GDPR in renting: Correctly implementing data protection in the rental process

The General Data Protection Regulation (GDPR) has also changed many processes in the real estate industry. Particularly during the letting process, numerous personal data are processed – from the initial prospective tenant inquiry to the selection of a tenant.

For real estate companies, housing associations, and brokers, the question regularly arises as to which data may be collected in the context of letting and how this must be processed in compliance with the GDPR.

In practice, many uncertainties arise: What information may be requested from prospective tenants? How long may applicant data be stored? And how can data protection requirements be structurally implemented in the letting process?

In this article, you will learn what requirements the GDPR places on letting processes, what typical data protection risks exist, and how digital letting processes can help to implement data protection in a structured manner.

What does GDPR mean for letting?

The GDPR regulates the handling of personal data across Europe. For letting, this means: All information that can be assigned to a specific person is subject to data protection. This includes, for example, contact details, proof of income, or ID documents of prospective tenants.

In the letting process, this data is regularly collected, stored, and processed. Real estate companies must therefore ensure that processing is lawful, that only necessary data is collected, and that sensitive information is protected.

Personal data in the letting process

Personal data is already processed at the initial point of contact with prospective tenants. As the letting process progresses, additional information is added.

Typical data in the letting process includes:

• Name and contact details

• Details about income

• Information on employment status

• Self-disclosure of the prospective tenant

• Proof of creditworthiness or credit report (e.g., SCHUFA)

In principle, this data may only be collected if it is necessary for the letting process.

Basic principles of the GDPR

The GDPR is based on several basic principles that also apply to the letting process.

These include:

• Purpose limitation of data processing

• Data minimization

• Transparency towards applicants

• Protection of personal data

For landlords, this means, among other things, that only information necessary for the decision on a tenancy may be requested.

Typical data protection problems when letting

In practice, data protection problems often arise from unstructured processes. Especially when many applications are received, data is processed through various channels.

Applications via different channels

Prospective tenants often send their documents in several ways.

Typical examples are:

• Email attachments

• Online forms

• Paper documents

• Real estate portals

As a result, multiple versions of the same documents are quickly created.

Unstructured storage of applicant data

When applications are received by email or stored locally, there is often a lack of a clear structure for data management.

Typical problems are:

• documents saved multiple times

• lack of overview of applications

• unclear responsibilities

This not only complicates the organization of the letting process but also increases the risk of data protection violations.

Storing data for too long

Another common mistake is storing applicant data for too long. If a tenancy does not come about, personal data must generally be deleted after a certain period of time.

Without structured processes, this deletion is often forgotten or delayed.

What personal data is processed in the letting process

Different types of data are processed during a tenancy. These arise in different phases of the letting process.

Data during the prospective tenant inquiry

Prospects already provide personal information during the first contact.

This often includes:

• Name

• Telephone number

• Email address

• Interest in a specific apartment

This data is used to answer inquiries and coordinate viewing appointments.

Data during the application process

If prospects apply specifically for an apartment, additional data is required.

Typical documents are:

• Tenant self-disclosure

• Proof of income

• Credit report (e.g., SCHUFA)

• Identity documents

This information helps landlords check the financial capability and reliability of potential tenants.

Data after contract conclusion

Even after a lease agreement has been signed, personal data continues to be processed.

Examples are:

• Contract data

• Bank details

• Communication data

• Documents for the apartment handover

This data must also be stored and protected in compliance with the GDPR.

GDPR-compliant organization of applicant data

In order to implement data protection requirements in the letting process, real estate companies need clear processes and technical support.

Clear data structure in the application process

A structured application process helps to collect and manage data correctly.

Important measures are:

• centralized storage of applicant data

• clear responsibilities within the team

• documented processes for data processing

This makes it easier to monitor and control data protection requirements.

Transparency towards prospective tenants

The GDPR requires that applicants be informed about how their data is processed.

This includes, for example, information about:

• Purpose of data collection

• Duration of data storage

• Rights of the data subjects

This information is often provided in privacy policies or application forms.

Deletion periods for applicant data

An important component of the GDPR is compliance with deletion periods. If an applicant does not receive a lease agreement, their data may only be stored for a limited period of time.

Many companies orient themselves toward periods of about three to six months to cover potential legal claims.

How digital letting processes help with data protection

Digital systems can support real estate companies in implementing data protection requirements in a more structured manner. Especially when dealing with a large volume of applications, digital processes provide better overview and control.

Centralized management of applicant data

Digital letting platforms bundle all applicant data in one system.

This offers several advantages:

• structured management of applications

• clear access rights for employees

• traceable documentation of processes

This enables better protection of personal data.

Automated deletion processes

Another advantage of digital systems is the automated management of data.

Examples are:

• automatic deletion periods for applicant data

• structured documentation of data processing

• centralized management of documents

This reduces the risk of personal data being stored for too long.

Transparent letting processes

Digital letting processes ensure not only efficiency but also more transparency in handling data.

You can learn more about modern letting processes here:

Letting real estate professionally: How EverReal is revolutionizing the letting process

Digital contract processes can also contribute to structured data processing:

Digital signature in lease agreements: Benefits, legal aspects, and implementation

The GDPR places clear demands on the handling of personal data in the letting process. Real estate companies must ensure that applicant data is lawfully collected, securely stored, and deleted in a timely manner.

In practice, data protection problems often arise from unstructured processes and manual data management. Digital letting processes can help to organize data centrally, comply with deletion periods, and systematically implement data protection requirements.

Companies that digitally structure their letting processes not only improve their efficiency but also their data protection organization.

What data are landlords allowed to request according to GDPR?

Landlords may only collect personal data that is necessary for making a decision on a tenancy. This includes, for example, contact details, proof of income, or credit information.

How long can applicant data be stored?

If no tenancy agreement is established, applicant data may generally only be stored for a limited period. Many companies align their practices with periods of about three to six months.

What data protection problems arise in the letting process?

Typical problems arise from unstructured data storage, multiple communication channels, and a lack of deletion processes for applicant data.

How can digital systems help with data protection?

Digital letting platforms bundle applicant data centrally, manage access rights, and support automated deletion processes. This significantly facilitates compliance with data protection requirements.