GDPR in Property Management 2026: What managers need to implement in practice

Problem: Tenant, applicant, and owner data are stored in Excel spreadsheets, shared email inboxes, and local network drives, without anyone being able to prove where which data is located and when it will be deleted.

Cause: The most common starting point for problems is not negligence, but a lack of structure, because without defined processes for data retention, data protection obligations cannot be met systematically.

Thesis: GDPR compliance in property management is not a one-off project to be ticked off with a data protection officer, but a permanent process issue.

Which GDPR obligations apply to property management companies

Direct answer: Property management companies process personal data of tenants, applicants, and owners on a daily basis and are therefore fully bound by the GDPR. Obligations include: Record of processing activities (Art. 30 GDPR), technical and organizational protective measures (Art. 32), deletion concept after contract end, and written data processing agreements with external service providers.

Why GDPR is often underestimated in property management

An Excel spreadsheet with prospective tenants, emails with proof of income in the shared inbox, viewing reports on the local network drive. This situation is normal in many administrative offices. It is also a GDPR risk that is regularly overlooked.

This is due to a widespread misunderstanding: GDPR is perceived as an issue for large companies, as something for corporations with data protection departments. In fact, it applies to any organization that processes personal data, and a property management company with 200 units processes dozens of such data records every day. Tenant data, applicant data, owner data, craftsman data, viewing reports: all of this falls under the GDPR.

The most common starting point for problems is not negligence, but a lack of structure. Those who do not have defined processes for data retention cannot systematically fulfill data protection obligations either. GDPR compliance in property management is not a one-off project to be ticked off with a data protection officer, but a permanent process issue.

The five central GDPR obligations for property managers

1. Record of processing activities (Art. 30 GDPR)

Every property management company must document what personal data it stores, for what purpose, on what legal basis, and for how long. The record of processing activities (ROPA) is not an optional recommendation, but a legal obligation under Art. 30 GDPR.

For a property management company, this usually includes at least: tenant applications and their selection, ongoing tenancies including payment data, owner communication, lists of interested parties, orders for craftsmen and service providers, and viewing documents. Each of these categories must be described in the ROPA with purpose, legal basis, recipients, and deletion period.

2. Technical and organizational measures (Art. 32 GDPR)

Art. 32 GDPR obliges controllers to take security measures corresponding to the state of the art. For property management companies, this specifically means: access rights restricted to what is necessary (employees only see data of their own properties), encryption when transmitting sensitive documents, data separation when changing systems, and protection against unauthorized access to physical documents.

A shared network drive without access control, which all employees can access, usually does not meet these requirements. The same applies to a shared email inbox where tenancy documents with creditworthiness proof end up.

3. Deletion concept after contract end (Art. 17 GDPR)

Personal data must not be stored indefinitely. According to Art. 17 GDPR, there is a right to deletion as soon as the purpose of storage no longer applies. At the same time, commercial and tax retention periods exist, which may prohibit immediate deletion.

For the practice of a property management company, this results in specific deadlines:

• Tenancy agreement documents: six years under §257 HGB; where a document is also an accounting record, eight years. The period starts at the end of the calendar year in which the document was created (§257 (5) HGB); during an ongoing tenancy the documents are needed for performing the contract in any case.

• Tenancy correspondence: six years, as commercial correspondence under §257 HGB. The three-year standard limitation period under §195 BGB is a limitation period, not a retention period.

• Applicant data after rejection: In principle, this data is to be deleted once the selection process has been completed. For cases in which claims under § 21 AGG may arise, the DSK orientation guide (Version 2, January 2026) names six months at the latest as the regular limit.

A deletion concept is not a list of deadlines, but a documented process that ensures data is actually deleted at the right time. Handling this process manually, i.e., delegating it to individuals as separate steps, is prone to errors. Audit-proof documentation in property management requires that retention periods are mapped system-side and not managed from memory.

4. Data processing agreements with external service providers (Art. 28 GDPR)

Anyone who passes on personal data to external service providers must conclude a written data processing agreement (DPA) in accordance with Art. 28 GDPR. This affects property management companies more broadly than is often assumed: tenant communication portals, real estate portals (insofar as applicant data is transmitted), external accounting service providers, craft businesses that gain access to apartments and write up reports, and providers of the management software used.

If a DPA is missing, there is a data protection breach, regardless of whether damage has actually occurred. The supervisory authorities regularly check the existence of DPAs.

5. Right of access (Art. 15 GDPR)

Tenants, applicants, and owners have the right to request information about what personal data is stored about them, for what purpose, and to whom it has been passed on. According to Art. 15 GDPR, this information must be provided within one month.

Without a documented process for handling access requests, this deadline can hardly be reliably met. Anyone who only starts searching for where which data of the data subject is stored when a request is received quickly loses time. A defined process of who receives the request, which data categories are to be queried, and who approves the response is part of GDPR-compliant data retention.

How well is your management set up against manual compliance risks? Download POV paper "Why manual compliance does not hold up" and assess your own situation.

The most common mistake: Tenant data in the email inbox instead of the system

The typical process for tenant applications in many management offices looks like this: Interested parties send documents by email. The email ends up in the shared inbox. The administrator prints out the documents or saves them in a local folder. After the decision, the rejection is also sent by email. The documents remain in the inbox.

