible. Define internally who stores the note and where, and do not make a copy.

Establish erasure periods

Determine when applicant data must be erased and automate the retention period within the workflow rather than tracking it in individual employees' calendars. The standards for this are outlined below in the section on erasure obligations.

Integrate data protection into overall management

The tiered approach to credit checks is one element of data protection obligations, not the entirety of them. Further notes on general data protection compliance in property management can be found in the article on GDPR in property management.

Conclusion

Conducting credit checks during tenant screening is not prohibited, but according to the guidance document, it must follow specific stages. The DSK Guidance Document V2 (January 2026) specifies which data is required when, what it considers the applicable legal basis, and when data must be deleted. Knowing these standards and incorporating them into internal processes protects property managers against avoidable risks.

If prospective tenants view the property alone, the landlord is permitted to have the ID shown; making a copy is not necessary and therefore not permitted. The guidance does not consider declarations of consent in self-disclosure forms to be the proper mechanism. Applicant data must be erased as soon as the purpose ceases; where claims under the AGG are possible, the guidance generally specifies a maximum period of six months.

Schufa score as automated decision-making

The European Court of Justice ruled on December 7, 2023 (C-634/21, curia.europa.eu) that a Schufa score is considered an automated decision within the meaning of Art. 22 GDPR if it plays a "determining role" in a rejection. This means: If a prospective tenant is rejected solely or predominantly based on a Schufa score, this process is subject to the requirements of Art. 22 GDPR, including information obligations and the right to human intervention.

Note on product availability: Schufa Wohnungsscoring, which was previously directly accessible to landlords, was discontinued as of April 1, 2024. It is no longer available to landlords and property managers.

Erasure obligations: When must applicant data be deleted?

The DSK Guidance Document V2 does not establish a blanket retention period, but instead links it to the processing purpose:

• General rule: Erasure as soon as the purpose of processing ceases to exist (Art. 17(1)(a) GDPR); in the event of a rejection, immediately thereafter

• If claims under the AGG are possible: generally after six months at the latest, provided no further assertion of claims is in question

• Exception: Longer retention if legal proceedings are specifically expected or already pending

Any exception must be documented and justified. Blanket retention "just in case" without a specific justification is insufficient under data protection law. The erasure period applies to all data collected during the application process, including creditworthiness documents and verification records.

Audit-compliant documentation in property management helps manage erasure periods transparently and provides proof of timely erasure in the event of a dispute.

We do not provide legal advice. Property managers should clarify specific legal issues with a specialized attorney or their professional association (VDIV, IVD).

Sources:- DSK Guidance Document V2.0, January 2026- CJEU Judgment of December 7, 2023, C-634/21- Art. 5(1)(c), Art. 6(1)(b), Art. 6(1)(f), Art. 17(1)(a), and Art. 22 GDPR

Q: Am I allowed to ask prospective tenants for their Schufa credit report?A: According to the DSK Guidance Document V2, obtaining a credit report itself belongs to the final stage—meaning after the decision in favor of a specific applicant—and it may only contain information necessary for the rental relationship. A full Schufa report exceeds this. As early as the declared intent to rent, however, the guidance considers it permissible to ask about opened consumer insolvency proceedings and eviction orders due to rent arrears from the past five years. In addition: If the Schufa score plays a "determining role" in a rejection, Art. 22 GDPR applies (CJEU C-634/21, December 7, 2023). Furthermore, it should be noted that the former Schufa Wohnungsscoring for landlords was discontinued on April 1, 2024, and is no longer available.

Q: Are ID copies permitted during tenant screening?A: According to the DSK Guidance Document V2 (January 2026), an ID copy is not required at the viewing appointment and is therefore inadmissible. If prospective tenants view the property alone, the landlord may have the ID shown and document that the check took place.

Q: How long may I retain applicant data after a rejection?A: The DSK Guidance Document V2 does not specify a blanket standard retention period. The baseline rule is erasure as soon as the processing purpose ceases to exist (Art. 17(1)(a) GDPR), meaning immediately after a rejection. If claims under the AGG are a factor, the data must generally be erased at the latest after six months, provided no further assertion of claims is in question. Extended retention is only permitted if a legal dispute is concretely expected or already underway, and must be documented and justified. Property managers are best advised to resolve specific legal questions with a specialized lawyer or their industry association (VDIV, IVD).

Q: Which version of the DSK Guidance Document is currently applicable?A: V2.0 (January 2026) supersedes V1.0 from January 24, 2024. Anyone still using V1.0 should download V2.0 directly from datenschutzkonferenz-online.de.