This process creates four parallel data storage locations: the email inbox, the local folder, the printer output, and the administrator's memory. None of these locations is recorded in the ROPA, no deletion time is defined, no access right is controlled. This is not an exceptional state, but the rule in businesses without structured data retention.

The problem is not email as a communication channel, but email as a filing system. As soon as personal data remains permanently in email inboxes, a data silo is created that meets neither the requirements of Art. 30 nor of Art. 17 GDPR.

Structure beats knowledge

In practice, GDPR compliance is not a question of knowledge, but a question of structure. Anyone who knows which deletion periods apply but has no process to enforce them will still violate the GDPR because individual employees make exceptions, forget documents, or set other priorities in their daily work.

Closing the gap system-side

A guided workflow system can close this gap structurally: Applicant data is recorded in a defined place and not distributed by email. Deletion periods are stored system-side. Access rights are defined by role. Access requests follow a documented process.

Structural basis instead of individual diligence

This does not mean that every compliance requirement is automatically met. It means that the structural basis for GDPR-compliant data retention is in place, and that it does not depend solely on the diligence of individual employees. Setting up an auditable letting process that is designed to be GDPR-compliant requires this structural basis.

Conclusion

GDPR obligations in property management are not a bureaucratic add-on. They are a direct consequence of the fact that personal data of tenants, applicants, and owners are processed daily. The record of processing activities, deletion concepts, data processing agreements, and a documented process for access requests are not optional measures, but legal requirements.

The first step is not a data protection project, but an inventory: Where is which personal data currently located? Who has access? Which deletion periods apply and who is responsible for ensuring they are met? Answering these four questions is the entry point into GDPR-compliant data retention.

Download POV paper "Why manual compliance does not hold up" | Request Demo

Additional note: Credit check and DSK orientation guide V2

A special case within the GDPR requirements concerns tenant selection: Which data may be requested when in the application process? In January 2026, the German Conference of the Independent Data Protection Authorities (DSK) published an updated orientation guide (Version 2) that defines a step-by-step logic for data collection in tenant applications. According to this, data such as proof of income and credit reports (Schufa) may only be requested from a certain stage of the selection process.

For the GDPR-compliant archiving of these documents, the same principles apply as for all other applicant data: storage only as long as necessary, deletion after the process is completed, no remaining in email inboxes. Details on the data protection-compliant implementation of the credit check in accordance with the guidelines of the DSK orientation guide V2 can be found in the article Credit check in tenant selection.

We do not provide legal advice. Property managers are best advised to clarify individual legal questions with a specialized lawyer or their association (VDIV, IVD).

Q: Do property management companies have to appoint a data protection officer?

A: The obligation to appoint a data protection officer (DPO) arises from Art. 37 GDPR and depends on certain criteria, not on company size alone. Private companies must appoint a DPO if they carry out extensive systematic monitoring of individuals or process special categories of personal data (such as health data) on a large scale. Property management companies do not usually fall under this obligation automatically. However, the Federal Data Protection Act (BDSG) also applies: Under §38 BDSG, a DPO must be appointed if at least 20 people are constantly employed in the automated processing of personal data. Below this threshold, the legal obligation to appoint a DPO does not apply, but the recommended practice of data protection remains unchanged. In case of uncertainty, it is advisable to contact the competent supervisory authority of the respective federal state.

Q: How long may I store applicant data after a rejection?

A: After the selection process is completed and the rejection is sent, the original purpose of storage no longer applies. The GDPR requires the deletion of data as soon as this purpose no longer exists (Art. 17 GDPR). For cases in which claims under the General Equal Treatment Act (AGG) may arise, the DSK orientation guide (Version 2, January 2026) names six months at the latest as the regular limit, because the documents may be needed during this period to defend against such claims. After this period has expired, applicant data must be completely deleted, including from email inboxes and local folders. There is no legal basis for longer retention.

Q: What happens during a GDPR audit in property management?

A: Data protection supervisory authorities can carry out audits on their own initiative (without cause), in response to complaints from data subjects, or after a reported data breach. As part of an audit, the authorities typically request inspection of the record of processing activities, proof of concluded data processing agreements, documentation of technical and organizational measures, and evidence of how access requests were handled. If the record is missing or DPAs cannot be presented, fines can be imposed. These are based on Art. 83 GDPR and can amount to up to 20 million euros or 4 percent of global annual turnover in the case of serious violations. In practice, fines against small and medium-sized property management companies are usually in the low five-figure range if intent is ruled out and the willingness to cooperate is high.

Q: Do I need a data processing agreement with my tenancy management software?

A: Yes. If a software provider processes personal data on behalf of a property management company, i.e., can access the data, for example for maintenance, support, or data storage in the cloud, this constitutes data processing on behalf of a controller within the meaning of Art. 28 GDPR. In this case, a written DPA is mandatory. This applies regardless of whether the provider is based in Germany, the EU, or outside the EU. For providers outside the EEA, suitable guarantees for data transfer are also required (e.g. EU standard contractual clauses). Serious software providers provide a DPA as standard. If this is missing, it should be actively requested, as the absence of a DPA already constitutes an independent data protection violation.